CVE-2026-57411

The CVE-2026-57411 entry concerns the WordPress plugin cf7-views (Aman CF7 Views – Complete Entry Management for Contact Form 7) with a DOM-based XSS vulnerability due to improper neutralization during web page generation. Affected versions are up to 3.2.2. CVSS v3.1 base score is 7.1 (HIGH); att...

CVE-2026-57407

The vulnerability concerns the WordPress plugin PDF Generator for WordPress (plugin name shown as pdf-generator-for-wp) and is described as a Server-Side Request Forgery (SSRF) . Affected versions are listed as “from n/a through

CVE-2026-57391

CVE-2026-57391 affects the WordPress Loops & Logic plugin, versions up to and including 4.2.3. The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. Exploitation details, affected exact vectors, and a published fix are...

CVE-2026-57417

CVE-2026-57417 concerns the WordPress Cart Lift plugin, affected versions are

CVE-2026-57423

CVE-2026-57423 affects the WordPress plugin Message Filter for Contact Form 7 (cf7-message-filter), specifically versions up to 1.6.3.8. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. Impact is reflected XSS...

CVE-2026-57416

The CVE-2026-57416 entry concerns the WordPress SiteGround Email Marketing plugin (versions

CVE-2026-57695

The CVE-2026-57695 entry relates to the WordPress Document Gallery plugin (

CVE-2026-57393

CVE-2026-57393 affects the WordPress plugin WooCommerce PDF Invoice Builder (plugin slug woo-pdf-invoice-builder) up to version ≤ 2.0.8. The vulnerability is described as an Exposure of Sensitive System Information to an Unauthorized Control Sphere that allows retrieval of embedded sensitive data...

CVE-2026-57420

CVE-2026-57420 concerns a Stored XSS in the WordPress plugin Author Box WP Lens (component: author-box-for-divi). The vulnerability arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Affected range is WordPress users running versions

CVE-2026-57733

The CVE-2026-57733 entry concerns the WordPress plugin tagDiv Cloud Library (td-cloud-library) with versions

CVE-2026-57668

CVE-2026-57668 concerns the WordPress plugin family NEX-Forms (Basix NEX-Forms nex-forms-express-wp-form-builder) with a Stored XSS vulnerability due to improper input neutralization during web page generation. Affected versions are NEX-Forms up to and including 9.2.2. The CVSS v3.1 base metrics ...

CVE-2026-57712

WPZOOM Portfolio plugin

CVE-2026-57408

CVE-2026-57408 affects the WordPress Peach Payments Gateway plugin wc-peach-payments-gateway

CVE-2026-57739

CVE-2026-57739 affects the WordPress WordPress Plugin AcyMailing SMTP Newsletter (versions up to and including 10.11.0). The vulnerability is an SQL Injection caused by improper neutralization of special elements in an SQL command, allowing blind SQL injection. According to the provided metrics, ...

CVE-2026-57406

CVE-2026-57406 : A Missing Authorization vulnerability is reported in the WordPress FundEngine plugin (wp-fundraising-donation) affecting versions up to 1.7.6. The issue is described as broken access control due to incorrectly configured access security levels, enabling exploitation of access con...

CVE-2026-57392

The CVE-2026-57392 entry concerns the WordPress Tourfic plugin (versions up to 2.22.5) with a Missing Authorization / Broken Access Control vulnerability. The root cause is misconfigured access control, enabling unauthorized access to protected resources or actions. Impact is described as broken ...

CVE-2026-57732

CVE-2026-57732 : A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin tagDiv Opt-In Builder (td-subscription), affecting versions

CVE-2026-57418

CVE-2026-57418 covers a Missing Authorization vulnerability in the WordPress/plugin set associated with Sprout Invoices, specifically the Sprout Invoices Client Invoicing (WordPress plugin, versions up to 20.8.13). The root cause is an Incorrectly Configured Access Control , described as broken a...

CVE-2026-57740

CVE-2026-57740 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress AcyMailing Newsletter SMTP Newsletter plugin, affecting versions up to and including 10.11.1. The issue stems from incorrectly configured access control, enabling an attacker with network acces...

CVE-2026-57400

The CVE-2026-57400 entry concerns the WordPress plugin Event Tickets Manager for WooCommerce. A Missing Authorization vulnerability is described as due to Incorrectly Configured Access Control Security Levels, affecting the plugin’s “Event Tickets Manager for WooCommerce” component in versions up...