CVE-2026-66631

CVE-2026-66631 affects the MC Woocommerce Wishlist WordPress plugin (plugin slug: smart-wishlist-for-more-convert ) in versions

CVE-2026-66630

SQL Injection vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by Ananda Dhakal via Patchstack . The flaw requires administrator-level privileges but changes scope, allowing an authenticated admin to inject SQL and achieve high confidentiality impact and l...

CVE-2026-66628

A SQL Injection vulnerability was identified in the shop manager functionality of the WordPress plugin WP-Lister Lite for eBay , affecting versions

CVE-2026-66626

CVE-2026-66626 is an Editor SQL Injection vulnerability in the WordPress plugin SKT Addons for Elementor (versions ≤ 4.0 ), discovered by Ananda Dhakal via Patchstack. The flaw allows an authenticated user with high privileges to inject SQL through the editor functionality. The CVSS 3.1 score is ...

CVE-2026-66625

WC Vendors Marketplace , a WordPress plugin, is vulnerable to an administrator-level SQL injection in versions

CVE-2026-66619

CVE-2026-66619 is an Administrator SQL Injection vulnerability in the WordPress Newsletters plugin , affecting versions 4.18 and below . The vulnerability was discovered by Ananda Dhakal via Patchstack. The CVSS 3.1 base score is 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, in...

CVE-2026-66624

WPMasterToolKit , a WordPress plugin, is affected by an Administrator-level SQL Injection in versions ≤ 2.22.0 , discovered by Ananda Dhakal (Patchstack). The vulnerability carries a CVSS 3.1 score of 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, indicating that a privileged (a...

CVE-2026-66618

CVE-2026-66618 is an Administrator-level SQL Injection vulnerability in the WP Maps WordPress plugin, affecting versions 4.9.9 and below . The flaw was discovered by Ananda Dhakal (Patchstack) and carries a CVSS 3.1 score of 7.6 (HIGH) , with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L , indi...

CVE-2026-66608

A Server-Side Request Forgery (SSRF) vulnerability was identified in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) in versions

CVE-2026-66617

A Contributor-level Cross Site Scripting (XSS) vulnerability affects the PublishPress Series WordPress plugin (aka "Organize Series") in versions

CVE-2026-66580

Product Feed Manager is a WordPress plugin affected by a SQL Injection vulnerability in versions

CVE-2026-66579

JetElements For Elementor is a WordPress plugin affected by a Contributor-level Cross Site Scripting (XSS) vulnerability in versions 2.9.2.1 and below . The flaw was discovered by nh4tvd and is rated CVSS 6.5 (MEDIUM) , with a changed scope and low impact on confidentiality, integrity, and availa...

CVE-2026-66578

A Contributor-level Cross Site Scripting (XSS) vulnerability affects the PropertyHive WordPress plugin in versions 2.2.6 and earlier . A user with the Contributor role can inject arbitrary script that executes in another user's browser, with changed scope and low impact on confidentiality, integr...

CVE-2026-66577

CVE-2026-66577 is a Contributor Cross Site Scripting (XSS) vulnerability in the JetSearch WordPress plugin, affecting versions ≤ 3.6.3 . The vulnerability was discovered by nh4tvd and reported via Patchstack , which serves as the CNA. The CVSS 3.1 score is 6.5 (MEDIUM) , with a vector of AV:N/AC:...

CVE-2026-66575

King Addons for Elementor WordPress plugin versions

CVE-2026-66576

CVE-2026-66576 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the JetBlocks For Elementor WordPress plugin, affecting versions 1.5.2 and earlier . The flaw was discovered by nh4tvd (reported via Patchstack). The vulnerability carries a CVSS 3.1 base score of 6.5 (MEDIUM) with ...

CVE-2026-66574

CVE-2026-66574 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the Element Pack Elementor Addons WordPress plugin (by BDThemes), affecting versions 8.8.3 and below . The flaw was discovered by researcher Dthangws and rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:R/...

CVE-2026-66572

CVE-2026-66572 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress JetBlog plugin (versions

CVE-2026-66573

CVE-2026-66573 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress JetTabs plugin, affecting versions 2.3.3.1 and earlier . The vulnerability was discovered by nh4tvd and rated CVSS 3.1 6.5 (Medium) with a changed scope, indicating potential impact beyond the vulnerab...

CVE-2026-66571

An unauthenticated Cross Site Request Forgery (CSRF) vulnerability exists in the WordPress plugin Asset CleanUp: Page Speed Booster in versions ≤ 1.4.0.5 , as discovered by Helder Gonçalves and tracked by Patchstack. The CVSS 3.1 score is 7.1 (High) with a Changed Scope, indicating that a success...