CVE-2026-42718 - Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

CVE-2026-42717 - Administrator SQL Injection in Leyka <= 3.32.3 versions.

CVE-2026-42716 - Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

CVE-2026-42715 - Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

CVE-2026-42712 - Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

CVE-2026-42711 - Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

CVE-2026-42709 - Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooC

CVE-2026-42706 - Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

CVE-2026-42705 - Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVE-2026-42704 - Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

CVE-2026-42702 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-42699 - Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

CVE-2026-42697 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-42696 - Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault –

CVE-2026-42693 - Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

CVE-2026-42633 - Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

CVE-2026-42632 - Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

CVE-2026-42631 - Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

CVE-2026-42630 - Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions

CVE-2026-42419 - Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

CVE-2026-40808 - Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

CVE-2026-40805 - Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

CVE-2026-40803 - Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

CVE-2026-40802 - Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

CVE-2026-40801 - Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

CVE-2026-40800 - Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5

CVE-2026-40777 - Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

CVE-2026-39802 - Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

CVE-2026-39801 - Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

CVE-2026-39800 - Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versi

CVE-2026-39799 - Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

CVE-2026-27350 - Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Requ

CVE-2026-108604 - Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safe

CVE-2026-108603 - slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that

CVE-2026-108602 - Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webh

CVE-2026-107434 - Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

CVE-2026-107420 - Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment G

CVE-2026-103685 - Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress

CVE-2026-96341 - Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Esca

CVE-2026-94590 - Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloa

CVE-2026-57806 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-108600 - open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerabili

CVE-2026-108599 - phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious re

CVE-2026-108598 - Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows un

CVE-2026-108597 - Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_mod

CVE-2026-108596 - OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read

CVE-2026-108595 - Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents t

CVE-2026-108594 - Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Conn

CVE-2026-108593 - 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-t

CVE-2026-108592 - mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvi

CVE-2026-108591 - InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrato

CVE-2026-106610 - Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-ot

CVE-2026-105892 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCa

CVE-2026-94160 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-62044 - Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player al

CVE-2026-108586 - 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability tha

CVE-2026-108585 - argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_

CVE-2026-106609 - Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiti

CVE-2026-106608 - Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege

CVE-2026-105889 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-104398 - Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooComm

CVE-2026-103357 - Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows

CVE-2026-103071 - Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page

CVE-2026-108583 - zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows at

CVE-2026-108582 - GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server fi

CVE-2026-108581 - TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authen

CVE-2026-108580 - AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnera

CVE-2026-108579 - OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated a

CVE-2026-108555 - PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote atta

CVE-2026-108554 - PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that a

CVE-2026-108553 - OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows comman

CVE-2026-108551 - openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attack

CVE-2026-108550 - SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and

CVE-2026-108549 - cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter

CVE-2026-108548 - AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's a

CVE-2026-108547 - AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows a

CVE-2026-108546 - Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler t

CVE-2026-108545 - SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenti

CVE-2026-108115 - Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows p

CVE-2026-108114 - Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API

CVE-2026-97264 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-97263 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94676 - Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Objec

CVE-2026-66435 - Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollb

CVE-2026-108165 - Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization s

CVE-2026-108164 - Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerab

CVE-2026-108163 - Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler

CVE-2026-108162 - Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated

CVE-2026-108161 - FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download(

CVE-2026-105885 - Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Inj

CVE-2026-102388 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-107794 - ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

CVE-2026-107373 - ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV l

CVE-2013-10076 - ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty li

CVE-2026-103636 - Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-103635 - Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103513 - Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103501 - Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-108506 - ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate acce

CVE-2026-106139 - In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to

CVE-2026-106138 - In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2

CVE-2026-91136 - The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and inclu

CVE-2026-4791 - The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-108505 - ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture

CVE-2026-107657 - The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnera

CVE-2026-104722 - The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul

CVE-2026-97396 - The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to

CVE-2026-97340 - The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored

CVE-2026-96765 - The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vul

CVE-2026-96662 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-96653 - The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_nam

CVE-2026-96563 - The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store

CVE-2026-96278 - The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUES

CVE-2026-93951 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-93950 - Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Co

CVE-2026-93949 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shoppi

CVE-2026-93945 - Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injecti

CVE-2026-93944 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Inje

CVE-2026-93943 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Inject

CVE-2026-93942 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injectio

CVE-2026-93941 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injectio

CVE-2026-93940 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Inject

CVE-2026-93938 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object In

CVE-2026-93937 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injectio

CVE-2026-93936 - Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Inject

CVE-2026-93935 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Objec

CVE-2026-93934 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Inje

CVE-2026-93933 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object

CVE-2026-93932 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Objec

CVE-2026-93931 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injectio

CVE-2026-93930 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Inject

CVE-2026-93929 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object In

CVE-2026-93927 - Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.Thi

CVE-2026-93746 - The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for W

CVE-2026-62046 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object

CVE-2026-62045 - Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Objec

CVE-2026-108504 - ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for metho

CVE-2026-106606 - Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce

CVE-2026-104803 - The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to,

CVE-2026-104759 - The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vul

CVE-2026-104728 - The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for

CVE-2026-103478 - The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored C

CVE-2026-102774 - The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DO

CVE-2026-102291 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-101921 - The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

CVE-2026-101920 - The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPres

CVE-2026-100178 - The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting

CVE-2026-100147 - The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored

CVE-2026-97348 - The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versi

CVE-2026-96840 - The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-96574 - The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restrictio

CVE-2026-96572 - The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Si

CVE-2026-96558 - The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to S

CVE-2026-95684 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc

CVE-2026-94538 - The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up t

CVE-2026-89100 - The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Sit

CVE-2026-6243 - The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

CVE-2026-5725 - The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fv

CVE-2026-3717 - The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized

CVE-2026-15178 - The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, a

CVE-2026-12626 - The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to

CVE-2026-108503 - ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided

CVE-2026-108502 - ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applicatio

CVE-2026-107742 - The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is

CVE-2026-107712 - The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Inject

CVE-2026-104801 - The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbi

CVE-2026-104006 - The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive I

CVE-2026-103897 - The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting

CVE-2026-103427 - The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cou

CVE-2026-102402 - The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-100196 - The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to St

CVE-2026-100161 - The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site

CVE-2026-97643 - The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored C

CVE-2026-96682 - The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Cont

CVE-2026-96667 - The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t

CVE-2026-94421 - The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' p

CVE-2026-94375 - The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Info

CVE-2026-94257 - The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being chang

CVE-2026-94256 - The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the

CVE-2026-93775 - The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-92975 - The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Pr

CVE-2026-91862 - The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-91050 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-87781 - The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter befo

CVE-2026-87780 - The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted

CVE-2026-85571 - The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course cont

CVE-2026-83526 - The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a

CVE-2026-78068 - The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-77183 - The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege e

CVE-2026-18558 - The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnera

CVE-2026-18496 - The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

CVE-2026-17025 - The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location'

CVE-2026-16776 - The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulner

CVE-2026-14882 - The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '

CVE-2026-14877 - The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-14379 - The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plug

CVE-2026-14335 - The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is

CVE-2026-12054 - The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFER

CVE-2026-107323 - The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its galler

CVE-2026-107321 - The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the d

CVE-2026-107120 - The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against it

CVE-2026-105995 - The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before retu

CVE-2026-105990 - The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any a

CVE-2026-105989 - The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any a

CVE-2026-105977 - The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorizat

CVE-2026-105976 - The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization ch

CVE-2026-104899 - The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre

CVE-2026-104766 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-104763 - The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all v

CVE-2026-104762 - The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to

CVE-2026-104754 - The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value

CVE-2026-104753 - The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter

CVE-2026-104752 - The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file up

CVE-2026-104742 - The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to au

CVE-2026-104741 - The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to au

CVE-2026-104725 - The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Pr

CVE-2026-104723 - The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t

CVE-2026-104023 - The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'si

CVE-2026-103912 - The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM

CVE-2026-103520 - The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnera

CVE-2026-103482 - The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Script

CVE-2026-9696 - The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_

CVE-2026-97670 - The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all version

CVE-2026-97630 - The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-96648 - The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-89301 - The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file

CVE-2026-87869 - The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflec

CVE-2026-6723 - The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress

CVE-2026-5727 - The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

CVE-2026-104993 - The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre

CVE-2026-104735 - The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plu

CVE-2026-104724 - The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin fo

CVE-2026-104021 - The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,

CVE-2026-103998 - The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v

CVE-2026-103964 - The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

CVE-2026-103889 - The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execut

CVE-2026-103424 - The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to S

CVE-2026-102401 - The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regu

CVE-2026-101324 - The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo

CVE-2026-96743 - The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-94589 - The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for Word

CVE-2026-108501 - ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary a

CVE-2026-107645 - The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to,

CVE-2026-104898 - The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to

CVE-2026-104797 - The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Aut

CVE-2026-104732 - The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions

CVE-2026-103365 - The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to

CVE-2026-101947 - ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths

CVE-2026-93883 - The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scr

CVE-2026-104915 - The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulne