CVE-2026-97308 WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login Lockdown = 2.17 versions...

CVE-2026-95526 WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...

CVE-2026-94675 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack = 6.2.13 versions...

CVE-2026-62072 WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...

CVE-2026-66588

...

CVE-2026-48199 WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Sermon'e = 1.0.2 versions...

CVE-2026-48197 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2026-42637 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...

CVE-2026-42638 WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1...

CVE-2026-42636 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.4.6 versions...

CVE-2026-42635 WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WooCommerce Simple Auctions = 3.0.10 versions...

CVE-2026-42634 WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Video Background Block – Use video as background in the section. = 2.0.3 versions...

CVE-2026-42418 WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5...

CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42415 WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Porto Theme - Functionality = 3.9.3 versions...

CVE-2026-42416 WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

Subscriber SQL Injection in UDesign Core = 4.15.0 versions...

CVE-2026-42414 WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

Subscriber SQL Injection in ListingPro = 2.9.12 versions...

CVE-2026-42413 WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Snapshotify All-in-One Backup & Restore & Migrate = 1.3.2 versions...

CVE-2026-41562 WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...

CVE-2026-41560 WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WXD Backup Lite = 1.0.2 versions...

CVE-2026-41561 WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Museder RestoreOne = 2.7.276 versions...

CVE-2026-41559 WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

CVE-2026-41555 WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...

CVE-2026-39798 WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Unauthenticated Settings Change in TrueBooker = 1.2.9 versions...

CVE-2026-39796 WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...

CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39792 WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Simple File List = 6.3.11 versions...

CVE-2026-39793 WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions...

CVE-2026-39791 WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

CVE-2026-39790 WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7...

CVE-2026-39787 WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

CVE-2026-39788 WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Front End PM = 11.4.6 versions...

CVE-2026-39785 WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...

CVE-2026-39784 WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Hotel Booking = 3.8 versions...

CVE-2026-39781 WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Document Gallery = 5.1.1 versions...

CVE-2026-39780 WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Youzify = 1.3.7 versions...

CVE-2026-39778 WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ansar Import – One Click Starter Sites – for Elementor & Themes = 2.1.2 versions...

CVE-2026-39776 WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Editor Remote Code Execution RCE in Tabs = 2.5 versions...

CVE-2026-39774 WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro = 1.17.3 versions...

CVE-2026-39775 WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39773 WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core = 1.7.0 versions...

CVE-2026-39772 WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft = 5.2.8 versions...

CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...

CVE-2026-39769 WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Graphina = 3.1.12 versions...

CVE-2026-39768 WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Security & Malware scan by CleanTalk = 2.189 versions...