Last week, there were 78 vulnerabilities disclosed in 62 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 59 Vulnerability Researchers that contributed to WordPress Security last week. **Review those vulnerabilities in this report now to ensure your site is not affected.** Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data**to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies.** That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world's leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back. Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our **database of over 35,000 vulnerabilities** and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, **all for free**. _Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published._ * * * ### New Firewall Rules Deployed Last Week The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection. The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: * * * AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay. * * * ### Total Unpatched & Patched Vulnerabilities Last Week Patch Status | Number of Vulnerabilities ---|--- Patched | 66 Unpatched | 12 * * * ### Total Vulnerabilities by CVSS Severity Last Week Severity Rating | Number of Vulnerabilities ---|--- Medium Severity | 54 High Severity | 21 Critical Severity | 3 * * * ### Total Vulnerabilities by CWE Type Last Week Vulnerability Type by CWE | Number of Vulnerabilities ---|--- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 23 Missing Authorization | 17 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 12 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 Cross-Site Request Forgery (CSRF) | 5 Exposure of Sensitive Information to an Unauthorized Actor | 4 Authorization Bypass Through User-Controlled Key | 3 Unrestricted Upload of File with Dangerous Type | 2 Deserialization of Untrusted Data | 1 Improper Authentication | 1 Improper Authorization | 1 Improper Privilege Management | 1 Server-Side Request Forgery (SSRF) | 1 Weak Password Recovery Mechanism for Forgotten Password | 1 * * * ### Researchers That Contributed to WordPress Security Last Week Researcher Name | Number of Vulnerabilities ---|--- ![](https://www.gravatar.com/avatar/4c2bd6964b38518385c4e8d1791fd762.jpg?s=32&d=mp&r=g) zaim | 4 ![](https://www.gravatar.com/avatar/ef74f4dbe7907a62f177592f647c1afa.jpg?s=32&d=mp&r=g) Webbernaut | 3 ![](https://www.gravatar.com/avatar/c0d3936ce2491c1bd33db966cf5421b9.jpg?s=32&d=mp&r=g) Athiwat Tiprasaharn (Jitlada) | 3 ![](https://www.gravatar.com/avatar/86a1429aeb8e473ec62cf8dd3d4e4571.jpg?s=32&d=mp&r=g) Nabil Irawan | 3 ![](https://www.gravatar.com/avatar/72bab04a62ba550220dbf14bbbc81dbd.jpg?s=32&d=mp&r=g) Niv Kochan | 2 ![](https://www.gravatar.com/avatar/429c3eb56bea605e95a57ae93ae24c62.jpg?s=32&d=mp&r=g) Nguyen Ba Khanh | 2 ![](https://www.gravatar.com/avatar/db76c9ad8fed7273064e3381b162549b.jpg?s=32&d=mp&r=g) Leonid Semenenko (lsemenenko) | 2 ![](https://www.gravatar.com/avatar/1aafd675decd7f34743b90ce772debf7.jpg?s=32&d=mp&r=g) Muhammad Nur Ibnu Hubab | 2 ![](https://www.gravatar.com/avatar/2c009f880c37af5ab9adcc8490628a98.jpg?s=32&d=mp&r=g) Nguyen Ngoc Duc (duc193) | 2 ![](https://www.gravatar.com/avatar/97a1f88460217867f45b925b3af1bb6a.jpg?s=32&d=mp&r=g) Muhammad Yudha - DJ | 2 ![](https://www.gravatar.com/avatar/9a8271ddc110a3f88d621dbb3591e9e8.jpg?s=32&d=mp&r=g) Julian Chibuike Nwadinobi (Wackydawg) | 2 ![](https://www.gravatar.com/avatar/e0f701652a71213d4d5afd11c6694ce0.jpg?s=32&d=mp&r=g) h0xilo | 2 ![](https://www.gravatar.com/avatar/233ef42c47535ec3a7ba55e8892ff1f7.jpg?s=32&d=mp&r=g) Hunter Jensen (skid) | 2 ![](https://www.gravatar.com/avatar/6dd380c38e13e8dc02631e8ea879a9e4.jpg?s=32&d=mp&r=g) benzdeus | 2 ![](https://www.gravatar.com/avatar/f8da36de0b16927a052e4eb0878abbfb.jpg?s=32&d=mp&r=g) lhking | 2 ![](https://www.gravatar.com/avatar/33751fc657c409bebde901e7bad75981.jpg?s=32&d=mp&r=g) anhcd05 | 2 ![](https://www.gravatar.com/avatar/b057c2855be2e8def7ed1c37740926ed.jpg?s=32&d=mp&r=g) kai63001 | 1 ![](https://www.gravatar.com/avatar/d58cf1850846b6293d1621cfe1d19a2f.jpg?s=32&d=mp&r=g) Tiago Ventura (perses) | 1 ![](https://www.gravatar.com/avatar/d0fee96ccb28796d22f6a908cfc743bc.jpg?s=32&d=mp&r=g) Kittipat Jitphonchana | 1 ![](https://www.gravatar.com/avatar/cfc16ede98e1f9d9949c6a2b6b70bc1c.jpg?s=32&d=mp&r=g) d.v4n_s3c | 1 ![](https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?s=32&d=mp&r=g) Bao - BlueRock | 1 ![](https://www.gravatar.com/avatar/2b10299bbeaa99905f33f61d9bd5a5d1.jpg?s=32&d=mp&r=g) NumeX | 1 ![](https://www.gravatar.com/avatar/691c3168925c59eae700032d1721a348.jpg?s=32&d=mp&r=g) AmonRa | 1 ![](https://www.gravatar.com/avatar/5ddf9d14fe3d5ebed8efd101f21a9e12.jpg?s=32&d=mp&r=g) Benedictus Jovan (aillesiM) | 1 ![](https://www.gravatar.com/avatar/45ee168e3ec0bb91083d6bb57a00e229.jpg?s=32&d=mp&r=g) Mukhlis Amien | 1 ![](https://www.gravatar.com/avatar/37cc74b0e1957fee81825154abeae540.jpg?s=32&d=mp&r=g) nquangit | 1 ![](https://www.gravatar.com/avatar/ac3ff42e2dcdeff7dc5b60f3c6726707.jpg?s=32&d=mp&r=g) Ronnachai Chaipha (rxnr) | 1 ![](https://www.gravatar.com/avatar/dc4392a91969faf724c6fde8f3691de6.jpg?s=32&d=mp&r=g) DJumanto | 1 ![](https://www.gravatar.com/avatar/ced6c2e2042f4ee80d95d5443c72d2b1.jpg?s=32&d=mp&r=g) シルAsuna | 1 ![](https://www.gravatar.com/avatar/f85a351fb56ffb26c63e64ed9e6ccd73.jpg?s=32&d=mp&r=g) PPzzAArr | 1 ![](https://www.gravatar.com/avatar/7e44c1d5ad8f406fc10e62f0a5b11655.jpg?s=32&d=mp&r=g) Jarno Vos (jarnovos) | 1 ![](https://www.gravatar.com/avatar/ee46d8ed5f17142621d8d0c597904ec0.jpg?s=32&d=mp&r=g) Jack Pas (Dark.) | 1 ![](https://www.gravatar.com/avatar/7965cd13376a540548ec7009cd66b05b.jpg?s=32&d=mp&r=g) daroo | 1 ![](https://www.gravatar.com/avatar/166fe5b6fe5cfdd2ddaec0e8c22d18e6.jpg?s=32&d=mp&r=g) David Marín | 1 ![](https://www.gravatar.com/avatar/258c774aecd81b7d1fa67abf3b576b33.jpg?s=32&d=mp&r=g) Peter Thaleikis | 1 ![](https://www.gravatar.com/avatar/2be53568b04545bf9e036c375a3d44d9.jpg?s=32&d=mp&r=g) Supakiad S. (m3ez) | 1 ![](https://www.gravatar.com/avatar/45acf8b492a9823d9b6f95bcc17730f3.jpg?s=32&d=mp&r=g) Ossacip Thanh | 1 ![](https://www.gravatar.com/avatar/df8c8ca46443f042a3e8e44337724b2b.jpg?s=32&d=mp&r=g) Nhut Quang | 1 ![](https://www.gravatar.com/avatar/553cb97e15a106a04fa7e72b813e84b1.jpg?s=32&d=mp&r=g) Muhammad Sharief | 1 ![](https://www.gravatar.com/avatar/b18e99e14d7f2de268d5197dd1571353.jpg?s=32&d=mp&r=g) Evan NR | 1 ![](https://www.gravatar.com/avatar/c56b90a6fb883bb5e992d1c8b45f57ba.jpg?s=32&d=mp&r=g) Dahmani Toumi (pegaSUS) | 1 ![](https://www.gravatar.com/avatar/520c9862af61a3568e290158b35d3df4.jpg?s=32&d=mp&r=g) kiemtiendinhau | 1 ![](https://www.gravatar.com/avatar/725f73e2dd8bfe253859ddc0df2afc9c.jpg?s=32&d=mp&r=g) Sélim Lanouar (whattheslime) | 1 ![](https://www.gravatar.com/avatar/ed1755942aa6cb7ca0583880be85d3b3.jpg?s=32&d=mp&r=g) Osvaldo Noe Gonzalez Del Rio (Os) | 1 ![](https://www.gravatar.com/avatar/01e9ff51a749f2beebcde4e6d5b68519.jpg?s=32&d=mp&r=g) Nguyen Cong Quang | 1 ![](https://www.gravatar.com/avatar/9a7afdb6686beacc853a9cd18b64a40b.jpg?s=32&d=mp&r=g) Nabil Irawan - Heroes Cyber Security | 1 ![](https://www.gravatar.com/avatar/c4c6944fc985a788726e03ffcb9629ff.jpg?s=32&d=mp&r=g) afnaan | 1 ![](https://www.gravatar.com/avatar/ec4093d3f2581c3c7036923a58d290b3.jpg?s=32&d=mp&r=g) Michael Iden (Mickhat) | 1 ![](https://www.gravatar.com/avatar/8dae08eb7d527264fd4e9c97ea820971.jpg?s=32&d=mp&r=g) andrea bocchetti | 1 ![](https://www.gravatar.com/avatar/e4188dd12f530657e2e401ac3062b0cf.jpg?s=32&d=mp&r=g) shrikant bhosale | 1 ![](https://www.gravatar.com/avatar/80b7d8f8871cb8728aa828e68dd59776.jpg?s=32&d=mp&r=g) Abdulsamad Yusuf (0xVenus) | 1 ![](https://www.gravatar.com/avatar/00b9210383dde323f6dbe14354fe953d.jpg?s=32&d=mp&r=g) Legion Hunter | 1 ![](https://www.gravatar.com/avatar/ee432feea135175a33b5be4a0c2a4071.jpg?s=32&d=mp&r=g) MAJidox | 1 ![](https://www.gravatar.com/avatar/585bd77d4bbe100a43b04223fd09a74f.jpg?s=32&d=mp&r=g) João Pedro Soares de Alcântara | 1 ![](https://www.gravatar.com/avatar/336a4835171563e9c198b2d4dee1fa34.jpg?s=32&d=mp&r=g) zakaria | 1 ![](https://www.gravatar.com/avatar/0570dfafd8c9d9f5f0f14e8b6d3ccfc7.jpg?s=32&d=mp&r=g) Caspian | 1 ![](https://www.gravatar.com/avatar/b596eef6275fcf70c058035885683275.jpg?s=32&d=mp&r=g) type5afe | 1 ![](https://www.gravatar.com/avatar/8e8a01bf0b9d95d7919748a0a689fb3c.jpg?s=32&d=mp&r=g) Ren Voza | 1 ![](https://www.gravatar.com/avatar/af5b586cc9011f91beb55273246d636b.jpg?s=32&d=mp&r=g) shark3y | 1 _Are you a security researcher who would like to be featured in our weekly vulnerability report?_ You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report. * * * ### WordPress Plugins with Reported Vulnerabilities Last Week Software Name | Software Slug ---|--- Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity | logtivity addfreespace | addfreespace Affiliate Program Suite — SliceWP Affiliates | slicewp AI Product Search for WooCommerce – Motive Commerce Search | motive-commerce-search All-in-One WP Migration Unlimited Extension | all-in-one-wp-migration-unlimited-extension Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | simply-schedule-appointments Auto Affiliate Links | wp-auto-affiliate-links AWP Classifieds | another-wordpress-classifieds-plugin BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | woo-bulk-editor BetterDocs Pro | betterdocs-pro Blog Settings | blog-settings bunny.net – WordPress CDN Plugin | bunnycdn Bus Ticket Booking with Seat Reservation | bus-ticket-booking-with-seat-reservation Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | wp-carousel-free Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website | charts-ninja-graphs-and-charts DX Sources | dx-sources E2Pdf – Export Pdf Tool for WordPress | e2pdf ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite eMagicOne Store Manager for WooCommerce | store-manager-connector EmailKit – Email Customizer for WooCommerce & WP | emailkit Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content | geeky-bot GenerateBlocks | generateblocks Gravity Bookings | gf-bookings-premium Gutenverse – WordPress Blocks, Page Builder & Site Editor | gutenverse Happy Addons for Elementor | happy-elementor-addons LatePoint – Calendar Booking Plugin for Appointments and Events | latepoint Loco Translate | loco-translate Mentoring | mentoring Mercado Pago payments for WooCommerce | woocommerce-mercadopago MoreConvert Pro | smart-wishlist-for-more-convert-premium Ninja Tables – Easy Data Table Builder | ninja-tables NMR Strava activities | nmr-strava-activities Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool PDF Poster – Display PDF Files with Custom Viewer | pdf-poster Publish 2 Ping.fm | publish-2-pingfm Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons Salon Booking System – Free Version | salon-booking-system Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | post-expirator Simple CAPTCHA Alternative with Cloudflare Turnstile | simple-cloudflare-turnstile Simple Owl Shortcodes | simple-owl-shortcodes Sky Addons for Elementor | sky-elementor-addons Slider Revolution | revslider Snow Monkey Blocks | snow-monkey-blocks Subscribe To Comments Reloaded | subscribe-to-comments-reloaded Team Members – Multi Language Supported Team Plugin | team-showcase-supreme User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration | wp-user-frontend User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce | webinar-ignition WeePie Cookie Allow | wp-cookie-allow WEN Logo Slider | wen-logo-slider WP Business Intelligence Lite | wp-business-intelligence-lite WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel WP-Clippy | wp-clippy WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance | wp-optimize wpForo Forum | wpforo WPGraphQL | wp-graphql YITH WooCommerce Wishlist | yith-woocommerce-wishlist Zingaya Click-to-Call | zingaya-click-to-call * * * ### WordPress Themes with Reported Vulnerabilities Last Week Software Name | Software Slug ---|--- avante | avante Betheme | betheme * * * ### Vulnerability Details Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you'd like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize. #### GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action 9.8 CVSS Rating **9.8 (Critical)** CVE-ID ** CVE-2026-5294 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content [geeky-bot] **Researcher** ![](https://www.gravatar.com/avatar/520c9862af61a3568e290158b35d3df4.jpg?s=32&d=mp&r=g)kiemtiendinhau More Details > #### Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration 9.8 CVSS Rating **9.8 (Critical)** CVE-ID ** CVE-2025-13618 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Mentoring [mentoring] **Researcher** ![](https://www.gravatar.com/avatar/ced6c2e2042f4ee80d95d5443c72d2b1.jpg?s=32&d=mp&r=g)シルAsuna More Details > #### MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse 9.8 CVSS Rating **9.8 (Critical)** CVE-ID ** CVE-2026-5722 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** MoreConvert Pro [smart-wishlist-for-more-convert-premium] **Researcher** ![](https://www.gravatar.com/avatar/2c009f880c37af5ab9adcc8490628a98.jpg?s=32&d=mp&r=g)Nguyen Ngoc Duc (duc193) More Details > #### Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload 8.8 CVSS Rating **8.8 (High)** CVE-ID ** CVE-2026-6261 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Betheme [betheme] **Researchers** ![](https://www.gravatar.com/avatar/ef74f4dbe7907a62f177592f647c1afa.jpg?s=32&d=mp&r=g)Webbernaut ![](https://www.gravatar.com/avatar/db76c9ad8fed7273064e3381b162549b.jpg?s=32&d=mp&r=g)Leonid Semenenko (lsemenenko) More Details > #### Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url 8.8 CVSS Rating **8.8 (High)** CVE-ID ** CVE-2026-6692 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** Slider Revolution [revslider] **Researcher** ![](https://www.gravatar.com/avatar/e0f701652a71213d4d5afd11c6694ce0.jpg?s=32&d=mp&r=g)h0xilo More Details > #### User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection 8.8 CVSS Rating **8.8 (High)** CVE-ID ** CVE-2026-5127 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration [wp-user-frontend] **Researcher** ![](https://www.gravatar.com/avatar/cfc16ede98e1f9d9949c6a2b6b70bc1c.jpg?s=32&d=mp&r=g)d.v4n_s3c More Details > #### WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta 8.1 CVSS Rating **8.1 (High)** CVE-ID ** CVE-2026-7252 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance [wp-optimize] **Researcher** ![](https://www.gravatar.com/avatar/f8da36de0b16927a052e4eb0878abbfb.jpg?s=32&d=mp&r=g)lhking More Details > #### WP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification 8.0 CVSS Rating **8.0 (High)** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** WP Business Intelligence Lite [wp-business-intelligence-lite] **Researcher** ![](https://www.gravatar.com/avatar/86a1429aeb8e473ec62cf8dd3d4e4571.jpg?s=32&d=mp&r=g)Nabil Irawan More Details > #### AWP Classifieds <= 4.4.6 - Unauthenticated SQL Injection via 'regions' 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-5100 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** AWP Classifieds [another-wordpress-classifieds-plugin] **Researcher** ![](https://www.gravatar.com/avatar/233ef42c47535ec3a7ba55e8892ff1f7.jpg?s=32&d=mp&r=g)Hunter Jensen (skid) More Details > #### BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-4348 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** BetterDocs Pro [betterdocs-pro] **Researcher** ![](https://www.gravatar.com/avatar/e0f701652a71213d4d5afd11c6694ce0.jpg?s=32&d=mp&r=g)h0xilo More Details > #### eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-42773 ** Patch Status **Unpatched** Published **May 7, 2026** **Affected Software** eMagicOne Store Manager for WooCommerce [store-manager-connector] **Researcher** ![](https://www.gravatar.com/avatar/45acf8b492a9823d9b6f95bcc17730f3.jpg?s=32&d=mp&r=g)Ossacip Thanh More Details > #### Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-3359 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker] **Researcher** ![](https://www.gravatar.com/avatar/b596eef6275fcf70c058035885683275.jpg?s=32&d=mp&r=g)type5afe More Details > #### Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-5192 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] **Researcher** ![](https://www.gravatar.com/avatar/7965cd13376a540548ec7009cd66b05b.jpg?s=32&d=mp&r=g)daroo More Details > #### GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey' 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-3456 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content [geeky-bot] **Researcher** ![](https://www.gravatar.com/avatar/2c009f880c37af5ab9adcc8490628a98.jpg?s=32&d=mp&r=g)Nguyen Ngoc Duc (duc193) More Details > #### Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-1719 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Gravity Bookings [gf-bookings-premium] **Researcher** ![](https://www.gravatar.com/avatar/80b7d8f8871cb8728aa828e68dd59776.jpg?s=32&d=mp&r=g)Abdulsamad Yusuf (0xVenus) More Details > #### WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-40797 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce [webinar-ignition] **Researcher** ![](https://www.gravatar.com/avatar/c56b90a6fb883bb5e992d1c8b45f57ba.jpg?s=32&d=mp&r=g)Dahmani Toumi (pegaSUS) More Details > #### WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-4304 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** WeePie Cookie Allow [wp-cookie-allow] **Researcher** ![](https://www.gravatar.com/avatar/8e8a01bf0b9d95d7919748a0a689fb3c.jpg?s=32&d=mp&r=g)Ren Voza More Details > #### WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-42665 ** Patch Status **Patched** Published **May 9, 2026** **Affected Software** WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access] **Researcher** ![](https://www.gravatar.com/avatar/45ee168e3ec0bb91083d6bb57a00e229.jpg?s=32&d=mp&r=g)Mukhlis Amien More Details > #### wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection 7.5 CVSS Rating **7.5 (High)** CVE-ID ** CVE-2026-40798 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** wpForo Forum [wpforo] **Researcher** ![](https://www.gravatar.com/avatar/429c3eb56bea605e95a57ae93ae24c62.jpg?s=32&d=mp&r=g)Nguyen Ba Khanh More Details > #### Affiliate Program Suite — SliceWP Affiliates <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating **7.2 (High)** CVE-ID ** CVE-2026-42653 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** Affiliate Program Suite — SliceWP Affiliates [slicewp] **Researcher** ![](https://www.gravatar.com/avatar/429c3eb56bea605e95a57ae93ae24c62.jpg?s=32&d=mp&r=g)Nguyen Ba Khanh More Details > #### Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter 7.2 CVSS Rating **7.2 (High)** CVE-ID ** CVE-2026-7330 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Auto Affiliate Links [wp-auto-affiliate-links] **Researcher** ![](https://www.gravatar.com/avatar/dc4392a91969faf724c6fde8f3691de6.jpg?s=32&d=mp&r=g)DJumanto More Details > #### LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating **7.2 (High)** CVE-ID ** CVE-2026-7448 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint] **Researcher** ![](https://www.gravatar.com/avatar/691c3168925c59eae700032d1721a348.jpg?s=32&d=mp&r=g)AmonRa More Details > #### LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter 7.2 CVSS Rating **7.2 (High)** CVE-ID ** CVE-2026-7332 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint] **Researcher** ![](https://www.gravatar.com/avatar/f8da36de0b16927a052e4eb0878abbfb.jpg?s=32&d=mp&r=g)lhking More Details > #### Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta 7.2 CVSS Rating **7.2 (High)** CVE-ID ** CVE-2026-4803 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/8dae08eb7d527264fd4e9c97ea820971.jpg?s=32&d=mp&r=g)andrea bocchetti More Details > #### All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-5753 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** All-in-One WP Migration Unlimited Extension [all-in-one-wp-migration-unlimited-extension] **Researcher** ![](https://www.gravatar.com/avatar/725f73e2dd8bfe253859ddc0df2afc9c.jpg?s=32&d=mp&r=g)Sélim Lanouar (whattheslime) More Details > #### Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-4807 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments] **Researcher** ![](https://www.gravatar.com/avatar/c0d3936ce2491c1bd33db966cf5421b9.jpg?s=32&d=mp&r=g)Athiwat Tiprasaharn (Jitlada) More Details > #### Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-6262 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Betheme [betheme] **Researchers** ![](https://www.gravatar.com/avatar/ef74f4dbe7907a62f177592f647c1afa.jpg?s=32&d=mp&r=g)Webbernaut ![](https://www.gravatar.com/avatar/db76c9ad8fed7273064e3381b162549b.jpg?s=32&d=mp&r=g)Leonid Semenenko (lsemenenko) More Details > #### ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-4362 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite] **Researcher** ![](https://www.gravatar.com/avatar/ee46d8ed5f17142621d8d0c597904ec0.jpg?s=32&d=mp&r=g)Jack Pas (Dark.) More Details > #### EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-5957 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** EmailKit – Email Customizer for WooCommerce & WP [emailkit] **Researcher** ![](https://www.gravatar.com/avatar/01e9ff51a749f2beebcde4e6d5b68519.jpg?s=32&d=mp&r=g)Nguyen Cong Quang More Details > #### Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-6214 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] **Researcher** ![](https://www.gravatar.com/avatar/33751fc657c409bebde901e7bad75981.jpg?s=32&d=mp&r=g)anhcd05 More Details > #### GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-3454 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** GenerateBlocks [generateblocks] **Researcher** ![](https://www.gravatar.com/avatar/b057c2855be2e8def7ed1c37740926ed.jpg?s=32&d=mp&r=g)kai63001 More Details > #### Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-4409 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Subscribe To Comments Reloaded [subscribe-to-comments-reloaded] **Researcher** ![](https://www.gravatar.com/avatar/2be53568b04545bf9e036c375a3d44d9.jpg?s=32&d=mp&r=g)Supakiad S. (m3ez) More Details > #### WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating **6.5 (Medium)** CVE-ID ** CVE-2026-45218 ** Patch Status **Patched** Published **May 9, 2026** **Affected Software** WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel] **Researcher** ![](https://www.gravatar.com/avatar/df8c8ca46443f042a3e8e44337724b2b.jpg?s=32&d=mp&r=g)Nhut Quang More Details > #### Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-6672 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Affiliate Program Suite — SliceWP Affiliates [slicewp] **Researcher** ![](https://www.gravatar.com/avatar/97a1f88460217867f45b925b3af1bb6a.jpg?s=32&d=mp&r=g)Muhammad Yudha - DJ More Details > #### Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-4730 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website [charts-ninja-graphs-and-charts] **Researcher** ![](https://www.gravatar.com/avatar/4c2bd6964b38518385c4e8d1791fd762.jpg?s=32&d=mp&r=g)zaim More Details > #### E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-7650 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** E2Pdf – Export Pdf Tool for WordPress [e2pdf] **Researcher** ![](https://www.gravatar.com/avatar/4c2bd6964b38518385c4e8d1791fd762.jpg?s=32&d=mp&r=g)zaim More Details > #### Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-2948 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse] **Researcher** ![](https://www.gravatar.com/avatar/ed1755942aa6cb7ca0583880be85d3b3.jpg?s=32&d=mp&r=g)Osvaldo Noe Gonzalez Del Rio (Os) More Details > #### Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-2868 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse] **Researcher** ![](https://www.gravatar.com/avatar/c0d3936ce2491c1bd33db966cf5421b9.jpg?s=32&d=mp&r=g)Athiwat Tiprasaharn (Jitlada) More Details > #### LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-7457 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint] **Researcher** ![](https://www.gravatar.com/avatar/72bab04a62ba550220dbf14bbbc81dbd.jpg?s=32&d=mp&r=g)Niv Kochan More Details > #### NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-5341 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** NMR Strava activities [nmr-strava-activities] **Researcher** ![](https://www.gravatar.com/avatar/4c2bd6964b38518385c4e8d1791fd762.jpg?s=32&d=mp&r=g)zaim More Details > #### Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-27421 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/258c774aecd81b7d1fa67abf3b576b33.jpg?s=32&d=mp&r=g)Peter Thaleikis More Details > #### Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-5159 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/0570dfafd8c9d9f5f0f14e8b6d3ccfc7.jpg?s=32&d=mp&r=g)Caspian More Details > #### Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-6255 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Simple Owl Shortcodes [simple-owl-shortcodes] **Researcher** ![](https://www.gravatar.com/avatar/ee432feea135175a33b5be4a0c2a4071.jpg?s=32&d=mp&r=g)MAJidox More Details > #### Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-7475 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Sky Addons for Elementor [sky-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/c0d3936ce2491c1bd33db966cf5421b9.jpg?s=32&d=mp&r=g)Athiwat Tiprasaharn (Jitlada) More Details > #### Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-3004 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Snow Monkey Blocks [snow-monkey-blocks] **Researcher** ![](https://www.gravatar.com/avatar/97a1f88460217867f45b925b3af1bb6a.jpg?s=32&d=mp&r=g)Muhammad Yudha - DJ More Details > #### WEN Logo Slider <= 3.4.0 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2025-62127 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** WEN Logo Slider [wen-logo-slider] **Researcher** ![](https://www.gravatar.com/avatar/86a1429aeb8e473ec62cf8dd3d4e4571.jpg?s=32&d=mp&r=g)Nabil Irawan More Details > #### WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-4665 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel [wp-carousel-free] **Researcher** ![](https://www.gravatar.com/avatar/ef74f4dbe7907a62f177592f647c1afa.jpg?s=32&d=mp&r=g)Webbernaut More Details > #### WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 6.4 CVSS Rating **6.4 (Medium)** CVE-ID ** CVE-2026-5505 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** WP-Clippy [wp-clippy] **Researcher** ![](https://www.gravatar.com/avatar/336a4835171563e9c198b2d4dee1fa34.jpg?s=32&d=mp&r=g)zakaria More Details > #### Avante < 3.0.5 - Reflected Cross-Site Scripting 6.1 CVSS Rating **6.1 (Medium)** CVE-ID ** CVE-2025-68524 ** Patch Status **Patched** Published **May 8, 2026** **Affected Software** avante [avante] **Researcher** ![](https://www.gravatar.com/avatar/585bd77d4bbe100a43b04223fd09a74f.jpg?s=32&d=mp&r=g)João Pedro Soares de Alcântara More Details > #### Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter 6.1 CVSS Rating **6.1 (Medium)** CVE-ID ** CVE-2026-6704 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Blog Settings [blog-settings] **Researcher** ![](https://www.gravatar.com/avatar/9a8271ddc110a3f88d621dbb3591e9e8.jpg?s=32&d=mp&r=g)Julian Chibuike Nwadinobi (Wackydawg) More Details > #### Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter 6.1 CVSS Rating **6.1 (Medium)** CVE-ID ** CVE-2026-6702 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Publish 2 Ping.fm [publish-2-pingfm] **Researcher** ![](https://www.gravatar.com/avatar/1aafd675decd7f34743b90ce772debf7.jpg?s=32&d=mp&r=g)Muhammad Nur Ibnu Hubab More Details > #### Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter 6.1 CVSS Rating **6.1 (Medium)** CVE-ID ** CVE-2026-6696 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** Zingaya Click-to-Call [zingaya-click-to-call] **Researcher** ![](https://www.gravatar.com/avatar/9a8271ddc110a3f88d621dbb3591e9e8.jpg?s=32&d=mp&r=g)Julian Chibuike Nwadinobi (Wackydawg) More Details > #### Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute 5.5 CVSS Rating **5.5 (Medium)** CVE-ID ** CVE-2026-5247 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] **Researcher** ![](https://www.gravatar.com/avatar/4c2bd6964b38518385c4e8d1791fd762.jpg?s=32&d=mp&r=g)zaim More Details > #### Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-8198 ** Patch Status **Patched** Published **May 8, 2026** **Affected Software** Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity [logtivity] **Researcher** ![](https://www.gravatar.com/avatar/ac3ff42e2dcdeff7dc5b60f3c6726707.jpg?s=32&d=mp&r=g)Ronnachai Chaipha (rxnr) More Details > #### AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 - Missing Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-42664 ** Patch Status **Patched** Published **May 9, 2026** **Affected Software** AI Product Search for WooCommerce – Motive Commerce Search [motive-commerce-search] **Researcher** ![](https://www.gravatar.com/avatar/5ddf9d14fe3d5ebed8efd101f21a9e12.jpg?s=32&d=mp&r=g)Benedictus Jovan (aillesiM) More Details > #### Bus Ticket Booking with Seat Reservation < 5.6.8 - Missing Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2025-66105 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation] **Researcher** ![](https://www.gravatar.com/avatar/00b9210383dde323f6dbe14354fe953d.jpg?s=32&d=mp&r=g)Legion Hunter More Details > #### Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-2729 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] **Researcher** ![](https://www.gravatar.com/avatar/d0fee96ccb28796d22f6a908cfc743bc.jpg?s=32&d=mp&r=g)Kittipat Jitphonchana More Details > #### Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-6222 ** Patch Status **Patched** Published **May 6, 2026** **Affected Software** Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] **Researcher** ![](https://www.gravatar.com/avatar/33751fc657c409bebde901e7bad75981.jpg?s=32&d=mp&r=g)anhcd05 More Details > #### Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-25468 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Happy Addons for Elementor [happy-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/e4188dd12f530657e2e401ac3062b0cf.jpg?s=32&d=mp&r=g)shrikant bhosale More Details > #### LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-7652 ** Patch Status **Patched** Published **May 8, 2026** **Affected Software** LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint] **Researcher** ![](https://www.gravatar.com/avatar/ec4093d3f2581c3c7036923a58d290b3.jpg?s=32&d=mp&r=g)Michael Iden (Mickhat) More Details > #### Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-3208 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Mercado Pago payments for WooCommerce [woocommerce-mercadopago] **Researcher** ![](https://www.gravatar.com/avatar/553cb97e15a106a04fa7e72b813e84b1.jpg?s=32&d=mp&r=g)Muhammad Sharief More Details > #### Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-42667 ** Patch Status **Patched** Published **May 10, 2026** **Affected Software** Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] **Researcher** ![](https://www.gravatar.com/avatar/d58cf1850846b6293d1621cfe1d19a2f.jpg?s=32&d=mp&r=g)Tiago Ventura (perses) More Details > #### PDF Poster – Display PDF Files with Custom Viewer <= 2.4.1 - Missing Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-27416 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** PDF Poster – Display PDF Files with Custom Viewer [pdf-poster] **Researcher** ![](https://www.gravatar.com/avatar/6dd380c38e13e8dc02631e8ea879a9e4.jpg?s=32&d=mp&r=g)benzdeus More Details > #### Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-25436 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] **Researcher** ![](https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?s=32&d=mp&r=g)Bao - BlueRock More Details > #### Salon Booking System – Free Version <= 10.30.25 - Missing Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-42666 ** Patch Status **Patched** Published **May 10, 2026** **Affected Software** Salon Booking System – Free Version [salon-booking-system] **Researcher** ![](https://www.gravatar.com/avatar/b18e99e14d7f2de268d5197dd1571353.jpg?s=32&d=mp&r=g)Evan NR More Details > #### Simple CAPTCHA Alternative with Cloudflare Turnstile <= 1.38.0 - Broken Authorization 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-40799 ** Patch Status **Patched** Published **May 8, 2026** **Affected Software** Simple CAPTCHA Alternative with Cloudflare Turnstile [simple-cloudflare-turnstile] **Researcher** ![](https://www.gravatar.com/avatar/166fe5b6fe5cfdd2ddaec0e8c22d18e6.jpg?s=32&d=mp&r=g)David Marín More Details > #### YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating **5.3 (Medium)** CVE-ID ** CVE-2026-27329 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** YITH WooCommerce Wishlist [yith-woocommerce-wishlist] **Researcher** ![](https://www.gravatar.com/avatar/f85a351fb56ffb26c63e64ed9e6ccd73.jpg?s=32&d=mp&r=g)PPzzAArr More Details > #### Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment 4.9 CVSS Rating **4.9 (Medium)** CVE-ID ** CVE-2026-6344 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] **Researcher** ![](https://www.gravatar.com/avatar/72bab04a62ba550220dbf14bbbc81dbd.jpg?s=32&d=mp&r=g)Niv Kochan More Details > #### Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter 4.9 CVSS Rating **4.9 (Medium)** CVE-ID ** CVE-2026-1921 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** Loco Translate [loco-translate] **Researcher** ![](https://www.gravatar.com/avatar/af5b586cc9011f91beb55273246d636b.jpg?s=32&d=mp&r=g)shark3y More Details > #### Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection 4.9 CVSS Rating **4.9 (Medium)** CVE-ID ** CVE-2025-68060 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** Team Members – Multi Language Supported Team Plugin [team-showcase-supreme] **Researcher** ![](https://www.gravatar.com/avatar/7e44c1d5ad8f406fc10e62f0a5b11655.jpg?s=32&d=mp&r=g)Jarno Vos (jarnovos) More Details > #### addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2026-6701 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** addfreespace [addfreespace] **Researcher** ![](https://www.gravatar.com/avatar/1aafd675decd7f34743b90ce772debf7.jpg?s=32&d=mp&r=g)Muhammad Nur Ibnu Hubab More Details > #### BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2026-27415 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net [woo-bulk-editor] **Researcher** ![](https://www.gravatar.com/avatar/6dd380c38e13e8dc02631e8ea879a9e4.jpg?s=32&d=mp&r=g)benzdeus More Details > #### bunny.net – WordPress CDN Plugin <= 2.3.6 - Missing Authorization 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2025-68049 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** bunny.net – WordPress CDN Plugin [bunnycdn] **Researcher** ![](https://www.gravatar.com/avatar/2b10299bbeaa99905f33f61d9bd5a5d1.jpg?s=32&d=mp&r=g)NumeX More Details > #### DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2026-6700 ** Patch Status **Unpatched** Published **May 4, 2026** **Affected Software** DX Sources [dx-sources] **Researcher** ![](https://www.gravatar.com/avatar/c4c6944fc985a788726e03ffcb9629ff.jpg?s=32&d=mp&r=g)afnaan More Details > #### Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2026-2306 ** Patch Status **Patched** Published **May 5, 2026** **Affected Software** Ninja Tables – Easy Data Table Builder [ninja-tables] **Researcher** ![](https://www.gravatar.com/avatar/37cc74b0e1957fee81825154abeae540.jpg?s=32&d=mp&r=g)nquangit More Details > #### User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2026-3601 ** Patch Status **Patched** Published **May 4, 2026** **Affected Software** User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration] **Researcher** ![](https://www.gravatar.com/avatar/233ef42c47535ec3a7ba55e8892ff1f7.jpg?s=32&d=mp&r=g)Hunter Jensen (skid) More Details > #### WP Business Intelligence Lite <= 3.2.0 - Missing Authorization 4.3 CVSS Rating **4.3 (Medium)** Patch Status **Unpatched** Published **May 5, 2026** **Affected Software** WP Business Intelligence Lite [wp-business-intelligence-lite] **Researcher** ![](https://www.gravatar.com/avatar/9a7afdb6686beacc853a9cd18b64a40b.jpg?s=32&d=mp&r=g)Nabil Irawan - Heroes Cyber Security More Details > #### WPGraphQL <= 2.5.3 - Cross-Site Request Forgery 4.3 CVSS Rating **4.3 (Medium)** CVE-ID ** CVE-2025-68604 ** Patch Status **Patched** Published **May 7, 2026** **Affected Software** WPGraphQL [wp-graphql] **Researcher** ![](https://www.gravatar.com/avatar/86a1429aeb8e473ec62cf8dd3d4e4571.jpg?s=32&d=mp&r=g)Nabil Irawan More Details > * * * _As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence._ This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (May 11, 2026 to May 17, 2026) appeared first on Wordfence.