{"items":[{"id":"CVE-2026-57666","published":"2026-11-04T08:00:17.428Z","updated":"2026-11-04T08:00:17.428Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119366","published":"2026-11-04T08:00:17.394Z","updated":"2026-11-04T08:00:17.394Z","title":"WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-62007","published":"2026-11-04T08:00:17.118Z","updated":"2026-11-04T08:00:17.118Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-54861","published":"2026-11-04T08:00:17.026Z","updated":"2026-11-04T08:00:17.026Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-62126","published":"2026-11-04T08:00:16.984Z","updated":"2026-11-04T08:00:16.984Z","title":"WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-57775","published":"2026-11-04T08:00:16.575Z","updated":"2026-11-04T08:00:16.575Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-57639","published":"2026-11-04T08:00:16.567Z","updated":"2026-11-04T08:00:16.567Z","title":"WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Roland Murg","product":"WP Booking System","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119477","published":"2026-11-04T08:00:16.109Z","updated":"2026-11-04T08:00:16.109Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-56065","published":"2026-11-04T08:00:16.083Z","updated":"2026-11-04T08:00:16.083Z","title":"WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Doofinder","product":"Doofinder for WooCommerce","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-54851","published":"2026-11-04T07:00:37.741Z","updated":"2026-11-04T07:00:37.741Z","title":"WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Awesomemotive","product":"Contact Form by WPForms","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-62000","published":"2026-11-04T07:00:37.663Z","updated":"2026-11-04T07:00:37.663Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119509","published":"2026-11-03T17:03:46.228Z","updated":"2026-11-03T22:41:20.019Z","title":"WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eranfl","product":"ClickCease Click Fraud Protection","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-97072","published":"2026-11-03T17:02:23.919Z","updated":"2026-11-03T17:25:22.004Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-114187","published":"2026-11-03T17:01:22.719Z","updated":"2026-11-03T17:02:23.679Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-103077","published":"2026-11-03T17:00:11.724Z","updated":"2026-11-03T22:41:26.022Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-114185","published":"2026-11-03T16:59:35.394Z","updated":"2026-11-03T17:26:18.705Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119485","published":"2026-11-03T16:57:33.723Z","updated":"2026-11-03T16:58:34.370Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-39777","published":"2026-11-03T16:55:05.128Z","updated":"2026-11-03T16:56:05.616Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119487","published":"2026-11-03T16:52:54.932Z","updated":"2026-11-03T17:26:46.976Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120843","published":"2026-11-03T16:51:22.083Z","updated":"2026-11-03T16:52:22.878Z","title":"WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Barn2 Plugins","product":"Posts Table with Search & Sort","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-114183","published":"2026-11-03T16:49:43.622Z","updated":"2026-11-03T16:50:43.569Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-116859","published":"2026-11-03T16:48:24.138Z","updated":"2026-11-03T22:41:32.139Z","title":"WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-116858","published":"2026-11-03T16:45:49.000Z","updated":"2026-11-03T16:46:49.307Z","title":"WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-39743","published":"2026-11-03T16:44:44.480Z","updated":"2026-11-03T16:45:45.606Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120846","published":"2026-11-03T16:44:19.563Z","updated":"2026-11-03T16:45:20.758Z","title":"WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119521","published":"2026-11-03T16:43:38.652Z","updated":"2026-11-03T16:43:39.074Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119495","published":"2026-11-03T16:43:08.775Z","updated":"2026-11-03T17:19:37.063Z","title":"WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Better Search","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-66570","published":"2026-11-01T16:00:09.605Z","updated":"2026-11-01T17:37:10.026Z","title":"WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nickboss","product":"WordPress File Upload","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-119480","published":"2026-11-01T16:00:09.213Z","updated":"2026-11-01T17:37:19.222Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-62048","published":"2026-11-01T16:00:09.158Z","updated":"2026-11-01T17:37:28.623Z","title":"WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-118090","published":"2026-10-30T18:30:57.420Z","updated":"2026-10-30T18:50:06.371Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-118089","published":"2026-10-30T18:30:56.607Z","updated":"2026-10-30T18:50:06.521Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-118086","published":"2026-10-30T18:30:54.718Z","updated":"2026-10-30T22:15:49.368Z","title":"WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-116862","published":"2026-10-30T18:30:53.968Z","updated":"2026-10-30T18:50:06.680Z","title":"WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Acato","product":"WP REST Cache","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-116861","published":"2026-10-30T18:30:53.202Z","updated":"2026-10-30T18:50:06.822Z","title":"WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"wpdesk","product":"Flexible Chat","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-116854","published":"2026-10-30T18:30:52.464Z","updated":"2026-10-30T18:50:06.975Z","title":"WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-116853","published":"2026-10-30T18:30:51.710Z","updated":"2026-10-30T18:50:07.134Z","title":"WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-116852","published":"2026-10-30T18:30:50.961Z","updated":"2026-10-30T22:15:55.746Z","title":"WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Marketing Fire","product":"Widget Options","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-116851","published":"2026-10-30T18:30:50.217Z","updated":"2026-10-30T18:50:07.289Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116847","published":"2026-10-30T18:30:49.476Z","updated":"2026-10-30T18:50:07.433Z","title":"WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116410","published":"2026-10-30T18:30:48.730Z","updated":"2026-10-30T18:50:07.593Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-116405","published":"2026-10-30T18:30:47.976Z","updated":"2026-10-30T18:50:07.747Z","title":"WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116401","published":"2026-10-30T18:30:47.215Z","updated":"2026-10-30T22:16:02.694Z","title":"WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-116386","published":"2026-10-30T18:30:46.458Z","updated":"2026-10-30T18:50:07.905Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-115947","published":"2026-10-30T18:30:45.703Z","updated":"2026-10-30T18:50:08.056Z","title":"WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-115604","published":"2026-10-30T18:30:44.953Z","updated":"2026-10-30T18:50:08.230Z","title":"WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-114711","published":"2026-10-30T18:30:44.199Z","updated":"2026-10-30T18:50:08.382Z","title":"WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-107868","published":"2026-10-30T18:30:43.460Z","updated":"2026-10-30T22:16:09.766Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITHEMES","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-105077","published":"2026-10-30T18:30:42.711Z","updated":"2026-10-30T19:00:18.568Z","title":"WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-94175","published":"2026-10-30T18:30:41.949Z","updated":"2026-10-30T19:00:18.724Z","title":"WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"All In One Login","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-90888","published":"2026-10-30T18:30:41.184Z","updated":"2026-10-30T19:00:18.867Z","title":"WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"leadsnap","product":"LeadSnap","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-78527","published":"2026-10-30T18:30:40.428Z","updated":"2026-10-30T22:16:24.495Z","title":"WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Testimonial Slider","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-73186","published":"2026-10-30T18:30:39.660Z","updated":"2026-10-30T19:00:19.002Z","title":"WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ShortPixel","product":"Enable Media Replace","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-54855","published":"2026-10-30T18:30:38.911Z","updated":"2026-10-30T19:00:19.152Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-54854","published":"2026-10-30T18:30:38.149Z","updated":"2026-10-30T19:00:19.289Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-54850","published":"2026-10-30T18:30:37.392Z","updated":"2026-10-30T19:00:19.472Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-48201","published":"2026-10-30T18:30:36.622Z","updated":"2026-10-30T22:16:45.956Z","title":"WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Raul P.","product":"Fast Velocity Minify","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39786","published":"2026-10-30T18:30:35.811Z","updated":"2026-10-30T19:00:19.629Z","title":"WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bookingalgorithms","product":"BA Book Everything","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39738","published":"2026-10-30T18:30:34.923Z","updated":"2026-11-01T10:33:20.156Z","title":"WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-39734","published":"2026-10-30T18:30:34.168Z","updated":"2026-10-30T19:00:19.915Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-39732","published":"2026-10-30T18:30:33.419Z","updated":"2026-10-30T19:00:20.047Z","title":"WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ivijan-Stefan Stipic","product":"Transliterator","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-28160","published":"2026-10-30T18:30:32.657Z","updated":"2026-11-02T06:29:27.699Z","title":"WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-27061","published":"2026-10-30T18:30:31.909Z","updated":"2026-10-30T19:00:20.210Z","title":"WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-119526","published":"2026-10-30T18:30:31.153Z","updated":"2026-10-30T19:00:20.359Z","title":"WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Royal Event","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-62056","published":"2026-10-30T18:14:58.428Z","updated":"2026-10-30T18:33:56.893Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-62023","published":"2026-10-30T18:14:07.501Z","updated":"2026-10-30T18:49:58.188Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-62019","published":"2026-10-30T18:13:23.687Z","updated":"2026-10-30T18:49:58.331Z","title":"WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-104674","published":"2026-10-30T18:12:56.057Z","updated":"2026-10-30T18:49:58.474Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-62047","published":"2026-10-30T18:12:37.091Z","updated":"2026-10-30T18:49:58.628Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-39739","published":"2026-10-30T18:11:41.349Z","updated":"2026-10-30T18:34:07.113Z","title":"WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Ultimate Addons for Elementor - Lite","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-52710","published":"2026-10-30T18:09:43.100Z","updated":"2026-10-30T19:00:20.558Z","title":"WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ithemelandco","product":"GIFTiT &#8211; Free Gifts for WooCommerce","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-62057","published":"2026-10-30T18:08:54.944Z","updated":"2026-10-30T19:00:20.717Z","title":"WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fahim Reza","product":"Divi Contact Form 7","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-62121","published":"2026-10-30T18:06:19.970Z","updated":"2026-10-30T18:49:58.770Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-62122","published":"2026-10-30T18:05:54.717Z","updated":"2026-10-30T18:49:58.921Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-119466","published":"2026-10-30T16:16:28.198Z","updated":"2026-10-30T16:39:18.607Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-65566","published":"2026-10-30T16:15:59.202Z","updated":"2026-10-30T17:18:21.422Z","title":"WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-62055","published":"2026-10-30T16:11:26.969Z","updated":"2026-10-30T17:18:21.560Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-119365","published":"2026-10-30T16:11:00.627Z","updated":"2026-10-30T17:18:21.690Z","title":"WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Media Player Addons for Elementor – Media Player widget for WP","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-119367","published":"2026-10-30T16:10:10.603Z","updated":"2026-10-30T17:18:21.825Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-62141","published":"2026-10-30T15:29:24.363Z","updated":"2026-10-30T17:18:22.239Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-119369","published":"2026-10-30T15:10:13.570Z","updated":"2026-10-30T15:43:43.340Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-119479","published":"2026-10-30T15:09:48.592Z","updated":"2026-10-30T17:18:22.511Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-116407","published":"2026-10-30T15:08:52.909Z","updated":"2026-10-30T15:50:49.510Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-119368","published":"2026-10-30T15:02:22.664Z","updated":"2026-10-30T17:18:22.640Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-119482","published":"2026-10-30T15:01:55.085Z","updated":"2026-10-30T17:18:22.784Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-116860","published":"2026-10-30T14:42:18.051Z","updated":"2026-10-30T15:07:31.474Z","title":"WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-119370","published":"2026-10-30T14:41:30.900Z","updated":"2026-10-30T15:07:31.625Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-65444","published":"2026-10-30T14:40:48.198Z","updated":"2026-10-30T15:07:31.758Z","title":"WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Creative Themes","product":"Blocksy Companion","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-118084","published":"2026-10-29T15:24:41.085Z","updated":"2026-10-30T18:39:14.169Z","title":"WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-118083","published":"2026-10-29T15:24:40.327Z","updated":"2026-10-30T18:49:59.436Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-118082","published":"2026-10-29T15:24:39.565Z","updated":"2026-10-30T18:49:59.606Z","title":"WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-118081","published":"2026-10-29T15:24:38.804Z","updated":"2026-10-29T19:43:59.116Z","title":"WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"10Web Social Photo Feed","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-118080","published":"2026-10-29T15:24:38.055Z","updated":"2026-10-29T17:15:13.611Z","title":"WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Social Snap","product":"Social Snap","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-118079","published":"2026-10-29T15:24:37.276Z","updated":"2026-11-03T16:48:08.846Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-118078","published":"2026-10-29T15:24:36.520Z","updated":"2026-10-30T18:49:59.967Z","title":"WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PixelYourSite","product":"Product Catalog Feed by PixelYourSite","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-118077","published":"2026-10-29T15:24:35.763Z","updated":"2026-10-30T18:50:00.172Z","title":"WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Fast Themes","product":"Sastra Essential Addons for Elementor","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-118076","published":"2026-10-29T15:24:35.032Z","updated":"2026-10-29T19:44:58.856Z","title":"WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Frisbii","product":"Frisbii Pay","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-118075","published":"2026-10-29T15:24:34.274Z","updated":"2026-10-29T17:15:20.028Z","title":"WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"dbarrere","product":"WP Media folders","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-118074","published":"2026-10-29T15:24:33.509Z","updated":"2026-10-30T18:50:00.340Z","title":"WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Daman Jeet","product":"Finale Lite","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-118073","published":"2026-10-29T15:24:32.755Z","updated":"2026-10-30T18:50:00.514Z","title":"WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-116869","published":"2026-10-29T15:24:32.010Z","updated":"2026-10-30T18:50:00.662Z","title":"WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"myPOS Payments","product":"myPOS Checkout","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-116868","published":"2026-10-29T15:24:31.253Z","updated":"2026-10-29T19:45:42.553Z","title":"WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyDev","product":"BuddyPress Xprofile Custom Field Types","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-116867","published":"2026-10-29T15:24:30.502Z","updated":"2026-10-29T17:15:40.473Z","title":"WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"sosidee","product":"Dynamic QR Code &#8211; generator","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-116866","published":"2026-10-29T15:24:29.747Z","updated":"2026-10-30T18:50:00.815Z","title":"WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Dotstore","product":"Extra Fees Plugin for WooCommerce","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-116865","published":"2026-10-29T15:24:29.022Z","updated":"2026-10-30T18:50:00.961Z","title":"WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Gesundheit Bewegt GmbH","product":"Zippy","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-116864","published":"2026-10-29T15:24:28.267Z","updated":"2026-10-30T18:50:01.124Z","title":"WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Arni Cinco","product":"WPCargo Track & Trace","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-108494","published":"2026-10-29T15:24:27.520Z","updated":"2026-10-29T19:46:58.960Z","title":"WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Chained Quiz","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-62131","published":"2026-10-29T15:24:26.750Z","updated":"2026-10-30T18:50:01.303Z","title":"WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Zoho Flow","product":"Zoho Flow","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-62018","published":"2026-10-29T15:24:26.009Z","updated":"2026-10-29T19:48:00.882Z","title":"WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gunslinger","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-62017","published":"2026-10-29T15:24:25.273Z","updated":"2026-10-29T17:16:01.751Z","title":"WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Good Homes","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-62016","published":"2026-10-29T15:24:24.535Z","updated":"2026-10-30T18:50:01.447Z","title":"WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamic","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62015","published":"2026-10-29T15:24:23.807Z","updated":"2026-10-30T18:50:01.608Z","title":"WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamezone","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62014","published":"2026-10-29T15:24:23.059Z","updated":"2026-10-30T18:50:01.772Z","title":"WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"EmojiNation","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-62013","published":"2026-10-29T15:24:22.290Z","updated":"2026-10-29T19:49:22.240Z","title":"WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Edge Decor","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-62012","published":"2026-10-29T15:24:21.539Z","updated":"2026-10-29T17:16:19.063Z","title":"WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Coinpress","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-62011","published":"2026-10-29T15:24:20.782Z","updated":"2026-10-30T18:50:01.917Z","title":"WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Bonbon","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62010","published":"2026-10-29T15:24:20.043Z","updated":"2026-10-30T18:50:02.069Z","title":"WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Avventure","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62009","published":"2026-10-29T15:24:19.287Z","updated":"2026-10-30T18:50:02.217Z","title":"WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Filmax","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-62008","published":"2026-10-29T15:24:18.536Z","updated":"2026-10-29T19:43:02.462Z","title":"WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Orpheus","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-62006","published":"2026-10-29T15:24:17.789Z","updated":"2026-10-29T17:16:25.167Z","title":"WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Nuts","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-62005","published":"2026-10-29T15:24:17.046Z","updated":"2026-10-30T18:50:02.379Z","title":"WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Muzicon","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62004","published":"2026-10-29T15:24:16.292Z","updated":"2026-10-30T18:50:02.531Z","title":"WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Motorix","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62003","published":"2026-10-29T15:24:15.533Z","updated":"2026-10-30T18:50:02.679Z","title":"WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Mission","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-62002","published":"2026-10-29T15:24:14.783Z","updated":"2026-10-29T19:42:29.362Z","title":"WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Meals & Wheels","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-62001","published":"2026-10-29T15:24:14.045Z","updated":"2026-10-29T17:16:36.644Z","title":"WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Marcell","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-61998","published":"2026-10-29T15:24:13.299Z","updated":"2026-10-30T18:50:02.827Z","title":"WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Le Truffe","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-61997","published":"2026-10-29T15:24:12.567Z","updated":"2026-10-30T18:50:03.004Z","title":"WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Legal Stone","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-61996","published":"2026-10-29T15:24:11.830Z","updated":"2026-10-30T18:39:14.014Z","title":"WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"favethemes","product":"MLS On The Fly","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-61995","published":"2026-10-29T15:24:10.950Z","updated":"2026-10-29T19:41:43.590Z","title":"WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"emarket-design","product":"YouTube Showcase","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-61993","published":"2026-10-29T15:24:10.200Z","updated":"2026-10-29T17:16:44.466Z","title":"WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"blockonomics","product":"Blockonomics","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-61992","published":"2026-10-29T15:24:09.438Z","updated":"2026-10-30T18:50:03.183Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Von Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-61991","published":"2026-10-29T15:24:08.677Z","updated":"2026-10-30T18:50:03.334Z","title":"WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Ajax Load More","product":"AjaxLoadMore Cache","kev":false,"epss":0.00748,"kevAdded":null},{"id":"CVE-2026-61989","published":"2026-10-29T15:24:07.932Z","updated":"2026-10-30T18:50:03.505Z","title":"WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Merv Barrett","product":"Easy Property Listings","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-61988","published":"2026-10-29T15:24:07.189Z","updated":"2026-10-29T19:41:03.059Z","title":"WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"morehawes","product":"Auction Nudge – Your eBay on Your Site","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-54866","published":"2026-10-29T15:24:06.443Z","updated":"2026-10-29T17:16:52.192Z","title":"WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Razorpay","product":"Razorpay Payment Button Elementor Plugin","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-54865","published":"2026-10-29T15:24:05.681Z","updated":"2026-10-30T18:39:13.879Z","title":"WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Podamibe Nepal","product":"Podamibe Custom User Gravatar","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-54864","published":"2026-10-29T15:24:04.940Z","updated":"2026-10-30T18:50:03.679Z","title":"WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"nicashmu","product":"Post Video Players","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-54860","published":"2026-10-29T15:24:04.196Z","updated":"2026-10-30T18:50:03.835Z","title":"WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Ozisti","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-54859","published":"2026-10-29T15:24:03.450Z","updated":"2026-10-29T19:40:30.116Z","title":"WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Preservation","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-54858","published":"2026-10-29T15:24:02.681Z","updated":"2026-10-29T17:16:59.146Z","title":"WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Printy","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-54857","published":"2026-10-29T15:24:01.923Z","updated":"2026-10-30T18:50:04.264Z","title":"WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Quirky","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-54856","published":"2026-10-29T15:24:01.171Z","updated":"2026-10-30T18:50:04.441Z","title":"WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"RexCoin","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-42701","published":"2026-10-29T15:24:00.414Z","updated":"2026-10-30T18:50:04.609Z","title":"WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YayCommerce","product":"YayMail","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-42692","published":"2026-10-29T15:23:59.420Z","updated":"2026-10-29T19:39:42.399Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-42690","published":"2026-10-29T15:23:58.663Z","updated":"2026-10-29T17:17:08.164Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-27394","published":"2026-10-29T15:23:57.862Z","updated":"2026-10-30T18:50:04.772Z","title":"WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jyothis Joy","product":"Eventer","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-118085","published":"2026-10-29T15:23:57.104Z","updated":"2026-10-30T18:50:05.160Z","title":"WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Global Payments","product":"GlobalPayments WooCommerce","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-42694","published":"2026-10-29T15:05:18.749Z","updated":"2026-10-30T18:50:05.330Z","title":"WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-48200","published":"2026-10-29T15:04:50.615Z","updated":"2026-10-29T17:18:26.068Z","title":"WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Barn2 Plugins","product":"Document Library Lite","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-116848","published":"2026-10-29T15:04:29.001Z","updated":"2026-10-30T18:39:13.456Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH Innovations","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-109891","published":"2026-10-29T15:04:03.409Z","updated":"2026-10-30T18:50:05.523Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-25448","published":"2026-10-29T14:55:02.968Z","updated":"2026-10-29T19:34:34.063Z","title":"WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-42691","published":"2026-10-29T14:40:48.838Z","updated":"2026-10-30T19:00:20.857Z","title":"WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-54852","published":"2026-10-29T14:40:27.236Z","updated":"2026-10-30T19:00:20.999Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-97073","published":"2026-10-29T14:39:40.470Z","updated":"2026-10-29T17:18:39.592Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-118097","published":"2026-10-29T14:39:07.281Z","updated":"2026-10-29T19:34:06.345Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-27062","published":"2026-10-29T14:38:48.633Z","updated":"2026-10-30T19:00:21.175Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-54853","published":"2026-10-29T14:32:35.962Z","updated":"2026-10-29T17:19:05.990Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-114706","published":"2026-10-29T14:32:29.513Z","updated":"2026-10-30T18:39:13.589Z","title":"WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-27063","published":"2026-10-29T14:32:08.078Z","updated":"2026-10-30T18:50:05.686Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-115601","published":"2026-10-29T14:31:58.839Z","updated":"2026-10-30T18:50:05.850Z","title":"WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Custom Price for WooCommerce","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-115605","published":"2026-10-29T14:29:40.076Z","updated":"2026-10-29T16:49:18.631Z","title":"WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-118095","published":"2026-10-29T14:29:27.704Z","updated":"2026-10-29T16:49:18.797Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-54871","published":"2026-10-29T14:29:24.576Z","updated":"2026-10-29T16:49:18.942Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-25450","published":"2026-10-29T14:29:14.280Z","updated":"2026-10-29T16:49:19.089Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-116850","published":"2026-10-29T14:29:07.948Z","updated":"2026-10-29T16:49:19.233Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-114181","published":"2026-10-29T14:28:58.705Z","updated":"2026-10-29T16:49:19.379Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-118088","published":"2026-10-29T14:26:27.526Z","updated":"2026-10-29T16:49:19.530Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-116849","published":"2026-10-29T14:26:08.716Z","updated":"2026-10-29T16:49:19.673Z","title":"WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-110881","published":"2026-10-29T14:25:46.727Z","updated":"2026-10-29T16:49:19.816Z","title":"WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116856","published":"2026-10-29T14:24:43.173Z","updated":"2026-10-29T16:49:19.958Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-39737","published":"2026-10-29T14:24:19.832Z","updated":"2026-10-29T17:19:30.379Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-118091","published":"2026-10-29T14:23:51.139Z","updated":"2026-10-30T18:50:06.004Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-116387","published":"2026-10-29T14:22:37.807Z","updated":"2026-10-30T18:50:06.170Z","title":"WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-39742","published":"2026-10-29T14:20:45.598Z","updated":"2026-10-29T14:37:20.747Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-115610","published":"2026-10-29T14:20:16.168Z","updated":"2026-10-30T18:39:13.737Z","title":"WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-118092","published":"2026-10-29T14:17:28.380Z","updated":"2026-10-29T17:19:46.176Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-116406","published":"2026-10-29T14:16:17.757Z","updated":"2026-10-29T16:49:20.101Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-52708","published":"2026-10-29T14:15:19.164Z","updated":"2026-10-29T16:49:20.247Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-116846","published":"2026-10-29T14:14:41.416Z","updated":"2026-10-29T16:49:20.397Z","title":"WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-48884","published":"2026-10-29T14:13:18.988Z","updated":"2026-10-29T16:49:20.542Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-39736","published":"2026-10-29T14:08:21.817Z","updated":"2026-10-29T16:49:21.267Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-116402","published":"2026-10-29T14:05:58.547Z","updated":"2026-10-29T16:49:21.421Z","title":"WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-48202","published":"2026-10-29T13:58:06.273Z","updated":"2026-10-29T16:49:21.568Z","title":"WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brave","product":"Brave","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-39782","published":"2026-10-29T13:56:43.214Z","updated":"2026-10-29T16:49:21.714Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-25467","published":"2026-10-29T13:55:28.476Z","updated":"2026-10-29T16:49:21.855Z","title":"WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-116399","published":"2026-10-29T13:54:04.259Z","updated":"2026-10-29T16:49:21.999Z","title":"WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-116857","published":"2026-10-29T13:53:39.647Z","updated":"2026-10-29T16:49:22.150Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-54862","published":"2026-10-29T13:09:14.823Z","updated":"2026-10-29T13:47:35.097Z","title":"WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Codection","product":"Import and export users and customers","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-42707","published":"2026-10-29T13:07:48.740Z","updated":"2026-10-29T13:47:35.256Z","title":"WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress Claim Listings","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-48195","published":"2026-10-29T13:07:16.802Z","updated":"2026-10-29T13:47:35.412Z","title":"WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-39741","published":"2026-10-29T13:06:11.953Z","updated":"2026-10-29T13:47:35.579Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-48196","published":"2026-10-29T13:04:39.022Z","updated":"2026-10-29T13:47:35.754Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-22386","published":"2026-10-29T13:04:17.195Z","updated":"2026-10-29T13:47:35.898Z","title":"WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-52709","published":"2026-10-29T13:03:56.761Z","updated":"2026-10-29T13:47:36.058Z","title":"WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-24533","published":"2026-10-29T13:02:13.252Z","updated":"2026-10-29T13:47:36.226Z","title":"WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-42703","published":"2026-10-29T13:01:49.395Z","updated":"2026-10-29T13:47:36.384Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-118087","published":"2026-10-29T13:01:05.153Z","updated":"2026-10-29T13:47:36.553Z","title":"WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-118094","published":"2026-10-29T12:59:46.185Z","updated":"2026-10-29T13:47:36.720Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-39735","published":"2026-10-29T12:58:57.438Z","updated":"2026-10-29T13:47:36.877Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-56056","published":"2026-10-29T12:58:32.218Z","updated":"2026-10-29T13:47:37.027Z","title":"WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"The Post Grid","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-118093","published":"2026-10-29T12:58:10.017Z","updated":"2026-10-29T13:47:37.178Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"Product Feed Manager","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-27401","published":"2026-10-29T11:28:05.240Z","updated":"2026-10-29T12:36:50.510Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-115611","published":"2026-10-29T11:00:26.280Z","updated":"2026-10-29T12:36:51.406Z","title":"WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"TableOn","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-115964","published":"2026-10-29T11:00:25.837Z","updated":"2026-10-29T12:36:51.554Z","title":"WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-115962","published":"2026-10-29T11:00:25.822Z","updated":"2026-10-29T12:36:51.694Z","title":"WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-115592","published":"2026-10-29T11:00:25.353Z","updated":"2026-10-29T12:36:51.841Z","title":"WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OceanWP","product":"OceanWP","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116409","published":"2026-10-29T11:00:25.348Z","updated":"2026-10-29T12:36:51.988Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112827","published":"2026-10-29T11:00:24.746Z","updated":"2026-10-29T12:36:52.128Z","title":"WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"HANDMADE – Dropshipping for Etsy and WooCommerce","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-114193","published":"2026-10-29T11:00:24.744Z","updated":"2026-10-29T12:36:52.272Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-115599","published":"2026-10-29T11:00:24.169Z","updated":"2026-10-29T12:36:52.417Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-115965","published":"2026-10-29T11:00:24.136Z","updated":"2026-10-29T12:36:52.568Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-115967","published":"2026-10-29T11:00:23.638Z","updated":"2026-10-29T12:36:52.709Z","title":"WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-115963","published":"2026-10-29T11:00:23.604Z","updated":"2026-10-29T12:36:52.863Z","title":"WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-115603","published":"2026-10-28T14:02:57.872Z","updated":"2026-10-29T13:47:37.343Z","title":"WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Advanced Ads GmbH","product":"Advanced Ads – Tracking","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-115968","published":"2026-10-28T14:02:57.496Z","updated":"2026-10-28T16:07:03.811Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-116390","published":"2026-10-28T14:02:57.098Z","updated":"2026-10-29T13:47:37.495Z","title":"WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"stepasyuk","product":"Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-116389","published":"2026-10-28T14:02:56.685Z","updated":"2026-10-29T13:47:37.643Z","title":"WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"crossi72","product":"Phoenix Media Rename","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-115590","published":"2026-10-28T14:02:56.306Z","updated":"2026-10-29T13:47:37.789Z","title":"WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-116391","published":"2026-10-28T13:00:28.765Z","updated":"2026-10-29T13:47:37.936Z","title":"WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Logo Slider","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-116392","published":"2026-10-28T13:00:28.367Z","updated":"2026-10-29T13:47:38.092Z","title":"WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-116393","published":"2026-10-28T13:00:28.337Z","updated":"2026-10-28T16:07:23.809Z","title":"WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"iHomefinder, Inc.","product":"Optima Express","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-116404","published":"2026-10-28T13:00:27.971Z","updated":"2026-10-29T13:47:38.245Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-111850","published":"2026-10-28T13:00:27.940Z","updated":"2026-10-29T13:47:38.415Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-115612","published":"2026-10-28T13:00:14.372Z","updated":"2026-10-28T16:07:30.579Z","title":"WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-115591","published":"2026-10-28T13:00:13.962Z","updated":"2026-10-29T13:47:38.566Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-115593","published":"2026-10-28T13:00:13.871Z","updated":"2026-10-29T13:47:38.730Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-115596","published":"2026-10-28T13:00:13.283Z","updated":"2026-10-28T16:07:36.842Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-111411","published":"2026-10-28T13:00:13.279Z","updated":"2026-10-30T20:04:18.969Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-115607","published":"2026-10-28T13:00:12.493Z","updated":"2026-10-29T13:47:38.888Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-115957","published":"2026-10-28T13:00:12.485Z","updated":"2026-10-30T20:05:31.800Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115606","published":"2026-10-28T13:00:11.719Z","updated":"2026-10-29T13:47:39.191Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-115609","published":"2026-10-28T13:00:11.577Z","updated":"2026-10-29T13:47:39.348Z","title":"WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"GetPaid","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-116855","published":"2026-10-28T11:17:47.505Z","updated":"2026-10-29T13:47:39.509Z","title":"WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-116863","published":"2026-10-27T15:56:41.312Z","updated":"2026-10-29T13:47:39.657Z","title":"WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-116408","published":"2026-10-26T17:29:38.120Z","updated":"2026-10-26T17:57:32.081Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-111404","published":"2026-10-26T17:28:57.422Z","updated":"2026-10-26T17:57:32.283Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-112839","published":"2026-10-26T17:28:17.277Z","updated":"2026-10-26T17:57:32.460Z","title":"WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"Customer Coupons for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-115966","published":"2026-10-26T17:27:49.307Z","updated":"2026-10-26T17:57:32.653Z","title":"WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Typing Text – Give your texts many typing effects","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116400","published":"2026-10-26T17:27:17.642Z","updated":"2026-10-26T17:57:32.849Z","title":"WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116398","published":"2026-10-26T17:26:48.798Z","updated":"2026-10-26T17:57:33.053Z","title":"WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Content Slider Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116395","published":"2026-10-26T16:46:39.501Z","updated":"2026-10-26T17:37:09.389Z","title":"WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115598","published":"2026-10-26T16:45:11.621Z","updated":"2026-10-26T17:37:09.543Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-114710","published":"2026-10-26T16:43:59.208Z","updated":"2026-10-26T17:37:09.711Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115597","published":"2026-10-26T16:43:22.281Z","updated":"2026-10-26T17:37:09.885Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-116388","published":"2026-10-26T16:42:54.795Z","updated":"2026-10-26T17:37:10.026Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-116396","published":"2026-10-26T16:39:18.840Z","updated":"2026-10-26T17:37:10.212Z","title":"WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-116403","published":"2026-10-26T16:37:59.242Z","updated":"2026-10-26T17:37:10.367Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-116394","published":"2026-10-26T16:00:08.893Z","updated":"2026-10-26T17:37:11.529Z","title":"WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-114708","published":"2026-10-26T10:36:32.680Z","updated":"2026-10-26T12:54:32.687Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115595","published":"2026-10-26T10:36:08.187Z","updated":"2026-10-26T12:54:32.838Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-115959","published":"2026-10-26T10:35:45.823Z","updated":"2026-10-26T12:54:32.987Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-115960","published":"2026-10-26T10:35:23.855Z","updated":"2026-10-26T12:54:33.130Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-115955","published":"2026-10-26T10:35:04.514Z","updated":"2026-10-26T12:54:33.290Z","title":"WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Advanced Post Block - Post Grid for WordPress block editor","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115956","published":"2026-10-26T10:34:34.613Z","updated":"2026-10-26T12:54:33.447Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115961","published":"2026-10-26T10:34:10.476Z","updated":"2026-10-26T12:54:33.589Z","title":"WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114707","published":"2026-10-26T10:28:54.378Z","updated":"2026-10-26T12:54:33.861Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-115594","published":"2026-10-26T10:28:26.944Z","updated":"2026-10-26T12:54:34.035Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-115608","published":"2026-10-26T10:28:00.697Z","updated":"2026-10-26T12:54:34.228Z","title":"WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-115953","published":"2026-10-26T10:27:38.261Z","updated":"2026-10-26T12:54:34.394Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115954","published":"2026-10-26T10:27:16.990Z","updated":"2026-10-26T12:54:34.575Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-115950","published":"2026-10-26T10:26:54.044Z","updated":"2026-10-26T12:54:34.713Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115951","published":"2026-10-26T10:26:34.727Z","updated":"2026-10-26T12:54:34.854Z","title":"WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kevin Weber","product":"Lazy Load for Videos","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115948","published":"2026-10-26T10:08:37.779Z","updated":"2026-10-26T12:54:35.005Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-114709","published":"2026-10-26T10:08:01.188Z","updated":"2026-10-26T10:23:40.064Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115949","published":"2026-10-26T10:07:24.926Z","updated":"2026-10-26T10:23:40.211Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-115614","published":"2026-10-26T10:05:22.425Z","updated":"2026-10-26T10:23:40.370Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-97255","published":"2026-10-26T10:03:47.707Z","updated":"2026-10-26T10:23:40.524Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-97254","published":"2026-10-26T10:02:36.972Z","updated":"2026-10-26T10:23:40.688Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-97295","published":"2026-10-26T10:01:28.037Z","updated":"2026-10-26T10:23:40.842Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-112865","published":"2026-10-26T10:01:03.255Z","updated":"2026-10-26T10:23:41.001Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-110377","published":"2026-10-26T09:59:47.003Z","updated":"2026-10-26T10:23:41.157Z","title":"WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Bopo – WooCommerce Product Bundle Builder","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-115602","published":"2026-10-26T09:59:24.845Z","updated":"2026-10-26T10:23:41.317Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115613","published":"2026-10-26T09:54:36.992Z","updated":"2026-10-26T10:13:37.674Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-115958","published":"2026-10-26T09:54:20.583Z","updated":"2026-10-26T10:13:37.956Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-110376","published":"2026-10-26T08:47:06.966Z","updated":"2026-10-26T10:13:38.243Z","title":"WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"DEPART","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-111841","published":"2026-10-26T08:46:47.663Z","updated":"2026-10-26T10:13:38.533Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-112828","published":"2026-10-26T08:45:37.443Z","updated":"2026-10-26T10:13:38.809Z","title":"WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-114191","published":"2026-10-24T14:00:09.573Z","updated":"2026-10-24T14:46:58.028Z","title":"WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Knit Pay","product":"UPI QR Code Payment Gateway for WooCommerce","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-114704","published":"2026-10-24T14:00:09.045Z","updated":"2026-10-24T14:46:58.175Z","title":"WordPress Relevanssi  plugin <= 4.28.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Christoph Vielgrader","product":"Relevanssi","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-114192","published":"2026-10-24T14:00:09.029Z","updated":"2026-10-24T14:46:58.324Z","title":"WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-114705","published":"2026-10-24T10:00:11.514Z","updated":"2026-10-24T14:46:58.465Z","title":"WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"quadlayers","product":"WP Social Feed Gallery","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-114194","published":"2026-10-24T09:08:50.102Z","updated":"2026-10-24T14:46:56.574Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-114196","published":"2026-10-24T08:00:13.761Z","updated":"2026-10-24T14:46:58.606Z","title":"WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"paytiumsupport","product":"Paytium","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-114695","published":"2026-10-24T08:00:13.590Z","updated":"2026-10-24T14:46:56.713Z","title":"WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-114694","published":"2026-10-24T08:00:13.325Z","updated":"2026-10-24T14:46:56.850Z","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-114693","published":"2026-10-24T08:00:12.874Z","updated":"2026-10-27T15:06:40.501Z","title":"WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugins360 Labs","product":"All-in-One Video Gallery","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-110892","published":"2026-10-24T08:00:12.427Z","updated":"2026-10-24T14:46:58.746Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-114697","published":"2026-10-24T08:00:12.424Z","updated":"2026-10-24T14:46:57.138Z","title":"WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-114178","published":"2026-10-24T08:00:11.922Z","updated":"2026-10-24T14:46:57.285Z","title":"WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bold Grid","product":"W3 Total Cache","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-114190","published":"2026-10-24T08:00:11.901Z","updated":"2026-10-24T14:46:58.879Z","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-112866","published":"2026-10-24T08:00:11.483Z","updated":"2026-10-24T14:46:59.015Z","title":"WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFactory","product":"Product Filter by WBW","kev":false,"epss":0.01164,"kevAdded":null},{"id":"CVE-2026-94075","published":"2026-10-24T08:00:11.463Z","updated":"2026-10-24T14:46:59.162Z","title":"WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-112869","published":"2026-10-24T08:00:10.988Z","updated":"2026-10-24T14:46:57.432Z","title":"WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noah Hearle","product":"We’re Open!","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-111402","published":"2026-10-24T08:00:10.963Z","updated":"2026-10-24T14:46:59.295Z","title":"WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-112844","published":"2026-10-24T08:00:10.546Z","updated":"2026-10-24T14:46:57.569Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-114179","published":"2026-10-24T08:00:10.535Z","updated":"2026-10-24T14:46:57.707Z","title":"WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-112848","published":"2026-10-23T13:00:20.030Z","updated":"2026-10-24T14:46:59.432Z","title":"WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112849","published":"2026-10-23T13:00:19.660Z","updated":"2026-10-23T14:58:45.182Z","title":"WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112850","published":"2026-10-23T13:00:19.609Z","updated":"2026-10-24T14:46:59.580Z","title":"WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Your Dress","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-112854","published":"2026-10-23T13:00:19.251Z","updated":"2026-10-24T14:46:59.714Z","title":"WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Holistic Center","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112847","published":"2026-10-23T13:00:19.203Z","updated":"2026-10-24T14:46:59.854Z","title":"WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ZenSoul","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112846","published":"2026-10-23T13:00:18.841Z","updated":"2026-10-24T14:47:00.039Z","title":"WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Save Life","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112851","published":"2026-10-23T13:00:18.778Z","updated":"2026-10-24T14:47:00.303Z","title":"WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"HotLock","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112852","published":"2026-10-23T13:00:18.393Z","updated":"2026-10-24T14:47:00.462Z","title":"WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX Group","product":"Helion","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-112853","published":"2026-10-23T13:00:18.338Z","updated":"2026-10-23T14:59:06.317Z","title":"WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Hallelujah","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-112856","published":"2026-10-23T13:00:17.961Z","updated":"2026-10-24T14:47:00.597Z","title":"WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Vagabonds","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112857","published":"2026-10-23T13:00:17.920Z","updated":"2026-10-23T14:59:12.653Z","title":"WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Reprizo","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-112858","published":"2026-10-23T13:00:17.505Z","updated":"2026-10-24T14:47:00.738Z","title":"WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Rhodos","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112859","published":"2026-10-23T13:00:17.469Z","updated":"2026-10-24T14:47:00.875Z","title":"WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Little Birdies","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112855","published":"2026-10-23T13:00:16.938Z","updated":"2026-10-24T14:47:01.013Z","title":"WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Redy","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-112863","published":"2026-10-23T13:00:16.927Z","updated":"2026-10-24T14:46:57.865Z","title":"WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hogash","product":"KALLYAS","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-112860","published":"2026-10-23T08:00:11.265Z","updated":"2026-10-23T10:56:06.122Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-112862","published":"2026-10-23T08:00:11.165Z","updated":"2026-10-23T10:56:06.266Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-112835","published":"2026-10-23T08:00:10.892Z","updated":"2026-10-23T10:56:06.431Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112837","published":"2026-10-23T08:00:10.809Z","updated":"2026-10-23T10:56:06.582Z","title":"WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-112359","published":"2026-10-23T08:00:10.686Z","updated":"2026-10-23T10:56:06.737Z","title":"WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Amauri.IO","product":"WPMobile.App","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-112838","published":"2026-10-23T08:00:10.440Z","updated":"2026-10-23T10:56:06.894Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112821","published":"2026-10-23T08:00:10.353Z","updated":"2026-10-23T10:56:07.050Z","title":"WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Knit Pay","product":"Knit Pay","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-112825","published":"2026-10-23T08:00:10.214Z","updated":"2026-10-23T10:56:07.212Z","title":"WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Car Rental Manager","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-112832","published":"2026-10-22T11:00:11.107Z","updated":"2026-10-22T13:37:46.390Z","title":"WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2026-112842","published":"2026-10-22T11:00:10.742Z","updated":"2026-10-22T13:37:46.527Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-112822","published":"2026-10-22T11:00:10.699Z","updated":"2026-10-22T13:37:46.663Z","title":"WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-112313","published":"2026-10-22T10:00:12.776Z","updated":"2026-11-03T15:22:36.298Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112820","published":"2026-10-22T10:00:12.735Z","updated":"2026-10-22T10:56:12.421Z","title":"WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Academist Core","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-114703","published":"2026-10-22T08:59:26.154Z","updated":"2026-10-22T10:56:12.576Z","title":"WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hupe13","product":"Extensions for Leaflet Map","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114702","published":"2026-10-22T08:58:42.642Z","updated":"2026-10-22T10:56:12.729Z","title":"WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"ND Shortcodes For Visual Composer","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114701","published":"2026-10-22T08:55:52.176Z","updated":"2026-10-22T10:56:12.880Z","title":"WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xootix","product":"Waitlist Woocommerce ( Back in stock notifier )","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114700","published":"2026-10-22T08:54:35.279Z","updated":"2026-10-22T10:56:13.056Z","title":"WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gloriafood","product":"Restaurant Menu – Food Ordering System – Table Reservation","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114699","published":"2026-10-22T08:53:03.761Z","updated":"2026-10-22T10:56:13.209Z","title":"WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"yoomoney","product":"ЮKassa для WooCommerce","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-114195","published":"2026-10-22T08:48:20.446Z","updated":"2026-10-22T10:56:13.370Z","title":"WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"ShopMagic","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-112218","published":"2026-10-22T08:47:02.409Z","updated":"2026-10-22T10:56:13.526Z","title":"WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-114696","published":"2026-10-22T08:46:29.875Z","updated":"2026-10-29T18:51:12.133Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-111842","published":"2026-10-22T08:46:02.025Z","updated":"2026-10-22T10:56:13.877Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-112311","published":"2026-10-22T08:00:50.094Z","updated":"2026-10-22T10:56:14.032Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-111851","published":"2026-10-22T08:00:50.041Z","updated":"2026-10-22T10:56:14.204Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.6,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-112312","published":"2026-10-22T08:00:50.028Z","updated":"2026-10-30T14:37:49.722Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-111830","published":"2026-10-22T08:00:49.652Z","updated":"2026-10-22T10:56:14.523Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-112241","published":"2026-10-22T08:00:49.628Z","updated":"2026-10-22T10:56:14.683Z","title":"WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-112242","published":"2026-10-22T08:00:49.604Z","updated":"2026-10-25T22:47:02.391Z","title":"WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-112845","published":"2026-10-22T07:33:45.372Z","updated":"2026-10-22T10:56:14.997Z","title":"WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jory Hogeveen","product":"Off-Canvas Sidebars & Menus (Slidebars)","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-110893","published":"2026-10-22T07:33:26.080Z","updated":"2026-10-22T10:56:15.240Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-110894","published":"2026-10-22T07:32:51.134Z","updated":"2026-10-22T10:56:15.454Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-114698","published":"2026-10-22T07:31:39.662Z","updated":"2026-10-22T10:56:15.614Z","title":"WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-112327","published":"2026-10-22T07:01:09.933Z","updated":"2026-10-22T10:56:15.759Z","title":"WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-112379","published":"2026-10-22T07:01:09.851Z","updated":"2026-10-22T10:56:15.899Z","title":"WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Codepeople","product":"Contact Form Email","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-114182","published":"2026-10-22T06:53:38.179Z","updated":"2026-10-22T10:56:16.049Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-112843","published":"2026-10-22T06:53:13.511Z","updated":"2026-10-22T10:56:16.221Z","title":"WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-112826","published":"2026-10-22T06:52:48.653Z","updated":"2026-10-22T10:56:16.397Z","title":"WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eLightUp","product":"Falcon – WordPress Optimizations & Tweaks","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-114180","published":"2026-10-22T06:51:28.157Z","updated":"2026-10-22T10:56:16.552Z","title":"WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-111847","published":"2026-10-22T06:50:48.346Z","updated":"2026-10-22T10:56:16.712Z","title":"WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Kings Plugins","product":"MarketKing","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-114177","published":"2026-10-22T06:50:11.735Z","updated":"2026-10-22T10:56:16.853Z","title":"WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-114175","published":"2026-10-22T06:48:49.336Z","updated":"2026-10-22T10:56:16.997Z","title":"WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-112867","published":"2026-10-22T06:46:23.617Z","updated":"2026-10-22T10:56:17.135Z","title":"WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"H5P","product":"H5P","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-114184","published":"2026-10-22T06:45:47.353Z","updated":"2026-10-22T10:56:17.294Z","title":"WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-111401","published":"2026-10-21T18:02:35.731Z","updated":"2026-10-22T10:56:17.445Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-112868","published":"2026-10-21T18:01:00.900Z","updated":"2026-10-22T10:56:17.592Z","title":"WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"H5P","product":"H5P","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-114176","published":"2026-10-21T18:00:12.725Z","updated":"2026-10-22T10:56:17.723Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-111832","published":"2026-10-21T14:00:13.392Z","updated":"2026-10-21T17:19:12.429Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-111834","published":"2026-10-21T14:00:13.142Z","updated":"2026-10-21T17:19:12.599Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-111835","published":"2026-10-21T14:00:13.041Z","updated":"2026-10-21T15:47:50.932Z","title":"WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bjorntech","product":"BjornTech Swish for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-111848","published":"2026-10-21T14:00:12.950Z","updated":"2026-10-21T15:47:58.712Z","title":"WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-112221","published":"2026-10-21T14:00:12.692Z","updated":"2026-10-21T17:19:12.758Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-111833","published":"2026-10-21T14:00:12.587Z","updated":"2026-10-21T17:19:12.931Z","title":"WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Bold Grid","product":"weForms","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-111837","published":"2026-10-21T14:00:12.511Z","updated":"2026-10-21T17:19:13.111Z","title":"WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-111838","published":"2026-10-21T14:00:12.248Z","updated":"2026-10-21T17:19:13.275Z","title":"WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"ThemeHunk Customizer","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-111840","published":"2026-10-21T14:00:12.136Z","updated":"2026-10-21T17:19:13.467Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-111852","published":"2026-10-21T14:00:12.051Z","updated":"2026-10-21T17:19:13.637Z","title":"WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-111849","published":"2026-10-21T13:00:12.562Z","updated":"2026-10-21T13:13:28.148Z","title":"WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-110369","published":"2026-10-21T09:10:25.410Z","updated":"2026-10-21T10:35:06.745Z","title":"WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"WordPress Team Members – GS Plugins","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-110370","published":"2026-10-21T09:10:25.368Z","updated":"2026-10-21T10:35:06.886Z","title":"WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Pins for Pinterest","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-110884","published":"2026-10-21T09:10:25.275Z","updated":"2026-10-21T10:35:07.177Z","title":"WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"geekontheroad","product":"Live Summary for Gravity Forms","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-110899","published":"2026-10-21T08:00:20.542Z","updated":"2026-10-30T20:01:11.038Z","title":"WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-107435","published":"2026-10-21T08:00:15.941Z","updated":"2026-10-21T10:35:07.464Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-112861","published":"2026-10-20T17:47:26.055Z","updated":"2026-10-21T10:35:07.995Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-112823","published":"2026-10-20T15:14:13.192Z","updated":"2026-10-21T10:35:08.137Z","title":"WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-112824","published":"2026-10-20T15:13:47.804Z","updated":"2026-10-20T16:16:17.587Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-111843","published":"2026-10-20T15:12:05.376Z","updated":"2026-10-21T10:35:08.438Z","title":"WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-112829","published":"2026-10-20T15:11:43.228Z","updated":"2026-10-21T10:35:08.582Z","title":"WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-112840","published":"2026-10-20T15:10:54.998Z","updated":"2026-10-21T10:35:08.866Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-112836","published":"2026-10-20T15:10:13.770Z","updated":"2026-10-20T16:44:17.508Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-109700","published":"2026-10-20T15:06:51.007Z","updated":"2026-10-20T17:21:58.344Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-112834","published":"2026-10-20T14:53:47.737Z","updated":"2026-10-21T10:28:09.573Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-112833","published":"2026-10-20T14:53:14.184Z","updated":"2026-10-20T15:14:09.857Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-111844","published":"2026-10-20T09:47:10.054Z","updated":"2026-10-20T16:07:12.280Z","title":"WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brizy","product":"Brizy","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-111828","published":"2026-10-19T13:29:02.276Z","updated":"2026-10-19T18:13:06.617Z","title":"WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-112222","published":"2026-10-19T13:28:19.208Z","updated":"2026-10-19T14:59:04.484Z","title":"WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Surfer","product":"Surfer","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-111829","published":"2026-10-19T13:27:57.467Z","updated":"2026-10-19T18:14:19.288Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-110902","published":"2026-10-19T13:27:05.415Z","updated":"2026-10-19T14:26:14.786Z","title":"WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-111845","published":"2026-10-19T12:38:16.661Z","updated":"2026-10-19T16:45:42.720Z","title":"WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Bundles","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-111831","published":"2026-10-19T12:24:22.785Z","updated":"2026-10-19T14:28:05.700Z","title":"WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-110363","published":"2026-10-19T12:21:58.494Z","updated":"2026-10-19T18:15:27.691Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-111836","published":"2026-10-19T12:21:27.605Z","updated":"2026-10-19T18:19:12.683Z","title":"WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentCommunity","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-111414","published":"2026-10-19T12:20:08.655Z","updated":"2026-10-19T18:23:08.474Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-111410","published":"2026-10-19T12:16:12.230Z","updated":"2026-10-19T14:28:31.696Z","title":"WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"E2Pdf.com","product":"e2pdf","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-111839","published":"2026-10-19T12:13:50.340Z","updated":"2026-10-19T18:25:34.806Z","title":"WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-112199","published":"2026-10-19T12:06:43.446Z","updated":"2026-10-19T18:26:29.775Z","title":"WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-110887","published":"2026-10-19T09:09:19.849Z","updated":"2026-10-19T16:51:04.682Z","title":"WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-111398","published":"2026-10-19T09:09:19.440Z","updated":"2026-10-19T17:17:11.133Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-110898","published":"2026-10-19T09:09:19.416Z","updated":"2026-10-19T16:50:35.254Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.4,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-111407","published":"2026-10-19T09:09:19.001Z","updated":"2026-10-19T12:49:03.673Z","title":"WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-111408","published":"2026-10-19T09:09:18.970Z","updated":"2026-10-19T17:17:55.950Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-110379","published":"2026-10-19T09:09:18.538Z","updated":"2026-10-19T12:49:30.765Z","title":"WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-111406","published":"2026-10-19T09:09:18.419Z","updated":"2026-10-19T16:54:29.679Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-110895","published":"2026-10-18T11:00:30.914Z","updated":"2026-10-18T11:42:55.685Z","title":"WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"DevItems","product":"Support Genix","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-107436","published":"2026-10-18T11:00:30.528Z","updated":"2026-10-19T18:44:42.166Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-110373","published":"2026-10-18T11:00:30.495Z","updated":"2026-10-19T18:56:33.875Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-110880","published":"2026-10-18T11:00:30.027Z","updated":"2026-10-19T18:57:25.484Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-110886","published":"2026-10-18T11:00:30.021Z","updated":"2026-10-19T15:53:23.555Z","title":"WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-109895","published":"2026-10-18T11:00:29.573Z","updated":"2026-10-18T11:42:55.835Z","title":"WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-109894","published":"2026-10-18T11:00:29.562Z","updated":"2026-10-19T15:51:39.092Z","title":"WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-110883","published":"2026-10-18T11:00:29.126Z","updated":"2026-10-19T19:00:19.026Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-110383","published":"2026-10-18T11:00:29.114Z","updated":"2026-10-18T11:42:55.982Z","title":"WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"WP E-Signature","product":"Electronic Signature Add-on for Fluent Forms","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-110897","published":"2026-10-18T11:00:28.706Z","updated":"2026-10-19T15:48:00.679Z","title":"WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IdeaBox Creations","product":"PowerPack Lite for Beaver Builder","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-110372","published":"2026-10-18T11:00:28.694Z","updated":"2026-10-19T19:01:11.342Z","title":"WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.01365,"kevAdded":null},{"id":"CVE-2026-110382","published":"2026-10-18T11:00:28.191Z","updated":"2026-10-19T15:45:31.217Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-108485","published":"2026-10-18T11:00:28.148Z","updated":"2026-10-19T15:42:56.281Z","title":"WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"eStore","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-110885","published":"2026-10-18T11:00:22.694Z","updated":"2026-10-19T19:03:21.300Z","title":"WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-110365","published":"2026-10-18T11:00:22.685Z","updated":"2026-10-19T19:03:53.371Z","title":"WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPExperts","product":"Advanced File Manager","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-110882","published":"2026-10-17T19:00:11.325Z","updated":"2026-10-18T11:22:45.458Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-109701","published":"2026-10-17T17:00:45.175Z","updated":"2026-10-18T11:22:45.594Z","title":"WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PAYCOMET","product":"PAYCOMET for WooCommerce","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-110889","published":"2026-10-17T11:00:12.190Z","updated":"2026-10-18T11:22:45.735Z","title":"WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Gantry","product":"Gantry 5 Framework","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-110384","published":"2026-10-17T07:00:31.036Z","updated":"2026-10-18T11:22:46.019Z","title":"WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Fancy Comments WordPress","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-111413","published":"2026-10-16T13:02:14.161Z","updated":"2026-10-16T13:32:40.971Z","title":"WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"aThemeArt","product":"aThemeArt Theme Helper","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-110896","published":"2026-10-16T12:57:24.956Z","updated":"2026-10-16T14:01:22.556Z","title":"WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-111400","published":"2026-10-16T12:55:17.830Z","updated":"2026-10-16T15:04:12.871Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-111396","published":"2026-10-16T12:54:50.256Z","updated":"2026-10-16T13:44:30.141Z","title":"WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-111409","published":"2026-10-16T12:52:57.180Z","updated":"2026-10-19T08:14:29.318Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-110903","published":"2026-10-16T12:51:28.928Z","updated":"2026-10-16T14:39:00.735Z","title":"WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-110900","published":"2026-10-16T12:51:01.259Z","updated":"2026-10-16T14:59:30.776Z","title":"WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-110901","published":"2026-10-16T12:50:03.734Z","updated":"2026-10-16T14:59:30.929Z","title":"WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPMU DEV","product":"SmartCrawl","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-110380","published":"2026-10-16T12:31:15.231Z","updated":"2026-10-16T14:59:31.070Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-111405","published":"2026-10-16T12:30:54.361Z","updated":"2026-10-16T13:46:12.255Z","title":"WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-111399","published":"2026-10-16T12:30:32.747Z","updated":"2026-10-16T14:59:31.212Z","title":"WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-111397","published":"2026-10-16T12:29:35.561Z","updated":"2026-10-16T14:02:23.262Z","title":"WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-94169","published":"2026-10-16T07:00:38.023Z","updated":"2026-10-16T18:38:00.753Z","title":"WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Theme-one","product":"The Grid","kev":false,"epss":0.04422,"kevAdded":null},{"id":"CVE-2026-94388","published":"2026-10-16T07:00:37.973Z","updated":"2026-10-16T15:09:36.628Z","title":"WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"halfdata","product":"Green Popups","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-97296","published":"2026-10-16T07:00:37.595Z","updated":"2026-10-16T15:09:37.442Z","title":"WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Rocketgenius, Inc","product":"Gravity Forms","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-96339","published":"2026-10-16T07:00:37.525Z","updated":"2026-10-16T10:36:08.361Z","title":"WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Houzez.co","product":"Houzez","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-110366","published":"2026-10-16T06:54:11.866Z","updated":"2026-10-16T15:09:37.698Z","title":"WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-110361","published":"2026-10-15T18:21:40.608Z","updated":"2026-10-15T20:17:18.211Z","title":"WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ClikIT","product":"Infinite Uploads","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-110362","published":"2026-10-15T18:21:16.105Z","updated":"2026-10-16T15:09:41.704Z","title":"WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Planet studio","product":"PlanetStudio Payment Gateway","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-109893","published":"2026-10-15T18:18:56.045Z","updated":"2026-10-16T17:12:08.141Z","title":"WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-110374","published":"2026-10-15T18:18:13.194Z","updated":"2026-10-15T18:32:12.140Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-108499","published":"2026-10-15T18:17:52.974Z","updated":"2026-10-15T20:19:57.344Z","title":"WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Knowledge Base","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-110364","published":"2026-10-15T18:16:51.303Z","updated":"2026-10-15T20:39:16.095Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-110375","published":"2026-10-15T18:16:25.737Z","updated":"2026-10-16T17:12:23.090Z","title":"WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-109689","published":"2026-10-15T18:14:39.051Z","updated":"2026-10-15T18:33:26.965Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-110360","published":"2026-10-15T18:12:23.561Z","updated":"2026-10-16T15:09:42.011Z","title":"WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-109897","published":"2026-10-15T18:11:34.153Z","updated":"2026-10-15T19:59:26.898Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-110378","published":"2026-10-15T18:07:26.117Z","updated":"2026-10-19T09:50:41.518Z","title":"WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP E-Signature","product":"Ninja Forms Signature Contract Add-On","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-96449","published":"2026-10-15T18:06:37.312Z","updated":"2026-10-16T15:09:42.195Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"WP EasyPay","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-106604","published":"2026-10-15T18:01:28.361Z","updated":"2026-10-16T14:39:06.911Z","title":"WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Compare","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-103083","published":"2026-10-15T18:00:35.463Z","updated":"2026-10-15T19:59:10.889Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-108175","published":"2026-10-15T17:48:26.005Z","updated":"2026-10-15T18:01:15.407Z","title":"WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-110381","published":"2026-10-15T17:48:07.069Z","updated":"2026-10-16T17:12:29.676Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-103350","published":"2026-10-15T17:47:33.578Z","updated":"2026-10-15T18:24:28.555Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-110888","published":"2026-10-15T17:46:50.254Z","updated":"2026-10-16T17:12:38.772Z","title":"WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-110891","published":"2026-10-15T17:46:27.380Z","updated":"2026-10-16T15:09:42.376Z","title":"WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WordLift Srl","product":"WordLift","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-110890","published":"2026-10-15T17:45:58.863Z","updated":"2026-10-15T18:24:23.069Z","title":"WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-110367","published":"2026-10-15T17:45:13.071Z","updated":"2026-10-15T18:24:51.313Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-110371","published":"2026-10-15T17:43:50.465Z","updated":"2026-10-15T17:59:43.855Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-105065","published":"2026-10-15T17:00:15.222Z","updated":"2026-10-16T14:39:07.063Z","title":"WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme.com","product":"XStore","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-109686","published":"2026-10-15T13:00:24.207Z","updated":"2026-10-15T15:16:30.523Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-109685","published":"2026-10-15T13:00:23.963Z","updated":"2026-10-16T14:39:07.227Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-109892","published":"2026-10-15T13:00:23.774Z","updated":"2026-10-15T13:18:44.529Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-102389","published":"2026-10-15T13:00:23.730Z","updated":"2026-10-15T16:41:33.903Z","title":"WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Broken Link Checker","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-105882","published":"2026-10-15T13:00:23.484Z","updated":"2026-10-15T15:03:59.807Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-109688","published":"2026-10-15T13:00:23.246Z","updated":"2026-10-15T14:36:49.884Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-107416","published":"2026-10-15T13:00:23.199Z","updated":"2026-10-15T13:19:10.932Z","title":"WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-109702","published":"2026-10-15T13:00:23.016Z","updated":"2026-10-15T15:04:14.692Z","title":"WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maxfoundry","product":"Social Share Buttons","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-109698","published":"2026-10-15T12:09:05.215Z","updated":"2026-10-15T13:09:25.240Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-109692","published":"2026-10-15T12:09:05.084Z","updated":"2026-10-15T13:14:03.798Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-109693","published":"2026-10-15T12:09:04.952Z","updated":"2026-10-16T15:09:42.546Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-109695","published":"2026-10-15T11:00:13.931Z","updated":"2026-10-15T15:04:25.338Z","title":"WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPManageNinja","product":"FluentCart","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-109694","published":"2026-10-15T11:00:13.754Z","updated":"2026-10-15T14:37:51.972Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-108491","published":"2026-10-15T11:00:13.399Z","updated":"2026-10-15T13:15:53.077Z","title":"WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-108497","published":"2026-10-15T11:00:13.368Z","updated":"2026-10-16T15:09:42.704Z","title":"WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-108498","published":"2026-10-15T11:00:13.206Z","updated":"2026-10-15T13:14:06.252Z","title":"WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bannersky","product":"BSK PDF Manager","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-108480","published":"2026-10-14T18:09:35.829Z","updated":"2026-10-15T16:43:45.485Z","title":"WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Skydropx","product":"Skydropx","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-108484","published":"2026-10-14T18:09:35.659Z","updated":"2026-10-15T16:43:45.622Z","title":"WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Best Payments Plugin for WP","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-108483","published":"2026-10-14T18:09:35.358Z","updated":"2026-10-16T18:42:02.176Z","title":"WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hippooo","product":"Hippoo Mobile App for WooCommerce","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-105066","published":"2026-10-14T18:09:35.203Z","updated":"2026-10-14T19:36:41.666Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SimplyRETS","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-108151","published":"2026-10-14T18:09:34.882Z","updated":"2026-10-15T16:43:45.890Z","title":"WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-103081","published":"2026-10-14T18:09:34.742Z","updated":"2026-10-15T16:43:46.026Z","title":"WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-107870","published":"2026-10-14T14:00:14.386Z","updated":"2026-10-15T16:43:47.159Z","title":"WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-107417","published":"2026-10-14T13:00:15.564Z","updated":"2026-10-15T16:43:47.561Z","title":"WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Muralidharan Ramasamy","product":"Push Notification for Post and BuddyPress","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-107426","published":"2026-10-14T13:00:15.455Z","updated":"2026-10-14T17:35:50.918Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-108291","published":"2026-10-14T12:08:28.433Z","updated":"2026-10-15T16:43:47.695Z","title":"WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"itthinx","product":"Affiliates","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-107425","published":"2026-10-14T12:08:28.323Z","updated":"2026-10-15T16:43:47.872Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-107867","published":"2026-10-14T12:08:28.020Z","updated":"2026-10-15T16:43:48.028Z","title":"WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetProductTables","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-107421","published":"2026-10-14T12:08:27.906Z","updated":"2026-10-15T16:43:48.193Z","title":"WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-107424","published":"2026-10-14T12:08:27.612Z","updated":"2026-10-14T14:01:21.121Z","title":"WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"M A Vinoth Kumar","product":"Frontend Dashboard","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-107422","published":"2026-10-14T12:08:27.530Z","updated":"2026-10-15T15:08:38.427Z","title":"WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"axew3.com","product":"WP w3all phpBB","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-105874","published":"2026-10-14T12:08:27.142Z","updated":"2026-10-15T16:43:48.332Z","title":"WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-106599","published":"2026-10-14T12:08:27.048Z","updated":"2026-10-14T17:32:25.261Z","title":"WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-97278","published":"2026-10-14T12:08:26.651Z","updated":"2026-10-14T14:00:58.678Z","title":"WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-107433","published":"2026-10-14T12:08:26.612Z","updated":"2026-10-14T17:29:24.440Z","title":"WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"WP OAuth Server","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-105067","published":"2026-10-14T11:00:11.690Z","updated":"2026-10-15T15:08:44.603Z","title":"WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Webnus","product":"Modern Events Calendar Lite","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-103358","published":"2026-10-14T11:00:11.345Z","updated":"2026-10-15T16:43:48.459Z","title":"WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Email Template Customizer for WooCommerce","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-107431","published":"2026-10-14T11:00:11.329Z","updated":"2026-10-14T14:07:43.610Z","title":"WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-107428","published":"2026-10-14T08:00:25.216Z","updated":"2026-10-14T11:29:08.950Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-110227","published":"2026-10-14T07:11:41.657Z","updated":"2026-10-15T16:43:49.599Z","title":"WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"10up","product":"Restricted Site Access","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-109901","published":"2026-10-14T07:11:16.010Z","updated":"2026-10-14T15:56:23.123Z","title":"WordPress CP Multi View Event Calendar  plugin <= 1.4.41 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Codepeople","product":"CP Multi View Event Calendar","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-109898","published":"2026-10-13T16:23:02.114Z","updated":"2026-10-15T16:43:51.594Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-109896","published":"2026-10-13T16:22:06.720Z","updated":"2026-10-15T16:43:51.727Z","title":"WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Download Monitor integration for WooCommerce","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-109890","published":"2026-10-13T16:21:41.444Z","updated":"2026-10-14T15:25:49.121Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-109699","published":"2026-10-13T08:53:05.371Z","updated":"2026-10-13T12:07:52.426Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-108487","published":"2026-10-13T08:51:33.492Z","updated":"2026-10-13T12:07:52.552Z","title":"WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hossni Mubarak","product":"Books Gallery","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-106598","published":"2026-10-13T08:49:45.050Z","updated":"2026-10-13T12:07:52.660Z","title":"WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-109687","published":"2026-10-13T08:49:07.664Z","updated":"2026-10-13T12:07:52.773Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-105881","published":"2026-10-13T08:45:21.284Z","updated":"2026-10-13T12:07:52.911Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-108179","published":"2026-10-13T08:44:24.127Z","updated":"2026-10-13T12:07:53.047Z","title":"WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PluginUs.Net","product":"WOLF","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-108489","published":"2026-10-13T08:43:51.589Z","updated":"2026-10-13T12:07:53.195Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-103076","published":"2026-10-13T08:43:07.734Z","updated":"2026-10-13T12:07:53.347Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-108174","published":"2026-10-13T08:42:35.004Z","updated":"2026-10-13T12:07:53.461Z","title":"WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-106597","published":"2026-10-13T08:42:04.867Z","updated":"2026-10-13T12:07:53.621Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-109697","published":"2026-10-13T08:41:17.199Z","updated":"2026-10-30T20:04:49.375Z","title":"WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-109691","published":"2026-10-13T08:39:18.284Z","updated":"2026-10-13T12:07:53.947Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-108488","published":"2026-10-13T08:38:44.619Z","updated":"2026-10-13T12:07:54.071Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-109696","published":"2026-10-13T08:36:20.364Z","updated":"2026-10-13T12:07:54.186Z","title":"WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-108490","published":"2026-10-13T08:35:52.144Z","updated":"2026-10-13T12:07:54.303Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-109684","published":"2026-10-13T08:34:34.941Z","updated":"2026-10-13T12:07:54.433Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-108496","published":"2026-10-13T08:33:20.679Z","updated":"2026-10-21T10:21:15.616Z","title":"WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-108493","published":"2026-10-13T08:32:30.517Z","updated":"2026-10-13T12:07:54.689Z","title":"WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Karolína Vyskočilová","product":"Pay for Payment for WooCommerce","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-108495","published":"2026-10-13T08:30:25.869Z","updated":"2026-10-13T12:07:54.820Z","title":"WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-108492","published":"2026-10-13T08:29:26.631Z","updated":"2026-10-19T08:14:59.464Z","title":"WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fullworks Plugins","product":"Quick Paypal Payments","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-109703","published":"2026-10-13T07:32:54.095Z","updated":"2026-10-13T12:07:55.100Z","title":"WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGraphQL","product":"WPGraphQL","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-54867","published":"2026-10-13T05:51:18.751Z","updated":"2026-10-13T12:07:55.225Z","title":"WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Griden","product":"Responsive Slider","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-54868","published":"2026-10-13T05:50:34.068Z","updated":"2026-10-13T12:07:55.346Z","title":"WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Simpler SEO","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-54869","published":"2026-10-13T05:49:47.849Z","updated":"2026-10-13T12:07:55.494Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-54870","published":"2026-10-13T05:48:07.438Z","updated":"2026-10-13T12:07:55.615Z","title":"WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpweaver","product":"Weaver Xtreme Theme Support","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-61994","published":"2026-10-12T17:51:32.988Z","updated":"2026-10-12T22:53:59.531Z","title":"WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RocketGeek","product":"WP-Members","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-42689","published":"2026-10-12T17:47:51.774Z","updated":"2026-10-12T22:53:59.670Z","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-108479","published":"2026-10-12T17:34:29.483Z","updated":"2026-10-12T22:53:59.811Z","title":"WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-108481","published":"2026-10-12T17:33:28.910Z","updated":"2026-10-12T22:53:59.945Z","title":"WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.4,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-103080","published":"2026-10-12T17:32:51.719Z","updated":"2026-10-12T22:54:00.096Z","title":"WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-108482","published":"2026-10-12T17:14:08.317Z","updated":"2026-10-12T22:54:00.236Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-107862","published":"2026-10-12T17:13:40.320Z","updated":"2026-10-12T22:54:00.380Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-108486","published":"2026-10-12T17:13:17.372Z","updated":"2026-10-12T22:54:00.527Z","title":"WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-107418","published":"2026-10-12T17:12:33.445Z","updated":"2026-10-12T22:54:00.660Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-108478","published":"2026-10-12T17:11:55.879Z","updated":"2026-10-12T22:54:00.791Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-108475","published":"2026-10-12T17:09:53.457Z","updated":"2026-10-12T22:54:00.913Z","title":"WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-108476","published":"2026-10-12T17:09:22.796Z","updated":"2026-10-12T22:54:01.038Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-108477","published":"2026-10-12T16:32:19.815Z","updated":"2026-10-12T22:54:01.160Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-107864","published":"2026-10-12T09:05:53.751Z","updated":"2026-10-12T11:40:33.566Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-107865","published":"2026-10-12T09:03:11.930Z","updated":"2026-10-12T11:40:33.699Z","title":"WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetMenu","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-107866","published":"2026-10-12T09:00:06.057Z","updated":"2026-10-12T11:40:33.826Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-107423","published":"2026-10-12T08:26:10.250Z","updated":"2026-10-12T11:40:33.963Z","title":"WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-107869","published":"2026-10-12T08:25:47.632Z","updated":"2026-10-12T11:40:34.088Z","title":"WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Flexible Subscriptions","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-107863","published":"2026-10-12T08:24:45.942Z","updated":"2026-10-19T07:34:27.782Z","title":"WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Codection","product":"Products Restricted Users for WooCommerce","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-108168","published":"2026-10-12T08:22:50.917Z","updated":"2026-10-12T11:40:34.371Z","title":"WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DLX Plugins","product":"Custom Query Blocks","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2023-25996","published":"2026-10-12T08:15:39.939Z","updated":"2026-10-12T11:40:34.485Z","title":"WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pluggabl LLC.","product":"Booster Elite for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-107432","published":"2026-10-12T07:47:11.169Z","updated":"2026-10-12T11:40:34.601Z","title":"WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-103356","published":"2026-10-12T07:45:51.286Z","updated":"2026-10-12T11:40:34.720Z","title":"WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VillaTheme","product":"TMDS","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-107430","published":"2026-10-12T07:45:32.370Z","updated":"2026-10-12T11:40:34.840Z","title":"WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VideoWhisper.com","product":"VideoWhisper Site Manager for ChatGPT, Claude, Codex","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-107429","published":"2026-10-12T07:44:56.102Z","updated":"2026-10-12T11:40:34.968Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-107427","published":"2026-10-12T07:44:34.562Z","updated":"2026-10-12T11:40:35.088Z","title":"WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-106605","published":"2026-10-12T07:44:09.895Z","updated":"2026-10-12T11:40:35.215Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-103685","published":"2026-10-10T19:55:52.636Z","updated":"2026-10-11T12:13:33.093Z","title":"WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-27350","published":"2026-10-10T19:44:36.929Z","updated":"2026-10-11T11:42:57.301Z","title":"WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Builderius.io","product":"Builderius","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-66480","published":"2026-10-10T19:42:40.322Z","updated":"2026-10-11T11:40:27.998Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-57742","published":"2026-10-10T19:40:34.607Z","updated":"2026-10-11T11:42:54.152Z","title":"WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX Group","product":"Kids Planet","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-107434","published":"2026-10-10T19:36:24.555Z","updated":"2026-10-11T12:13:33.222Z","title":"WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.4,"vendor":"videowhisper","product":"MicroPayments","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-107420","published":"2026-10-10T19:36:23.815Z","updated":"2026-10-11T12:13:33.358Z","title":"WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Narinder Singh","product":"Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-81797","published":"2026-10-10T19:36:20.181Z","updated":"2026-10-11T11:47:06.948Z","title":"WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-78535","published":"2026-10-10T19:36:19.431Z","updated":"2026-10-11T11:53:08.903Z","title":"WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Photolia","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-78534","published":"2026-10-10T19:36:18.684Z","updated":"2026-10-11T11:42:57.594Z","title":"WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Keen IT Solutions","product":"Educavo","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-78533","published":"2026-10-10T19:36:17.936Z","updated":"2026-10-11T11:53:09.041Z","title":"WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Qwery","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-78532","published":"2026-10-10T19:36:17.241Z","updated":"2026-10-11T11:42:57.727Z","title":"WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"LMS","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-78531","published":"2026-10-10T19:36:16.484Z","updated":"2026-10-11T11:53:09.192Z","title":"WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Jacqueline","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-78530","published":"2026-10-10T19:36:15.786Z","updated":"2026-10-11T12:13:33.478Z","title":"WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Chimpstudio","product":"FoodBakery","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-78529","published":"2026-10-10T19:36:15.048Z","updated":"2026-10-11T11:53:09.311Z","title":"WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Alliance","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66569","published":"2026-10-10T19:36:14.295Z","updated":"2026-10-11T11:53:09.437Z","title":"WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Kicker","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66568","published":"2026-10-10T19:36:13.592Z","updated":"2026-10-11T11:53:09.567Z","title":"WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Original","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-66567","published":"2026-10-10T19:36:12.850Z","updated":"2026-10-11T11:53:09.687Z","title":"WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Anesta","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-66566","published":"2026-10-10T19:36:12.066Z","updated":"2026-10-11T11:53:06.480Z","title":"WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Ambient","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-66565","published":"2026-10-10T19:36:11.322Z","updated":"2026-10-11T11:53:09.804Z","title":"WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"FC United","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66564","published":"2026-10-10T19:36:10.604Z","updated":"2026-10-11T11:53:09.938Z","title":"WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ShiftCV","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66563","published":"2026-10-10T19:36:09.853Z","updated":"2026-10-11T11:53:10.057Z","title":"WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Windsor","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66483","published":"2026-10-10T19:36:09.122Z","updated":"2026-10-11T11:53:10.197Z","title":"WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66482","published":"2026-10-10T19:36:08.416Z","updated":"2026-10-11T11:53:10.333Z","title":"WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Drone Media","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-66481","published":"2026-10-10T19:36:07.665Z","updated":"2026-10-11T12:13:33.600Z","title":"WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Presto Player","product":"Presto Player Pro","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-65459","published":"2026-10-10T19:36:06.909Z","updated":"2026-10-11T12:13:33.722Z","title":"WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-62130","published":"2026-10-10T19:36:06.188Z","updated":"2026-10-11T12:13:33.844Z","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Amir Helzer","product":"WooCommerce Multilingual & Multicurrency","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-62129","published":"2026-10-10T19:36:05.441Z","updated":"2026-10-11T12:13:33.961Z","title":"WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-62125","published":"2026-10-10T19:36:04.679Z","updated":"2026-10-11T11:53:10.453Z","title":"WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Asia Garden","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-62124","published":"2026-10-10T19:36:03.928Z","updated":"2026-10-11T11:53:10.566Z","title":"WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"N7 | Golf Club Sports & Events","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-62123","published":"2026-10-10T19:36:03.180Z","updated":"2026-10-11T11:53:10.683Z","title":"WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Invetex","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-62120","published":"2026-10-10T19:36:02.422Z","updated":"2026-10-11T11:53:10.812Z","title":"WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Law Office","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-62118","published":"2026-10-10T19:36:01.668Z","updated":"2026-10-11T12:13:34.084Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-62117","published":"2026-10-10T19:36:00.956Z","updated":"2026-10-11T12:03:19.855Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-62116","published":"2026-10-10T19:35:59.761Z","updated":"2026-10-11T11:42:57.844Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62115","published":"2026-10-10T19:35:58.997Z","updated":"2026-10-11T11:53:06.600Z","title":"WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-62100","published":"2026-10-10T19:35:58.260Z","updated":"2026-10-11T11:42:57.978Z","title":"WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62099","published":"2026-10-10T19:35:57.377Z","updated":"2026-10-11T11:53:06.723Z","title":"WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-62098","published":"2026-10-10T19:35:56.621Z","updated":"2026-10-11T12:13:34.271Z","title":"WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-62096","published":"2026-10-10T19:35:55.878Z","updated":"2026-10-11T11:53:06.836Z","title":"WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-62095","published":"2026-10-10T19:35:55.124Z","updated":"2026-10-11T11:42:58.099Z","title":"WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62094","published":"2026-10-10T19:35:54.377Z","updated":"2026-10-11T11:53:06.957Z","title":"WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-62093","published":"2026-10-10T19:35:53.628Z","updated":"2026-10-11T11:42:58.242Z","title":"WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-62092","published":"2026-10-10T19:35:52.885Z","updated":"2026-10-11T11:53:07.072Z","title":"WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-62091","published":"2026-10-10T19:35:52.151Z","updated":"2026-10-11T11:42:58.368Z","title":"WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62090","published":"2026-10-10T19:35:51.406Z","updated":"2026-10-11T11:53:10.946Z","title":"WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"WineShop","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62087","published":"2026-10-10T19:35:50.660Z","updated":"2026-10-11T11:53:11.062Z","title":"WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Equadio","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62086","published":"2026-10-10T19:35:49.927Z","updated":"2026-10-11T11:53:11.187Z","title":"WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Juno","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62082","published":"2026-10-10T19:35:49.222Z","updated":"2026-10-11T11:42:58.500Z","title":"WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"An-Themes","product":"Pin WP","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-62077","published":"2026-10-10T19:35:48.485Z","updated":"2026-10-11T11:53:11.303Z","title":"WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Avala","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62076","published":"2026-10-10T19:35:47.777Z","updated":"2026-10-11T11:53:11.425Z","title":"WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"The4","product":"Kalles","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62075","published":"2026-10-10T19:35:47.010Z","updated":"2026-10-11T11:53:07.199Z","title":"WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mymoun","product":"Backhoe","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62074","published":"2026-10-10T19:35:46.304Z","updated":"2026-10-11T11:53:07.312Z","title":"WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Ozeum","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62070","published":"2026-10-10T19:35:45.567Z","updated":"2026-10-11T11:53:07.428Z","title":"WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CKThemes","product":"Flipmart","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62069","published":"2026-10-10T19:35:44.815Z","updated":"2026-10-11T11:53:07.538Z","title":"WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Fabius","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62068","published":"2026-10-10T19:35:44.070Z","updated":"2026-10-11T11:53:07.654Z","title":"WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Teoro","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62067","published":"2026-10-10T19:35:43.329Z","updated":"2026-10-11T11:53:07.770Z","title":"WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Kaven","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62066","published":"2026-10-10T19:35:42.575Z","updated":"2026-10-11T11:53:07.887Z","title":"WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Volos","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62065","published":"2026-10-10T19:35:41.822Z","updated":"2026-10-11T11:53:08.012Z","title":"WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Cardea","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-62064","published":"2026-10-10T19:35:41.077Z","updated":"2026-10-11T11:42:58.736Z","title":"WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ambed","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62054","published":"2026-10-10T19:35:40.282Z","updated":"2026-10-11T11:53:11.542Z","title":"WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Yacht Rental","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62053","published":"2026-10-10T19:35:39.525Z","updated":"2026-10-11T11:53:11.661Z","title":"WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Wine House","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62052","published":"2026-10-10T19:35:38.667Z","updated":"2026-10-11T11:53:11.771Z","title":"WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Tipsy","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62051","published":"2026-10-10T19:35:37.951Z","updated":"2026-10-11T11:53:11.895Z","title":"WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Stargaze","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62050","published":"2026-10-10T19:35:37.198Z","updated":"2026-10-11T11:53:12.013Z","title":"WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Splendour","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-62043","published":"2026-10-10T19:35:36.442Z","updated":"2026-10-11T12:03:21.565Z","title":"WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"sevenspark","product":"Contact Form 7 – Dynamic Text Extension","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-62038","published":"2026-10-10T19:35:35.694Z","updated":"2026-10-11T12:13:34.392Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-62037","published":"2026-10-10T19:35:34.938Z","updated":"2026-10-11T11:42:58.866Z","title":"WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Document Embedder","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62035","published":"2026-10-10T19:35:34.192Z","updated":"2026-10-11T12:13:34.513Z","title":"WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"upcasted","product":"AWS S3 for WordPress Plugin – Upcasted","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-62034","published":"2026-10-10T19:35:33.484Z","updated":"2026-10-11T11:42:59.001Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62033","published":"2026-10-10T19:35:32.726Z","updated":"2026-10-11T12:13:34.635Z","title":"WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-62032","published":"2026-10-10T19:35:31.972Z","updated":"2026-10-11T11:42:57.116Z","title":"WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-62031","published":"2026-10-10T19:35:31.204Z","updated":"2026-10-11T12:03:19.985Z","title":"WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-62030","published":"2026-10-10T19:35:30.447Z","updated":"2026-10-11T11:42:57.453Z","title":"WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-62027","published":"2026-10-10T19:35:29.582Z","updated":"2026-10-11T11:42:59.155Z","title":"WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Team Section Block","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62025","published":"2026-10-10T19:35:28.815Z","updated":"2026-10-11T12:13:34.756Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-62024","published":"2026-10-10T19:35:28.051Z","updated":"2026-10-11T12:13:34.867Z","title":"WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"CodeBard","product":"CodeBard Help Desk","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-62022","published":"2026-10-10T19:35:27.261Z","updated":"2026-10-11T12:13:34.985Z","title":"WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Select-Themes","product":"Tonda Membership","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-62021","published":"2026-10-10T19:35:26.468Z","updated":"2026-10-11T12:13:35.107Z","title":"WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Angio","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-62020","published":"2026-10-10T19:35:25.680Z","updated":"2026-10-11T11:53:08.144Z","title":"WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TouchUp","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-48194","published":"2026-10-10T19:35:24.166Z","updated":"2026-10-11T11:53:08.274Z","title":"WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"DukaMarket","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-48193","published":"2026-10-10T19:35:23.448Z","updated":"2026-10-11T11:53:08.402Z","title":"WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Uminex","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-45440","published":"2026-10-10T19:35:22.690Z","updated":"2026-10-11T12:03:20.105Z","title":"WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Smackcoders Inc.","product":"WP Ultimate CSV Importer","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-42777","published":"2026-10-10T19:35:21.931Z","updated":"2026-10-11T11:53:08.533Z","title":"WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Aalto","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-42724","published":"2026-10-10T19:35:21.169Z","updated":"2026-10-11T11:53:08.651Z","title":"WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-42723","published":"2026-10-10T19:35:20.422Z","updated":"2026-10-11T11:53:12.158Z","title":"WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-42722","published":"2026-10-10T19:35:19.708Z","updated":"2026-10-11T12:03:20.221Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-42719","published":"2026-10-10T19:35:18.996Z","updated":"2026-10-11T12:13:35.224Z","title":"WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-42718","published":"2026-10-10T19:35:18.277Z","updated":"2026-10-11T11:53:12.284Z","title":"WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-42717","published":"2026-10-10T19:35:17.515Z","updated":"2026-10-11T12:03:20.341Z","title":"WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-42716","published":"2026-10-10T19:35:16.768Z","updated":"2026-10-11T11:53:12.414Z","title":"WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"payever","product":"Payever - WooCommerce Gateway","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-42715","published":"2026-10-10T19:35:16.054Z","updated":"2026-10-11T11:42:59.293Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42712","published":"2026-10-10T19:35:15.340Z","updated":"2026-10-11T12:03:20.465Z","title":"WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"QODE","product":"Qode Tours","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-42711","published":"2026-10-10T19:35:14.606Z","updated":"2026-10-11T11:42:59.426Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42709","published":"2026-10-10T19:35:13.809Z","updated":"2026-10-11T11:42:59.539Z","title":"WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Food Menu – Restaurant Menu & Online Ordering for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42706","published":"2026-10-10T19:35:13.010Z","updated":"2026-10-11T12:13:35.348Z","title":"WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"DK","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-42705","published":"2026-10-10T19:35:12.244Z","updated":"2026-10-11T12:13:35.480Z","title":"WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"Grand News","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-42704","published":"2026-10-10T19:35:11.485Z","updated":"2026-10-11T11:53:08.769Z","title":"WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Kids Care","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-42702","published":"2026-10-10T19:35:10.741Z","updated":"2026-10-13T16:32:55.073Z","title":"WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42699","published":"2026-10-10T19:35:10.023Z","updated":"2026-10-11T11:42:59.770Z","title":"WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"FV Player 8","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42697","published":"2026-10-10T19:35:09.276Z","updated":"2026-10-13T06:13:04.166Z","title":"WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Inisev","product":"Social Share Icons & Social Share Buttons","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42696","published":"2026-10-10T19:35:08.522Z","updated":"2026-10-13T06:13:18.105Z","title":"WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-42693","published":"2026-10-10T19:35:07.750Z","updated":"2026-10-29T12:08:20.728Z","title":"WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42633","published":"2026-10-10T19:35:07.003Z","updated":"2026-10-11T12:03:20.589Z","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Marcus","product":"Events Manager","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-42632","published":"2026-10-10T19:35:06.270Z","updated":"2026-10-11T11:43:00.299Z","title":"WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Real Estate","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42631","published":"2026-10-10T19:35:05.518Z","updated":"2026-10-11T11:43:00.412Z","title":"WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Music","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42630","published":"2026-10-10T19:35:04.739Z","updated":"2026-10-11T12:03:21.321Z","title":"WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Plura","product":"Web Plura Backup &amp; Restore Manager","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-42419","published":"2026-10-10T19:35:03.982Z","updated":"2026-10-11T12:03:21.445Z","title":"WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SwishFolio","product":"Swish Migrate and Backup","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-40808","published":"2026-10-10T19:35:03.250Z","updated":"2026-10-11T12:13:35.708Z","title":"WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Automattic","product":"Jetpack VideoPress","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-40805","published":"2026-10-10T19:35:02.525Z","updated":"2026-10-11T12:13:35.834Z","title":"WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PeepSo","product":"PeepSo","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-40803","published":"2026-10-10T19:35:01.775Z","updated":"2026-10-11T11:43:00.531Z","title":"WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jotform","product":"Jotform &#8211; AI Chatbot","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-40802","published":"2026-10-10T19:35:01.019Z","updated":"2026-10-11T12:13:35.962Z","title":"WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"pubjet","product":"Pubjet | پاب‌جت","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-40801","published":"2026-10-10T19:35:00.257Z","updated":"2026-10-11T12:13:36.097Z","title":"WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Wordable","product":"Wordable","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-40800","published":"2026-10-10T19:34:59.496Z","updated":"2026-10-11T12:03:20.711Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-40777","published":"2026-10-10T19:34:58.723Z","updated":"2026-10-11T12:13:36.220Z","title":"WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Rashid","product":"WPSection","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-39802","published":"2026-10-10T19:34:57.947Z","updated":"2026-10-11T12:13:36.342Z","title":"WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.1,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-39801","published":"2026-10-10T19:34:57.214Z","updated":"2026-10-11T12:13:36.457Z","title":"WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-39800","published":"2026-10-10T19:34:56.435Z","updated":"2026-10-11T11:43:00.654Z","title":"WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Anton Bond","product":"Additional Order Filters for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39799","published":"2026-10-10T19:34:55.718Z","updated":"2026-10-11T11:43:00.768Z","title":"WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Joomunited","product":"WP File Download","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94590","published":"2026-10-10T18:45:45.857Z","updated":"2026-10-11T12:13:36.569Z","title":"WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodePeople2","product":"Sell Downloads","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-57806","published":"2026-10-10T18:44:38.221Z","updated":"2026-10-11T11:42:54.287Z","title":"WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"drfuri","product":"Martfury - WooCommerce Marketplace WordPress Theme","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-106610","published":"2026-10-10T18:09:06.421Z","updated":"2026-10-11T12:13:36.684Z","title":"WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-96341","published":"2026-10-10T18:09:06.215Z","updated":"2026-10-11T12:13:42.585Z","title":"WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.2,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-105892","published":"2026-10-10T18:09:05.758Z","updated":"2026-10-11T12:13:42.710Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-105889","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:03:20.837Z","title":"WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-104398","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:13:42.842Z","title":"WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"VillaTheme","product":"AFFI – Affiliate Marketing for WooCommerce","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-103071","published":"2026-10-10T17:00:10.567Z","updated":"2026-10-11T12:13:36.805Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-103357","published":"2026-10-10T17:00:10.501Z","updated":"2026-10-11T12:13:36.927Z","title":"WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.9,"vendor":"VillaTheme","product":"GIFT4U","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-106608","published":"2026-10-10T17:00:10.174Z","updated":"2026-10-11T12:13:37.058Z","title":"WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-106609","published":"2026-10-10T17:00:10.072Z","updated":"2026-10-11T12:13:37.201Z","title":"WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Impian","product":"Bayarcash WooCommerce","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-94160","published":"2026-10-10T17:00:09.779Z","updated":"2026-10-11T11:42:54.432Z","title":"WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themeStek","product":"ThemeStek Extras for LabtechCO Theme","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62044","published":"2026-10-10T17:00:09.638Z","updated":"2026-10-11T12:13:37.319Z","title":"WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"Super Video Player","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-66435","published":"2026-10-10T14:00:13.260Z","updated":"2026-10-11T12:13:37.438Z","title":"WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Devin Walker","product":"WP Rollback","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-97264","published":"2026-10-10T14:00:13.151Z","updated":"2026-10-11T11:42:54.561Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-97263","published":"2026-10-10T14:00:12.696Z","updated":"2026-10-11T11:42:54.692Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-94676","published":"2026-10-10T14:00:12.587Z","updated":"2026-10-11T12:13:37.549Z","title":"WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Tainacan Community","product":"Tainacan","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-105885","published":"2026-10-10T14:00:10.868Z","updated":"2026-10-11T12:13:38.290Z","title":"WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-102388","published":"2026-10-10T14:00:10.087Z","updated":"2026-10-11T11:42:54.822Z","title":"WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-93951","published":"2026-10-10T08:00:09.334Z","updated":"2026-10-11T11:42:54.945Z","title":"WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Zeinet","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62045","published":"2026-10-10T07:00:39.141Z","updated":"2026-10-11T12:13:38.417Z","title":"WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Booklovers","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-62046","published":"2026-10-10T07:00:38.957Z","updated":"2026-10-11T12:13:38.529Z","title":"WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Gutentype","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-93945","published":"2026-10-10T07:00:38.671Z","updated":"2026-10-11T12:13:42.978Z","title":"WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Balance","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93944","published":"2026-10-10T07:00:38.483Z","updated":"2026-10-11T12:13:43.101Z","title":"WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Camelia","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93943","published":"2026-10-10T07:00:38.253Z","updated":"2026-10-11T12:13:38.647Z","title":"WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Convex","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93942","published":"2026-10-10T07:00:38.027Z","updated":"2026-10-11T12:13:38.769Z","title":"WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Dwell","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93941","published":"2026-10-10T07:00:37.796Z","updated":"2026-10-11T12:13:38.936Z","title":"WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Edema","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93940","published":"2026-10-10T07:00:37.570Z","updated":"2026-10-11T12:13:39.061Z","title":"WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Greeny","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93938","published":"2026-10-10T07:00:37.342Z","updated":"2026-10-11T12:13:39.189Z","title":"WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hogwords","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93937","published":"2026-10-10T07:00:37.101Z","updated":"2026-10-11T12:13:39.314Z","title":"WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hygia","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93936","published":"2026-10-10T07:00:36.862Z","updated":"2026-10-11T12:13:39.432Z","title":"WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"IPharm","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-93935","published":"2026-10-10T07:00:36.635Z","updated":"2026-10-11T12:13:39.559Z","title":"WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Let's Play","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93934","published":"2026-10-10T07:00:36.397Z","updated":"2026-10-11T12:13:39.683Z","title":"WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Partiso","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93933","published":"2026-10-10T07:00:35.938Z","updated":"2026-10-11T12:13:39.804Z","title":"WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Rosalinda","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93932","published":"2026-10-10T07:00:35.688Z","updated":"2026-10-11T12:13:39.922Z","title":"WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smart Casa","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93931","published":"2026-10-10T07:00:35.434Z","updated":"2026-10-11T12:13:40.048Z","title":"WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smash","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93930","published":"2026-10-10T07:00:35.196Z","updated":"2026-10-11T12:13:40.173Z","title":"WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Tantra","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-93929","published":"2026-10-10T07:00:34.898Z","updated":"2026-10-11T12:13:40.386Z","title":"WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Travesia","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-93927","published":"2026-10-10T07:00:34.675Z","updated":"2026-10-11T12:13:40.518Z","title":"WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Veto","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-93950","published":"2026-10-10T07:00:34.389Z","updated":"2026-10-11T12:13:40.643Z","title":"WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-93949","published":"2026-10-10T07:00:34.180Z","updated":"2026-10-11T12:13:40.757Z","title":"WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Omegathemes","product":"Grocery Shopping Store","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-106606","published":"2026-10-10T07:00:33.921Z","updated":"2026-10-11T12:13:40.905Z","title":"WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YITH","product":"YITH WooCommerce Affiliates","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-42695","published":"2026-10-09T16:51:45.133Z","updated":"2026-10-11T11:42:55.084Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-94067","published":"2026-10-09T14:00:10.842Z","updated":"2026-10-09T20:00:14.448Z","title":"WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"The Voux","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-94066","published":"2026-10-09T14:00:10.562Z","updated":"2026-10-09T17:30:30.300Z","title":"WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SpabRice","product":"Pond","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-94063","published":"2026-10-09T14:00:10.469Z","updated":"2026-10-09T15:09:20.784Z","title":"WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-94065","published":"2026-10-09T14:00:10.127Z","updated":"2026-10-11T12:13:41.024Z","title":"WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"ColorFolio","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-94064","published":"2026-10-09T14:00:10.022Z","updated":"2026-10-11T12:13:41.160Z","title":"WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"Neo | Barber Shop WordPress Theme","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-62026","published":"2026-10-09T13:15:27.207Z","updated":"2026-10-09T19:55:18.178Z","title":"WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MIGHTYminnow","product":"Dashboard Notes","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-94062","published":"2026-10-09T13:00:16.921Z","updated":"2026-10-09T17:43:13.501Z","title":"WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-94061","published":"2026-10-09T13:00:16.730Z","updated":"2026-10-11T11:42:55.234Z","title":"WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"Whistle - Sports Club","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-94060","published":"2026-10-09T13:00:16.560Z","updated":"2026-10-11T11:42:55.373Z","title":"WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Voldor","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-94059","published":"2026-10-09T13:00:16.346Z","updated":"2026-10-09T15:09:41.245Z","title":"WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ogency","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-94058","published":"2026-10-09T13:00:16.159Z","updated":"2026-10-09T19:56:25.807Z","title":"WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Treck","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62028","published":"2026-10-09T12:14:54.653Z","updated":"2026-10-11T12:13:41.276Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-105883","published":"2026-10-09T12:08:39.172Z","updated":"2026-10-09T19:59:10.283Z","title":"WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Th Shop Mania","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-106601","published":"2026-10-09T12:08:38.787Z","updated":"2026-10-09T15:09:49.660Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-106602","published":"2026-10-09T12:08:38.768Z","updated":"2026-10-11T12:13:41.420Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-104392","published":"2026-10-09T12:08:37.866Z","updated":"2026-10-09T20:01:16.901Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-105870","published":"2026-10-09T12:08:37.726Z","updated":"2026-10-11T11:42:55.514Z","title":"WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Delight Star Inc.","product":"WP Associate Post R2","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-105872","published":"2026-10-09T12:08:37.425Z","updated":"2026-10-11T12:13:41.572Z","title":"WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"mklacroix","product":"Product Configurator for WooCommerce","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-105877","published":"2026-10-09T12:08:37.272Z","updated":"2026-10-09T17:33:02.391Z","title":"WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-105318","published":"2026-10-09T12:08:37.036Z","updated":"2026-10-13T06:22:16.869Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Datasolution","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-62029","published":"2026-10-09T12:04:39.782Z","updated":"2026-10-09T17:34:23.625Z","title":"WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-62036","published":"2026-10-09T11:49:30.979Z","updated":"2026-10-11T11:40:37.609Z","title":"WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AREOI","product":"All Bootstrap Blocks","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-39779","published":"2026-10-09T11:44:42.274Z","updated":"2026-10-09T15:10:10.428Z","title":"WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Asgaros","product":"Asgaros Forum","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-62039","published":"2026-10-09T11:44:04.748Z","updated":"2026-10-11T11:42:55.643Z","title":"WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-62040","published":"2026-10-09T11:42:11.802Z","updated":"2026-10-14T12:23:44.503Z","title":"WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DEV Institute","product":"Restrict User Access – Membership Plugin with Force","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-62041","published":"2026-10-09T11:40:25.660Z","updated":"2026-10-09T17:36:34.128Z","title":"WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ashok Dudhat","product":"WP Event Manager","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-62042","published":"2026-10-09T11:32:27.683Z","updated":"2026-10-09T19:57:53.346Z","title":"WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"unFocus Projects","product":"Scripts n Styles","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-107419","published":"2026-10-09T11:17:43.577Z","updated":"2026-10-11T12:13:41.693Z","title":"WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Cool Plugins","product":"AI Translation for Polylang","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-93947","published":"2026-10-09T10:00:36.351Z","updated":"2026-10-09T15:10:20.858Z","title":"WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shinetheme","product":"Traveler","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-94158","published":"2026-10-09T10:00:36.253Z","updated":"2026-10-11T11:42:55.888Z","title":"WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bkninja","product":"Gloria Admin Panel","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94503","published":"2026-10-09T10:00:35.938Z","updated":"2026-10-12T06:17:40.182Z","title":"WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"PX-lab","product":"Zombify","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-94161","published":"2026-10-09T10:00:35.885Z","updated":"2026-10-09T17:38:14.641Z","title":"WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94159","published":"2026-10-09T10:00:35.516Z","updated":"2026-10-11T11:42:56.008Z","title":"WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94167","published":"2026-10-09T10:00:35.453Z","updated":"2026-10-09T15:10:28.354Z","title":"WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Extend Themes","product":"Kubio AI Page Builder","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96334","published":"2026-10-09T10:00:35.107Z","updated":"2026-10-11T12:13:41.820Z","title":"WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.6,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-94170","published":"2026-10-09T10:00:35.060Z","updated":"2026-10-11T11:42:56.139Z","title":"WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Sassy Social Share","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94664","published":"2026-10-09T10:00:34.694Z","updated":"2026-10-09T20:05:07.048Z","title":"WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"add-ons.org","product":"PDF for Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-96607","published":"2026-10-09T10:00:34.684Z","updated":"2026-10-09T17:39:12.169Z","title":"WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-94666","published":"2026-10-09T10:00:34.337Z","updated":"2026-10-11T12:13:41.956Z","title":"WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"ZealousWeb","product":"Generate PDF using Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-96332","published":"2026-10-09T10:00:34.303Z","updated":"2026-10-09T20:06:18.069Z","title":"WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"yalla ya!","product":"Simple Payment","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-95589","published":"2026-10-09T10:00:33.945Z","updated":"2026-10-09T20:10:23.743Z","title":"WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Deposits and Partial Payments for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-94668","published":"2026-10-09T10:00:33.924Z","updated":"2026-10-09T17:40:22.596Z","title":"WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94667","published":"2026-10-09T10:00:33.558Z","updated":"2026-10-11T11:42:56.267Z","title":"WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-94665","published":"2026-10-09T10:00:33.513Z","updated":"2026-10-09T15:10:39.045Z","title":"WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-94663","published":"2026-10-09T10:00:33.105Z","updated":"2026-10-09T17:41:11.576Z","title":"WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-94661","published":"2026-10-09T10:00:33.072Z","updated":"2026-10-11T11:42:56.385Z","title":"WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94641","published":"2026-10-09T10:00:32.734Z","updated":"2026-10-11T11:42:56.522Z","title":"WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94632","published":"2026-10-09T10:00:32.671Z","updated":"2026-10-09T15:10:48.031Z","title":"WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"BlockStrap Page Builder - Bootstrap Blocks","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96809","published":"2026-10-09T10:00:32.302Z","updated":"2026-10-11T12:03:20.949Z","title":"WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"MultiNet Interactive AB","product":"EduAdmin Booking","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-94415","published":"2026-10-09T10:00:32.301Z","updated":"2026-10-11T11:42:56.644Z","title":"WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Muffingroup","product":"Betheme","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94166","published":"2026-10-09T10:00:22.170Z","updated":"2026-10-09T20:11:22.652Z","title":"WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96761","published":"2026-10-09T10:00:22.064Z","updated":"2026-10-09T15:10:57.640Z","title":"WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-96671","published":"2026-10-09T10:00:21.368Z","updated":"2026-10-09T20:12:12.139Z","title":"WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-96331","published":"2026-10-09T10:00:21.324Z","updated":"2026-10-20T17:58:59.053Z","title":"WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpdreams","product":"Ajax Search Pro","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-96330","published":"2026-10-09T10:00:20.965Z","updated":"2026-10-11T12:03:21.072Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-96329","published":"2026-10-09T10:00:20.895Z","updated":"2026-10-11T12:03:21.202Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-96328","published":"2026-10-09T10:00:20.599Z","updated":"2026-10-09T15:11:09.645Z","title":"WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"jegtheme","product":"JNews - Pay Writer","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-95609","published":"2026-10-09T10:00:20.474Z","updated":"2026-10-11T11:42:56.776Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-95599","published":"2026-10-09T10:00:20.145Z","updated":"2026-10-09T20:13:14.977Z","title":"WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-95598","published":"2026-10-09T10:00:20.071Z","updated":"2026-10-09T17:43:35.650Z","title":"WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Search in Place","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-95597","published":"2026-10-09T10:00:19.713Z","updated":"2026-10-11T12:13:42.073Z","title":"WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codemstory","product":"워드프레스 결제 심플페이","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-95596","published":"2026-10-09T10:00:19.652Z","updated":"2026-10-11T11:42:56.912Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-95591","published":"2026-10-09T10:00:19.352Z","updated":"2026-10-09T15:11:17.737Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94568","published":"2026-10-09T10:00:19.289Z","updated":"2026-10-09T20:18:08.028Z","title":"WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-95607","published":"2026-10-09T10:00:18.459Z","updated":"2026-10-09T15:11:27.797Z","title":"WordPress WPLMS  theme <= 4.973 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-96327","published":"2026-10-09T10:00:18.114Z","updated":"2026-10-09T20:19:06.443Z","title":"WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-95608","published":"2026-10-09T10:00:18.049Z","updated":"2026-10-11T11:42:57.048Z","title":"WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"HUSKY","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-95610","published":"2026-10-09T10:00:17.308Z","updated":"2026-10-27T13:20:09.827Z","title":"WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-96461","published":"2026-10-09T10:00:17.179Z","updated":"2026-10-09T20:20:07.252Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-96337","published":"2026-10-09T10:00:16.886Z","updated":"2026-10-09T17:44:38.003Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-96518","published":"2026-10-09T10:00:16.773Z","updated":"2026-10-09T15:11:34.573Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-96333","published":"2026-10-09T10:00:16.516Z","updated":"2026-10-09T15:11:44.568Z","title":"WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-96553","published":"2026-10-09T10:00:16.406Z","updated":"2026-10-11T11:42:57.165Z","title":"WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Damian Góra","product":"FiboSearch","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-96539","published":"2026-10-09T10:00:16.120Z","updated":"2026-10-11T12:13:42.212Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-96336","published":"2026-10-09T10:00:15.190Z","updated":"2026-10-11T12:13:42.343Z","title":"WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-62049","published":"2026-10-09T09:15:43.867Z","updated":"2026-10-09T20:21:08.550Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97075","published":"2026-10-09T08:00:19.896Z","updated":"2026-10-09T18:02:29.120Z","title":"WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-97076","published":"2026-10-09T07:00:48.876Z","updated":"2026-10-11T12:13:42.465Z","title":"WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-40804","published":"2026-10-08T18:48:17.611Z","updated":"2026-10-08T19:29:11.917Z","title":"WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kodezen LLC","product":"aBlocks","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-105436","published":"2026-10-08T17:00:12.300Z","updated":"2026-10-09T15:15:11.490Z","title":"WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"MainWP","product":"MainWP Child","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-27420","published":"2026-10-08T13:26:16.676Z","updated":"2026-10-08T15:49:00.862Z","title":"WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Katie Seaborn","product":"Zotpress","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-42698","published":"2026-10-08T13:14:10.326Z","updated":"2026-10-08T14:06:52.143Z","title":"WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-62127","published":"2026-10-08T13:09:19.885Z","updated":"2026-10-08T14:05:57.477Z","title":"WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MediaRon LLC","product":"WP Plugin Info Card","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-62128","published":"2026-10-08T13:08:46.298Z","updated":"2026-10-10T03:00:58.682Z","title":"WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Creator LMS","product":"Creator LMS","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-106611","published":"2026-10-08T13:05:37.797Z","updated":"2026-10-08T17:53:46.740Z","title":"WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-105893","published":"2026-10-08T13:05:12.901Z","updated":"2026-10-08T16:59:47.202Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-105079","published":"2026-10-08T13:04:48.139Z","updated":"2026-10-10T02:58:43.411Z","title":"WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105891","published":"2026-10-08T13:03:39.883Z","updated":"2026-10-10T02:58:07.274Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-103072","published":"2026-10-08T13:03:10.908Z","updated":"2026-10-08T17:53:52.213Z","title":"WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"VillaTheme Core","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-105890","published":"2026-10-08T13:02:50.319Z","updated":"2026-10-08T14:07:23.790Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105888","published":"2026-10-08T13:02:00.900Z","updated":"2026-10-08T17:53:58.712Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-105078","published":"2026-10-08T13:01:36.116Z","updated":"2026-10-08T14:07:52.571Z","title":"WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Store Locator","product":"WP Store Locator","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-106596","published":"2026-10-08T13:00:34.650Z","updated":"2026-10-08T14:07:40.315Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-105887","published":"2026-10-08T13:00:14.204Z","updated":"2026-10-08T14:10:10.343Z","title":"WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Robosoft","product":"Robo Gallery","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-103070","published":"2026-10-08T12:58:32.583Z","updated":"2026-10-08T14:18:45.750Z","title":"WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105886","published":"2026-10-08T12:57:40.288Z","updated":"2026-10-08T17:01:38.992Z","title":"WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Ultimate Post Kit","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-105076","published":"2026-10-08T12:56:35.162Z","updated":"2026-10-08T17:10:45.652Z","title":"WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Appsbd","product":"Vitepos","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-62142","published":"2026-10-08T12:31:10.868Z","updated":"2026-10-08T14:11:39.688Z","title":"WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Melapress","product":"WP 2FA","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-105878","published":"2026-10-08T12:29:51.708Z","updated":"2026-10-08T17:02:33.651Z","title":"WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Bundles","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-106603","published":"2026-10-08T12:27:58.657Z","updated":"2026-10-09T07:24:52.632Z","title":"WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Groundhogg","product":"HollerBox","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-66479","published":"2026-10-08T12:20:49.278Z","updated":"2026-10-08T14:12:00.074Z","title":"WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"WPComplete","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-106600","published":"2026-10-08T12:20:18.826Z","updated":"2026-10-08T14:19:36.619Z","title":"WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-96335","published":"2026-10-07T17:09:50.213Z","updated":"2026-10-07T19:23:46.015Z","title":"WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-95606","published":"2026-10-07T17:07:23.189Z","updated":"2026-10-07T17:49:58.857Z","title":"WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-95605","published":"2026-10-07T17:05:14.177Z","updated":"2026-10-07T18:04:51.175Z","title":"WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-95595","published":"2026-10-07T17:03:19.480Z","updated":"2026-10-07T19:23:46.144Z","title":"WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fontsplugin","product":"Disable and Remove Google Fonts | GDPR & DSGVO friendly","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-95534","published":"2026-10-07T17:00:23.166Z","updated":"2026-10-07T17:32:12.169Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-94670","published":"2026-10-07T16:57:43.166Z","updated":"2026-10-07T19:23:46.278Z","title":"WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-94662","published":"2026-10-07T16:55:21.832Z","updated":"2026-10-07T17:49:13.996Z","title":"WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-42708","published":"2026-10-07T11:59:35.547Z","updated":"2026-10-07T19:23:47.417Z","title":"WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"AF themes","product":"WP Post Author","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-42710","published":"2026-10-07T11:55:51.698Z","updated":"2026-10-07T17:05:16.763Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-42713","published":"2026-10-07T10:57:33.366Z","updated":"2026-10-07T19:23:47.540Z","title":"WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Gopiplus","product":"Post title marquee scroll","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-42714","published":"2026-10-07T10:56:56.499Z","updated":"2026-10-07T17:43:50.109Z","title":"WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Piggly Dev","product":"Pix por Piggly (para Woocommerce)","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-42720","published":"2026-10-07T09:57:33.748Z","updated":"2026-10-07T10:26:54.695Z","title":"WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-42721","published":"2026-10-07T09:56:56.962Z","updated":"2026-10-07T10:26:38.797Z","title":"WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"SERVIT Software Solutions","product":"affiliate-toolkit","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-27434","published":"2026-10-07T09:24:43.741Z","updated":"2026-10-07T10:09:58.783Z","title":"WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sc Internet Vivoo","product":"WP Rentals","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-104390","published":"2026-10-07T09:17:31.432Z","updated":"2026-10-07T10:09:58.909Z","title":"WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-105876","published":"2026-10-07T09:16:26.835Z","updated":"2026-10-07T10:09:59.051Z","title":"WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-104393","published":"2026-10-07T09:16:04.708Z","updated":"2026-10-07T10:09:59.187Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-105875","published":"2026-10-07T09:15:39.584Z","updated":"2026-10-07T10:09:59.320Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-104391","published":"2026-10-07T09:15:11.909Z","updated":"2026-10-07T10:09:59.457Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-103075","published":"2026-10-07T09:12:48.442Z","updated":"2026-10-07T10:09:59.577Z","title":"WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Hustle","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-105884","published":"2026-10-07T09:12:23.408Z","updated":"2026-10-07T10:09:59.723Z","title":"WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Media","product":"Rocket Lazy Load","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-105873","published":"2026-10-07T09:11:27.437Z","updated":"2026-10-07T10:09:59.849Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97294","published":"2026-10-07T09:10:56.001Z","updated":"2026-10-07T10:10:00.035Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-105871","published":"2026-10-07T09:04:25.788Z","updated":"2026-10-07T10:10:00.383Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-66666","published":"2026-10-06T17:48:37.371Z","updated":"2026-10-06T20:05:54.337Z","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Automattic","product":"WordPress","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-104399","published":"2026-10-06T08:40:47.824Z","updated":"2026-10-06T10:31:25.740Z","title":"WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-105317","published":"2026-10-06T08:35:24.406Z","updated":"2026-10-06T10:31:25.873Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-105071","published":"2026-10-06T08:35:23.670Z","updated":"2026-10-06T10:31:26.009Z","title":"WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-105070","published":"2026-10-06T08:35:22.951Z","updated":"2026-10-06T10:31:26.150Z","title":"WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-105061","published":"2026-10-06T08:35:22.227Z","updated":"2026-10-06T10:31:26.294Z","title":"WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bởi brandtoss","product":"WP Mailster","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-105059","published":"2026-10-06T08:35:21.544Z","updated":"2026-10-12T14:27:14.634Z","title":"WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"royalnavneet","product":"Delete All Comments of wordpress","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-105058","published":"2026-10-06T08:35:20.818Z","updated":"2026-10-06T10:31:26.566Z","title":"WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"John James Jacoby","product":"WP User Profiles","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-105057","published":"2026-10-06T08:35:20.081Z","updated":"2026-10-06T10:31:26.694Z","title":"WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ben Marshall","product":"Zero Spam","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-104814","published":"2026-10-06T08:35:19.361Z","updated":"2026-10-06T10:31:26.835Z","title":"WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"epiphyt","product":"Form Block","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-104757","published":"2026-10-06T08:35:18.658Z","updated":"2026-10-06T10:31:26.972Z","title":"WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Javier Carazo","product":"Import and export users and customers","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-104747","published":"2026-10-06T08:35:17.979Z","updated":"2026-10-06T10:31:27.096Z","title":"WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Haaken","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-104672","published":"2026-10-06T08:35:17.268Z","updated":"2026-10-06T10:31:27.261Z","title":"WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-104670","published":"2026-10-06T08:35:16.585Z","updated":"2026-10-06T10:31:27.439Z","title":"WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-104406","published":"2026-10-06T08:35:15.890Z","updated":"2026-10-06T10:31:27.573Z","title":"WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"picu","product":"picu","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-104405","published":"2026-10-06T08:35:15.194Z","updated":"2026-10-06T10:31:27.703Z","title":"WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-104395","published":"2026-10-06T08:35:14.474Z","updated":"2026-10-06T10:31:27.829Z","title":"WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"picu","product":"picu","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-104394","published":"2026-10-06T08:35:13.805Z","updated":"2026-10-06T10:31:27.975Z","title":"WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-104387","published":"2026-10-06T08:35:13.107Z","updated":"2026-10-06T10:31:28.112Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.2,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-104385","published":"2026-10-06T08:35:12.401Z","updated":"2026-10-06T10:31:28.298Z","title":"WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-102915","published":"2026-10-06T08:35:10.971Z","updated":"2026-10-06T10:31:28.455Z","title":"WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.5,"vendor":"Marco van Wieren","product":"WPO365","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-102387","published":"2026-10-06T08:35:10.255Z","updated":"2026-10-06T10:31:28.617Z","title":"WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"XServer","product":"Xserver Migrator","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-100518","published":"2026-10-06T08:35:09.522Z","updated":"2026-10-06T10:31:28.757Z","title":"WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebFactory","product":"Advanced Google reCAPTCHA","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-97308","published":"2026-10-06T08:35:08.814Z","updated":"2026-10-06T10:31:28.890Z","title":"WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.8,"vendor":"WebFactory","product":"Login Lockdown","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-95594","published":"2026-10-06T08:35:08.065Z","updated":"2026-10-12T14:07:16.423Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-95526","published":"2026-10-06T08:35:07.323Z","updated":"2026-10-06T10:31:29.166Z","title":"WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"RealMag777","product":"BEAR","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-94675","published":"2026-10-06T08:35:06.593Z","updated":"2026-10-06T10:31:29.335Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fluent Forms Free vs Pro","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62072","published":"2026-10-06T08:35:05.157Z","updated":"2026-10-06T10:31:29.627Z","title":"WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Planner","product":"Progress Planner","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-48199","published":"2026-10-06T08:35:04.446Z","updated":"2026-10-06T10:31:29.791Z","title":"WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Beplusthemes","product":"Sermon'e","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-48197","published":"2026-10-06T08:35:03.720Z","updated":"2026-10-06T10:31:29.926Z","title":"WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-42638","published":"2026-10-06T08:35:02.876Z","updated":"2026-10-07T07:41:51.824Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-42637","published":"2026-10-06T08:35:02.145Z","updated":"2026-10-06T10:31:30.233Z","title":"WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-42636","published":"2026-10-06T08:35:01.411Z","updated":"2026-10-06T10:31:30.386Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-42635","published":"2026-10-06T08:35:00.661Z","updated":"2026-10-06T10:31:30.527Z","title":"WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpgenie","product":"WooCommerce Simple Auctions","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-42634","published":"2026-10-06T08:34:59.948Z","updated":"2026-10-06T10:31:30.659Z","title":"WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Video Background Block – Use video as background in the section.","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-42418","published":"2026-10-06T08:34:59.233Z","updated":"2026-10-07T07:41:55.087Z","title":"WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Socialrocket","product":"Social Rocket","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-42417","published":"2026-10-06T08:34:58.496Z","updated":"2026-10-06T10:31:30.946Z","title":"WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"reputeinfosystems","product":"ARMember Premium","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-42416","published":"2026-10-06T08:34:57.756Z","updated":"2026-10-06T10:31:31.076Z","title":"WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-42415","published":"2026-10-06T08:34:57.024Z","updated":"2026-10-06T10:31:31.207Z","title":"WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"p-themes","product":"Porto Theme - Functionality","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-42414","published":"2026-10-06T08:34:56.108Z","updated":"2026-10-06T10:31:31.351Z","title":"WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-42413","published":"2026-10-06T08:34:55.402Z","updated":"2026-10-06T10:31:31.489Z","title":"WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"DaftPlug","product":"Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-41562","published":"2026-10-06T08:34:54.683Z","updated":"2026-10-06T10:31:31.621Z","title":"WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"norvisgabriel","product":"Norvis Backup","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-41561","published":"2026-10-06T08:34:53.939Z","updated":"2026-10-06T10:31:31.857Z","title":"WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Adrian Lin","product":"Museder RestoreOne","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-41560","published":"2026-10-06T08:34:53.188Z","updated":"2026-10-06T10:31:32.165Z","title":"WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wxdlabs","product":"WXD Backup Lite","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-41559","published":"2026-10-06T08:34:52.473Z","updated":"2026-10-06T10:31:32.284Z","title":"WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Pluginjoy","product":"SafeSnap – Verified WordPress Backup &amp; Restore","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-41555","published":"2026-10-06T08:34:51.734Z","updated":"2026-10-06T10:31:32.436Z","title":"WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Weblizar – WordPress Themes & Plugin","product":"Newsletter Subscription Form – User Subscriptions Form, Capture Email","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-40807","published":"2026-10-06T08:34:51.025Z","updated":"2026-10-06T10:31:32.614Z","title":"WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-40806","published":"2026-10-06T08:34:50.271Z","updated":"2026-10-06T10:31:32.786Z","title":"WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Plugin Devs","product":"Blog, Posts and Category Filter for Elementor","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39798","published":"2026-10-06T08:34:49.525Z","updated":"2026-10-06T10:31:32.929Z","title":"WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemetechMount","product":"TrueBooker","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-39797","published":"2026-10-06T08:34:48.786Z","updated":"2026-10-06T10:31:33.072Z","title":"WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Data443 Risk Mitigation, Inc.","product":"GDPR Framework By Data443","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-39796","published":"2026-10-06T08:34:48.042Z","updated":"2026-10-06T10:31:33.215Z","title":"WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Flipper Code – WordPress Development Company","product":"Advanced Posts Listing – Show Post List Easily","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-39795","published":"2026-10-06T08:34:47.283Z","updated":"2026-10-28T17:37:08.624Z","title":"WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"brewlabs","product":"SendPress Newsletters","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-39794","published":"2026-10-06T08:34:46.533Z","updated":"2026-10-06T10:31:33.503Z","title":"WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WooCommerce Multivendor Marketplace – REST API","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-39793","published":"2026-10-06T08:34:45.833Z","updated":"2026-10-06T10:31:33.635Z","title":"WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Nicu Micle","product":"Simple JWT Login","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-39792","published":"2026-10-06T08:34:45.084Z","updated":"2026-10-06T10:31:33.763Z","title":"WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-39791","published":"2026-10-06T08:34:44.345Z","updated":"2026-10-06T10:31:33.890Z","title":"WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mailjet","product":"Mailjet Email Marketing","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39790","published":"2026-10-06T08:34:43.639Z","updated":"2026-10-08T16:26:51.693Z","title":"WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39788","published":"2026-10-06T08:34:42.945Z","updated":"2026-10-06T10:31:34.162Z","title":"WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shamim Hasan","product":"Front End PM","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-39787","published":"2026-10-06T08:34:42.197Z","updated":"2026-10-06T10:31:34.287Z","title":"WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"10Web","product":"10Web Social Photo Feed","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-39785","published":"2026-10-06T08:34:41.464Z","updated":"2026-10-13T16:31:43.279Z","title":"WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Serhii Pasyuk","product":"Gmedia Photo Gallery","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-39784","published":"2026-10-06T08:34:40.759Z","updated":"2026-10-06T10:31:34.555Z","title":"WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39781","published":"2026-10-06T08:34:40.014Z","updated":"2026-10-15T16:32:45.612Z","title":"WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dan Rossiter","product":"Document Gallery","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39780","published":"2026-10-06T08:34:39.270Z","updated":"2026-10-06T10:31:34.839Z","title":"WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39778","published":"2026-10-06T08:34:38.441Z","updated":"2026-10-06T10:31:35.026Z","title":"WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themeansar","product":"Ansar Import – One Click Starter Sites – for Elementor &amp; Themes","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39776","published":"2026-10-06T08:34:37.696Z","updated":"2026-10-06T10:31:35.164Z","title":"WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8,"vendor":"wpshopmart","product":"Tabs","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-39775","published":"2026-10-06T08:34:36.958Z","updated":"2026-10-06T10:31:35.298Z","title":"WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"DexignZone","product":"JobZilla - Job Board WordPress Theme","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-39774","published":"2026-10-06T08:34:36.214Z","updated":"2026-10-06T10:31:35.455Z","title":"WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Tourfic AI Studio","product":"Tourfic Pro","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-39773","published":"2026-10-06T08:34:35.478Z","updated":"2026-10-06T10:31:35.630Z","title":"WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":10,"vendor":"AmentoTech","product":"Doctreat Core","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-39772","published":"2026-10-06T08:34:34.779Z","updated":"2026-10-06T10:31:35.769Z","title":"WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bestwebsoft","product":"Captcha by BestWebSoft","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-39771","published":"2026-10-06T08:34:34.040Z","updated":"2026-10-06T10:31:35.912Z","title":"WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"MightyNetworks vs BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-39770","published":"2026-10-06T08:34:33.299Z","updated":"2026-10-06T10:31:36.033Z","title":"WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"AmentoTech","product":"Doctreat","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-39769","published":"2026-10-06T08:34:32.593Z","updated":"2026-10-23T08:42:43.466Z","title":"WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Iqonic Designs","product":"Graphina – Charts and Graphs For Elementor","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2026-39767","published":"2026-10-06T08:34:31.166Z","updated":"2026-10-06T10:31:36.500Z","title":"WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":6.5,"vendor":"baseapp","product":"WPBase Cache","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-39766","published":"2026-10-06T08:34:30.421Z","updated":"2026-10-06T10:31:36.624Z","title":"WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"reputeinfosystems","product":"ARForms","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39765","published":"2026-10-06T08:34:29.700Z","updated":"2026-10-06T10:31:36.756Z","title":"WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"WebAppick","product":"Challan","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-39764","published":"2026-10-06T08:34:28.966Z","updated":"2026-10-06T10:31:36.888Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RadiusTheme","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-39762","published":"2026-10-06T08:34:28.253Z","updated":"2026-10-06T10:31:37.034Z","title":"WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Patterns In The Cloud","product":"Autoship Cloud for WooCommerce Subscription Products","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-39761","published":"2026-10-06T08:34:27.505Z","updated":"2026-10-06T10:31:37.178Z","title":"WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"eLightUp","product":"Meta Box AIO","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-39759","published":"2026-10-06T08:34:26.777Z","updated":"2026-10-06T10:31:37.320Z","title":"WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-39758","published":"2026-10-06T08:34:25.937Z","updated":"2026-10-06T10:31:37.448Z","title":"WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Midtrans","product":"Midtrans-WooCommerce","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39757","published":"2026-10-06T08:34:25.188Z","updated":"2026-10-06T10:31:37.577Z","title":"WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"AmentoTech","product":"Taskbot","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-39756","published":"2026-10-06T08:34:24.471Z","updated":"2026-10-06T10:31:37.698Z","title":"WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wappointment team","product":"Wappointment","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-39755","published":"2026-10-06T08:34:23.714Z","updated":"2026-10-06T10:31:37.844Z","title":"WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"revmakx","product":"WP Duplicate","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-39754","published":"2026-10-06T08:34:22.980Z","updated":"2026-10-06T10:31:37.977Z","title":"WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"About Piotnet","product":"Piotnet Addons For Elementor","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-39753","published":"2026-10-06T08:34:22.228Z","updated":"2026-10-06T10:31:38.113Z","title":"WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AmentoTech","product":"Taskbot","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-39752","published":"2026-10-06T08:34:21.489Z","updated":"2026-10-06T10:31:38.249Z","title":"WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-39751","published":"2026-10-06T08:34:20.780Z","updated":"2026-10-06T10:31:38.368Z","title":"WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-39750","published":"2026-10-06T08:34:20.040Z","updated":"2026-10-06T10:31:38.496Z","title":"WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39749","published":"2026-10-06T08:34:19.329Z","updated":"2026-10-06T10:31:38.645Z","title":"WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"digitalpoint","product":"App for Cloudflare®","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-39748","published":"2026-10-06T08:34:18.613Z","updated":"2026-10-06T10:31:38.779Z","title":"WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeMove","product":"EduMall","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39747","published":"2026-10-06T08:34:17.916Z","updated":"2026-10-06T10:31:38.899Z","title":"WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WofficeIO","product":"Woffice","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-39746","published":"2026-10-06T08:34:17.195Z","updated":"2026-10-29T11:35:28.523Z","title":"WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Booknetic","product":"Booknetic","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-39745","published":"2026-10-06T08:34:16.474Z","updated":"2026-10-06T10:31:39.162Z","title":"WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bestweblayout","product":"Contact Form to DB by BestWebSoft","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39731","published":"2026-10-06T08:34:15.745Z","updated":"2026-10-06T10:31:39.296Z","title":"WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"code4life","product":"Database for CF7","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39730","published":"2026-10-06T08:34:15.038Z","updated":"2026-10-07T14:58:48.197Z","title":"WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-39729","published":"2026-10-06T08:34:14.325Z","updated":"2026-10-06T10:31:39.562Z","title":"WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.2,"vendor":"WisdmLabs","product":"Edwiser Bridge","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-39728","published":"2026-10-06T08:34:13.608Z","updated":"2026-10-06T10:31:39.691Z","title":"WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"instapagedev","product":"Instapage Plugin","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-39727","published":"2026-10-06T08:34:12.878Z","updated":"2026-10-06T10:31:39.836Z","title":"WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saravana Kumar K","product":"WC Fields Factory","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-39726","published":"2026-10-06T08:34:12.139Z","updated":"2026-10-06T10:31:39.966Z","title":"WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lumise NEO","product":"Lumise Product Designer","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39724","published":"2026-10-06T08:34:10.675Z","updated":"2026-10-06T10:31:40.239Z","title":"WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"veppa","product":"HTTP Requests Manager","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39722","published":"2026-10-06T08:34:09.939Z","updated":"2026-10-06T10:31:40.382Z","title":"WordPress WPLMS  theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-39720","published":"2026-10-06T08:34:09.205Z","updated":"2026-10-06T10:31:40.515Z","title":"WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mapster","product":"Mapster WP Maps","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39719","published":"2026-10-06T08:34:08.460Z","updated":"2026-10-06T10:31:40.658Z","title":"WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"DeKnows","product":"PDF Smart Viewer for Elementor","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-32581","published":"2026-10-06T08:34:07.719Z","updated":"2026-10-06T10:31:40.798Z","title":"WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"mooberrydreams","product":"Mooberry Book Manager","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-32580","published":"2026-10-06T08:34:06.978Z","updated":"2026-10-06T10:31:40.926Z","title":"WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"wpgenie","product":"WooCommerce Lottery","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-32579","published":"2026-10-06T08:34:06.232Z","updated":"2026-10-06T10:31:41.067Z","title":"WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"kognetiks","product":"Kognetiks Chatbot for WordPress","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-32578","published":"2026-10-06T08:34:05.522Z","updated":"2026-10-06T10:31:41.205Z","title":"WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"techsupport","product":"ECPay Ecommerce for WooCommerce","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-32577","published":"2026-10-06T08:34:04.809Z","updated":"2026-10-06T10:31:41.352Z","title":"WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32575","published":"2026-10-06T08:34:03.887Z","updated":"2026-10-06T10:31:41.490Z","title":"WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fantastic Plugins","product":"SUMO Affiliates Pro","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32574","published":"2026-10-06T08:34:03.141Z","updated":"2026-10-13T16:35:59.917Z","title":"WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EDGARROJAS","product":"Smart Forms","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32572","published":"2026-10-06T08:34:02.373Z","updated":"2026-10-06T10:31:41.804Z","title":"WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"WP User Frontend Pro","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32571","published":"2026-10-06T08:34:01.623Z","updated":"2026-10-06T10:31:41.949Z","title":"WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Colabrio","product":"Ohio Extra","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-32570","published":"2026-10-06T08:34:00.908Z","updated":"2026-10-06T10:31:42.083Z","title":"WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"DaftPlug","product":"Progressify - Progressive Web App (PWA)","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32569","published":"2026-10-06T08:33:59.999Z","updated":"2026-10-06T10:31:42.269Z","title":"WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Joomunited","product":"WP Media folder","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32568","published":"2026-10-06T08:33:59.253Z","updated":"2026-10-06T10:31:42.412Z","title":"WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"JMAPlugins","product":"WooCommerce Designer Pro","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-32557","published":"2026-10-06T08:33:58.564Z","updated":"2026-10-29T07:21:07.586Z","title":"WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"BookingWP","product":"WooCommerce Appointments","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-25434","published":"2026-10-06T08:33:57.852Z","updated":"2026-10-06T10:31:42.715Z","title":"WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-25433","published":"2026-10-06T08:33:57.132Z","updated":"2026-10-06T10:41:48.647Z","title":"WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-105879","published":"2026-10-06T08:08:49.411Z","updated":"2026-10-06T10:41:48.785Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-103346","published":"2026-10-06T08:00:10.782Z","updated":"2026-10-06T10:41:48.907Z","title":"WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tomlister","product":"Payflex Payment Gateway","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97300","published":"2026-10-06T05:14:51.890Z","updated":"2026-10-06T10:41:49.035Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-41563","published":"2026-10-06T05:14:51.195Z","updated":"2026-10-06T10:41:49.165Z","title":"WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Dawer Drew","product":"Sitemovr","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-41558","published":"2026-10-06T05:14:50.478Z","updated":"2026-10-06T10:41:49.297Z","title":"WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Synchro","product":"WP Migration Plugin DB & Files – WP Synchro","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-39789","published":"2026-10-06T05:14:49.764Z","updated":"2026-10-06T10:41:49.423Z","title":"WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Affiliate Pro","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-39760","published":"2026-10-06T05:14:49.003Z","updated":"2026-10-06T10:41:49.552Z","title":"WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Creative interactive media","product":"Real 3D FlipBook","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-39723","published":"2026-10-06T05:14:48.278Z","updated":"2026-10-08T16:26:23.878Z","title":"WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Green Invoice","product":"Morning for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-39599","published":"2026-10-06T05:14:47.563Z","updated":"2026-10-06T10:41:49.802Z","title":"WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wallstrdev","product":"WDS MCP Content Manager","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32582","published":"2026-10-06T05:14:46.484Z","updated":"2026-10-08T18:47:48.687Z","title":"WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iatoai","product":"IATO MCP","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-32576","published":"2026-10-06T05:14:45.697Z","updated":"2026-10-06T15:24:37.645Z","title":"WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ZWEISCHNEIDER","product":"Faktur Pro for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-105072","published":"2026-10-06T05:14:44.960Z","updated":"2026-10-06T10:41:50.181Z","title":"WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-103066","published":"2026-10-05T19:00:11.467Z","updated":"2026-10-06T10:41:50.315Z","title":"WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WP BASE","product":"WP BASE Booking","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-100506","published":"2026-10-05T19:00:11.321Z","updated":"2026-10-06T10:41:50.448Z","title":"WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Spell Check","product":"WP Spell Check","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-100511","published":"2026-10-05T19:00:11.317Z","updated":"2026-10-06T10:41:50.582Z","title":"WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Vektor Inc.","product":"VK Google Job Posting Manager","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-97257","published":"2026-10-05T19:00:11.048Z","updated":"2026-10-06T10:41:50.714Z","title":"WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PressTigers","product":"Simple Event Planner","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-93617","published":"2026-10-05T19:00:10.929Z","updated":"2026-10-06T10:41:50.839Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-103348","published":"2026-10-05T19:00:10.897Z","updated":"2026-10-06T10:41:50.968Z","title":"WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Smackcoders Inc.","product":"WP Ultimate Exporter","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-103337","published":"2026-10-05T19:00:10.084Z","updated":"2026-10-06T10:41:51.102Z","title":"WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kirillbdev","product":"WC Ukraine Shipping","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-103349","published":"2026-10-05T18:08:37.239Z","updated":"2026-10-06T10:41:51.225Z","title":"WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Rymera Web Co","product":"Product Feed PRO for WooCommerce","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-97303","published":"2026-10-05T18:08:37.120Z","updated":"2026-10-06T10:41:51.386Z","title":"WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Scratch & Win – Giveaways and Contests","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-103352","published":"2026-10-05T18:08:36.905Z","updated":"2026-10-05T18:43:01.668Z","title":"WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WP BASE","product":"WP BASE Booking","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-97283","published":"2026-10-05T18:08:36.832Z","updated":"2026-10-05T18:46:38.457Z","title":"WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-97275","published":"2026-10-05T18:08:36.781Z","updated":"2026-10-06T10:41:51.523Z","title":"WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"BuildKit – Product Builder for WooCommerce – Custom PC Builder","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-97309","published":"2026-10-05T18:08:36.517Z","updated":"2026-10-06T10:41:51.642Z","title":"WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.1,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-97070","published":"2026-10-05T18:08:36.385Z","updated":"2026-10-05T18:44:35.126Z","title":"WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.9,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-97305","published":"2026-10-05T18:08:36.362Z","updated":"2026-10-05T18:45:13.106Z","title":"WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Themeisle","product":"AI Chatbot for WordPress – Hyve Lite","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-103334","published":"2026-10-05T18:08:36.164Z","updated":"2026-10-05T18:47:24.816Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Etoile Web Design Incorporated","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-97304","published":"2026-10-05T18:08:35.952Z","updated":"2026-10-05T18:42:34.010Z","title":"WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-100515","published":"2026-10-05T18:08:35.913Z","updated":"2026-10-09T18:19:21.509Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-103085","published":"2026-10-05T18:08:35.787Z","updated":"2026-10-05T18:45:32.266Z","title":"WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-103086","published":"2026-10-05T18:08:35.529Z","updated":"2026-10-06T10:41:52.418Z","title":"WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-100509","published":"2026-10-05T18:08:35.500Z","updated":"2026-10-05T18:49:24.033Z","title":"WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-102383","published":"2026-10-05T18:08:35.452Z","updated":"2026-10-05T18:42:11.214Z","title":"WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Lookzy","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-15643","published":"2026-10-05T17:24:53.975Z","updated":"2026-10-06T10:41:52.537Z","title":"WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jose Fernandez","product":"Adsmonetizer","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-42700","published":"2026-10-05T17:13:33.229Z","updated":"2026-10-05T17:44:52.388Z","title":"WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GhozyLab","product":"Image Slider Widget","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105421","published":"2026-10-05T14:17:16.609Z","updated":"2026-10-05T15:38:34.612Z","title":"WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit) for WooCommerce","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-39783","published":"2026-10-05T11:28:18.780Z","updated":"2026-10-05T15:28:29.158Z","title":"WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-103684","published":"2026-10-05T11:26:23.170Z","updated":"2026-10-05T14:55:00.213Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-105073","published":"2026-10-05T11:22:42.540Z","updated":"2026-10-05T14:48:32.613Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-94669","published":"2026-10-05T10:49:05.171Z","updated":"2026-10-05T11:22:42.637Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-39763","published":"2026-10-05T10:23:12.204Z","updated":"2026-10-05T12:45:02.991Z","title":"WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Deepak Anand","product":"WP Dummy Content Generator","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-39721","published":"2026-10-05T09:01:20.344Z","updated":"2026-10-05T15:28:52.287Z","title":"WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-105064","published":"2026-10-05T08:59:15.782Z","updated":"2026-10-05T14:55:00.384Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-103351","published":"2026-10-05T08:58:21.432Z","updated":"2026-10-05T12:49:49.460Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-104389","published":"2026-10-05T08:57:16.886Z","updated":"2026-10-06T10:41:52.659Z","title":"WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Sirv","product":"Sirv","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-104388","published":"2026-10-05T08:56:48.249Z","updated":"2026-10-05T12:12:48.342Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-102393","published":"2026-10-05T08:55:31.033Z","updated":"2026-10-05T14:55:00.543Z","title":"WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-103079","published":"2026-10-05T08:52:59.269Z","updated":"2026-10-05T15:29:12.356Z","title":"WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-104396","published":"2026-10-05T08:51:37.187Z","updated":"2026-10-16T07:13:51.113Z","title":"WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeroen Peters","product":"Name Directory","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-102914","published":"2026-10-05T08:51:11.546Z","updated":"2026-10-05T14:55:00.789Z","title":"WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-104675","published":"2026-10-05T08:50:46.064Z","updated":"2026-10-05T12:51:51.503Z","title":"WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-103084","published":"2026-10-05T08:49:57.381Z","updated":"2026-10-05T12:56:19.984Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-104397","published":"2026-10-05T08:49:32.355Z","updated":"2026-10-05T15:29:19.729Z","title":"WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jeroen Peters","product":"Name Directory","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-105060","published":"2026-10-05T08:48:19.013Z","updated":"2026-10-05T14:55:00.913Z","title":"WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Logo Showcase","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-104673","published":"2026-10-05T08:47:44.618Z","updated":"2026-10-05T15:29:27.109Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105056","published":"2026-10-05T08:46:55.611Z","updated":"2026-10-06T10:41:52.779Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-104408","published":"2026-10-05T08:44:29.687Z","updated":"2026-10-05T14:55:01.062Z","title":"WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Groundhogg","product":"Groundhogg","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-103335","published":"2026-10-05T08:44:05.054Z","updated":"2026-10-05T12:22:29.503Z","title":"WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-105055","published":"2026-10-05T08:40:51.713Z","updated":"2026-10-05T12:25:37.241Z","title":"WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-97071","published":"2026-10-05T08:40:20.638Z","updated":"2026-10-06T10:41:52.955Z","title":"WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-105062","published":"2026-10-05T08:39:55.952Z","updated":"2026-10-05T15:29:34.053Z","title":"WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brandtoss","product":"WP Admin Audit","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-103078","published":"2026-10-05T08:39:06.483Z","updated":"2026-10-05T15:29:40.419Z","title":"WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-104407","published":"2026-10-05T08:35:02.776Z","updated":"2026-10-06T10:41:53.087Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-104386","published":"2026-10-05T08:34:19.528Z","updated":"2026-10-06T10:41:53.221Z","title":"WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels Team","product":"WP VR","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-105069","published":"2026-10-05T08:32:47.894Z","updated":"2026-10-05T12:49:38.131Z","title":"WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nikki Blight","product":"QR Redirector","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-104404","published":"2026-10-05T08:31:24.755Z","updated":"2026-10-05T13:03:22.921Z","title":"WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-105068","published":"2026-10-05T08:26:46.416Z","updated":"2026-10-05T12:56:44.259Z","title":"WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-104401","published":"2026-10-05T08:19:04.715Z","updated":"2026-10-05T12:57:37.874Z","title":"WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Memberful","product":"Memberful - Membership Plugin","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-104400","published":"2026-10-05T08:07:32.702Z","updated":"2026-10-05T14:05:02.111Z","title":"WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-104409","published":"2026-10-05T08:06:10.229Z","updated":"2026-10-08T10:23:24.752Z","title":"WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-104402","published":"2026-10-04T15:08:43.541Z","updated":"2026-10-05T13:15:54.663Z","title":"WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"farvisun","product":"Mindio Magic MCP","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97307","published":"2026-10-04T09:08:23.508Z","updated":"2026-10-05T15:31:34.786Z","title":"WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Cost Calculator Builder","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-103355","published":"2026-10-04T08:00:09.599Z","updated":"2026-10-06T10:41:53.484Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-103344","published":"2026-10-04T08:00:09.427Z","updated":"2026-10-05T13:31:23.995Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-103062","published":"2026-10-04T07:00:43.570Z","updated":"2026-10-05T15:31:49.116Z","title":"WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97276","published":"2026-10-04T07:00:43.091Z","updated":"2026-10-05T18:50:30.444Z","title":"WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-103354","published":"2026-10-04T07:00:42.870Z","updated":"2026-10-05T16:22:32.586Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-96451","published":"2026-10-03T15:08:13.855Z","updated":"2026-10-05T14:55:02.194Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-103342","published":"2026-10-03T14:00:11.382Z","updated":"2026-10-03T15:12:23.526Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-103065","published":"2026-10-03T14:00:11.348Z","updated":"2026-10-09T14:15:55.689Z","title":"WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":8.2,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-39718","published":"2026-10-02T19:16:31.625Z","updated":"2026-10-02T20:13:21.126Z","title":"WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Webriti","product":"Wallstreet","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39717","published":"2026-10-02T14:49:50.614Z","updated":"2026-10-09T11:33:22.679Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-39601","published":"2026-10-02T14:49:13.832Z","updated":"2026-10-05T07:01:17.773Z","title":"WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"WPdevelop","product":"Booking Calendar","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-39600","published":"2026-10-02T14:47:33.805Z","updated":"2026-10-07T16:37:01.379Z","title":"WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Mehul Gohil","product":"Aculect AI Companion","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39444","published":"2026-10-02T14:46:08.063Z","updated":"2026-10-02T16:48:56.046Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-39439","published":"2026-10-02T14:43:15.849Z","updated":"2026-10-02T15:36:35.417Z","title":"WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kiera Howe","product":"WebSamurai","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-32585","published":"2026-10-02T14:42:08.710Z","updated":"2026-10-03T15:12:23.899Z","title":"WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"airano","product":"Airano MCP Bridge","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-32584","published":"2026-10-02T14:41:03.346Z","updated":"2026-10-02T15:07:45.249Z","title":"WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Chiranjit Hazarika","product":"Smart One Click Setup – Complete Demo Import &amp; Export","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-102797","published":"2026-10-02T12:39:34.767Z","updated":"2026-10-02T13:57:00.976Z","title":"WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"ThemeREX Group","product":"ThemeREX Addons","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-102798","published":"2026-10-02T12:38:28.411Z","updated":"2026-10-02T13:29:59.525Z","title":"WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeREX Group","product":"ThemeREX Addons","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-104403","published":"2026-10-02T09:55:28.219Z","updated":"2026-10-03T15:12:24.142Z","title":"WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-94180","published":"2026-10-02T09:39:20.551Z","updated":"2026-10-02T17:52:42.348Z","title":"WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Monetizemore","product":"Advanced Ads","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-94405","published":"2026-10-02T09:31:18.985Z","updated":"2026-10-02T11:30:53.569Z","title":"WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-97280","published":"2026-10-01T14:52:03.158Z","updated":"2026-10-01T15:57:23.782Z","title":"WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Review Schema","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-103347","published":"2026-10-01T14:34:07.750Z","updated":"2026-10-01T15:58:15.849Z","title":"WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"hcaptcha","product":"hCaptcha for WP","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-103068","published":"2026-10-01T14:34:07.010Z","updated":"2026-10-01T16:19:55.947Z","title":"WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ByteCore Stack","product":"ByteCoreStack &#8211; MCP Connector for AI Tools","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-102378","published":"2026-10-01T14:34:06.250Z","updated":"2026-10-01T14:57:37.004Z","title":"WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Parallax Section block","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-100517","published":"2026-10-01T14:34:05.498Z","updated":"2026-10-30T20:07:13.094Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-100514","published":"2026-10-01T14:34:04.730Z","updated":"2026-10-01T15:59:33.462Z","title":"WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Pete Nelson","product":"REST API Log","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-97297","published":"2026-10-01T14:34:03.987Z","updated":"2026-10-01T16:21:10.765Z","title":"WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Gratisfaction","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-97284","published":"2026-10-01T14:34:03.248Z","updated":"2026-10-01T14:58:31.778Z","title":"WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Icegram","product":"Icegram","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-97281","published":"2026-10-01T14:34:02.504Z","updated":"2026-10-01T15:22:23.232Z","title":"WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-97277","published":"2026-10-01T14:34:01.020Z","updated":"2026-10-01T16:01:47.829Z","title":"WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Social Boost","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-97273","published":"2026-10-01T14:34:00.261Z","updated":"2026-10-03T15:12:24.277Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97269","published":"2026-10-01T14:33:59.507Z","updated":"2026-10-01T15:00:07.930Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-97268","published":"2026-10-01T14:33:58.737Z","updated":"2026-10-01T15:22:50.151Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97260","published":"2026-10-01T14:33:57.980Z","updated":"2026-10-01T16:02:40.819Z","title":"WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maxfoundry","product":"MaxGalleria","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97258","published":"2026-10-01T14:33:57.214Z","updated":"2026-10-03T15:12:24.403Z","title":"WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aruba.it","product":"Aruba Migration Tool","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-97251","published":"2026-10-01T14:33:56.425Z","updated":"2026-10-01T15:02:09.768Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-95588","published":"2026-10-01T14:33:55.650Z","updated":"2026-10-01T15:23:18.110Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-94390","published":"2026-10-01T14:33:54.882Z","updated":"2026-10-01T16:03:56.330Z","title":"WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Dotstore","product":"Hide Shipping Method For WooCommerce","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-62073","published":"2026-10-01T14:33:54.117Z","updated":"2026-10-03T15:12:24.535Z","title":"WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-62071","published":"2026-10-01T14:33:53.363Z","updated":"2026-10-01T15:06:25.257Z","title":"WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"nickboss","product":"WordPress File Upload","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-103752","published":"2026-10-01T14:33:52.557Z","updated":"2026-10-01T15:23:37.279Z","title":"WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Paul Ryan","product":"Authorizer","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-62058","published":"2026-10-01T12:40:18.396Z","updated":"2026-10-01T13:38:59.450Z","title":"WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"CF7 Apps","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-62059","published":"2026-10-01T12:39:49.807Z","updated":"2026-10-01T13:57:56.421Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-62060","published":"2026-10-01T12:39:21.338Z","updated":"2026-10-01T13:12:51.056Z","title":"WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"captivateaudio","product":"Captivate Sync","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-62061","published":"2026-10-01T12:38:50.904Z","updated":"2026-10-01T13:07:12.654Z","title":"WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-62063","published":"2026-10-01T12:38:26.109Z","updated":"2026-10-01T13:17:34.846Z","title":"WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-102394","published":"2026-10-01T12:35:39.808Z","updated":"2026-10-01T13:10:48.460Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-103339","published":"2026-10-01T12:34:57.157Z","updated":"2026-10-01T13:12:11.502Z","title":"WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-102379","published":"2026-10-01T12:34:14.535Z","updated":"2026-10-02T12:21:28.191Z","title":"WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"BuildKit – Product Builder for WooCommerce – Custom PC Builder","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-103063","published":"2026-10-01T12:33:43.897Z","updated":"2026-10-01T13:17:59.844Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-103345","published":"2026-10-01T12:33:16.274Z","updated":"2026-10-05T06:34:05.575Z","title":"WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-103064","published":"2026-10-01T12:32:30.325Z","updated":"2026-10-01T13:52:30.520Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-102390","published":"2026-10-01T12:31:32.747Z","updated":"2026-10-01T13:18:20.919Z","title":"WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"AFFI – Affiliate Marketing for WooCommerce","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-102382","published":"2026-10-01T12:31:11.263Z","updated":"2026-10-01T13:55:29.926Z","title":"WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-102381","published":"2026-10-01T12:28:05.598Z","updated":"2026-10-01T13:40:01.350Z","title":"WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-103343","published":"2026-10-01T12:27:40.996Z","updated":"2026-10-01T13:18:56.897Z","title":"WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-103341","published":"2026-10-01T12:26:42.885Z","updated":"2026-10-01T13:54:13.692Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-103340","published":"2026-10-01T12:26:12.165Z","updated":"2026-10-01T16:28:07.573Z","title":"WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-103338","published":"2026-10-01T12:24:10.898Z","updated":"2026-10-01T13:18:39.859Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-103067","published":"2026-10-01T12:18:20.988Z","updated":"2026-10-01T13:19:52.849Z","title":"WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8,"vendor":"Memberful","product":"Memberful - Membership Plugin","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-103336","published":"2026-10-01T11:43:56.597Z","updated":"2026-10-05T06:29:27.908Z","title":"WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Smackcoders Inc.","product":"WP Ultimate CSV Importer","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-103353","published":"2026-10-01T10:48:43.088Z","updated":"2026-10-01T16:29:37.061Z","title":"WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-103082","published":"2026-10-01T10:40:12.139Z","updated":"2026-10-01T19:20:47.386Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-102392","published":"2026-09-30T17:39:08.197Z","updated":"2026-09-30T17:59:54.701Z","title":"WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ThemeHigh","product":"Extra Product Options For WooCommerce | Custom Product Addons and Fields","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-102391","published":"2026-09-30T17:39:07.431Z","updated":"2026-09-30T17:59:54.827Z","title":"WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-102377","published":"2026-09-30T17:39:06.666Z","updated":"2026-09-30T17:59:54.957Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-102376","published":"2026-09-30T17:39:05.910Z","updated":"2026-09-30T17:59:55.112Z","title":"WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Branda","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-102375","published":"2026-09-30T17:39:05.158Z","updated":"2026-10-07T07:03:08.159Z","title":"WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Optimole","product":"Optimole","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-100512","published":"2026-09-30T17:39:04.412Z","updated":"2026-09-30T17:59:55.366Z","title":"WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hook & Filter","product":"Nested Pages","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-100510","published":"2026-09-30T17:39:03.526Z","updated":"2026-09-30T17:59:55.497Z","title":"WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97291","published":"2026-09-30T17:39:02.780Z","updated":"2026-09-30T17:59:55.640Z","title":"WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Magazine3","product":"Schema & Structured Data for WP & AMP","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-97290","published":"2026-09-30T17:39:02.029Z","updated":"2026-09-30T17:59:55.770Z","title":"WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sayontan Sinha","product":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97265","published":"2026-09-30T17:39:01.284Z","updated":"2026-09-30T17:59:55.899Z","title":"WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97256","published":"2026-09-30T17:39:00.498Z","updated":"2026-09-30T17:59:56.028Z","title":"WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Greg – SiteOrigin","product":"Page Builder by SiteOrigin","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-94171","published":"2026-09-30T17:38:59.725Z","updated":"2026-10-05T14:02:30.455Z","title":"WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-102397","published":"2026-09-30T17:38:58.949Z","updated":"2026-09-30T17:59:56.305Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-97259","published":"2026-09-30T14:10:24.653Z","updated":"2026-09-30T15:28:07.426Z","title":"WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-62084","published":"2026-09-30T14:03:36.676Z","updated":"2026-09-30T15:28:07.560Z","title":"WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Starr","product":"User Submitted Posts","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-62097","published":"2026-09-30T14:02:22.503Z","updated":"2026-09-30T15:28:07.696Z","title":"WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WPTasty","product":"Business Directory","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-102399","published":"2026-09-30T12:28:32.997Z","updated":"2026-09-30T13:37:20.578Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-102398","published":"2026-09-30T12:28:32.242Z","updated":"2026-09-30T13:17:02.812Z","title":"WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-102396","published":"2026-09-30T12:28:31.363Z","updated":"2026-09-30T13:37:20.451Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-102395","published":"2026-09-30T12:28:30.584Z","updated":"2026-09-30T13:37:20.312Z","title":"WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-102386","published":"2026-09-30T12:28:29.823Z","updated":"2026-09-30T13:37:20.049Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-102385","published":"2026-09-30T12:28:29.078Z","updated":"2026-09-30T13:37:20.188Z","title":"WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-102384","published":"2026-09-30T12:28:28.331Z","updated":"2026-09-30T13:37:19.911Z","title":"WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Supreme Modules","product":"Supreme Modules Lite","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-100513","published":"2026-09-30T12:28:27.585Z","updated":"2026-09-30T13:37:19.781Z","title":"WordPress CF7 Views &#8211; Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-100508","published":"2026-09-30T12:28:26.866Z","updated":"2026-09-30T13:37:19.654Z","title":"WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WordPress.org","product":"Two Factor","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-100507","published":"2026-09-30T12:28:26.112Z","updated":"2026-10-07T07:02:38.107Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97302","published":"2026-09-30T12:28:25.365Z","updated":"2026-09-30T13:27:16.701Z","title":"WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themeisle","product":"MPG","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-97301","published":"2026-09-30T12:28:24.611Z","updated":"2026-09-30T13:27:16.577Z","title":"WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cool Plugins","product":"Cool Formkit Lite","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97299","published":"2026-09-30T12:28:23.864Z","updated":"2026-09-30T13:27:16.449Z","title":"WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"KnitPay","product":"Razorpay Payment Links for WooCommerce","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-97298","published":"2026-09-30T12:28:23.100Z","updated":"2026-09-30T13:27:16.320Z","title":"WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons","product":"King Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97293","published":"2026-09-30T12:28:22.351Z","updated":"2026-09-30T13:27:16.193Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-97292","published":"2026-09-30T12:28:21.609Z","updated":"2026-09-30T13:27:16.062Z","title":"WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITHEMES","product":"YITH WooCommerce Tab Manager","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97289","published":"2026-09-30T12:28:20.861Z","updated":"2026-10-09T18:13:00.752Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97288","published":"2026-09-30T12:28:20.118Z","updated":"2026-09-30T13:37:19.266Z","title":"WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jayson T Cote","product":"OAuth Server","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97287","published":"2026-09-30T12:28:19.370Z","updated":"2026-10-14T23:27:10.906Z","title":"WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-97286","published":"2026-09-30T12:28:18.648Z","updated":"2026-10-02T17:45:29.119Z","title":"WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-97285","published":"2026-09-30T12:28:17.865Z","updated":"2026-09-30T13:37:18.887Z","title":"WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nexcess","product":"The Events Calendar","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97282","published":"2026-09-30T12:28:17.107Z","updated":"2026-09-30T13:37:18.756Z","title":"WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RadiusTheme","product":"Review Schema","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-97279","published":"2026-09-30T12:28:16.360Z","updated":"2026-09-30T13:37:18.630Z","title":"WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chouby","product":"Polylang","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-97274","published":"2026-09-30T12:28:15.610Z","updated":"2026-09-30T13:37:18.333Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-97272","published":"2026-09-30T12:28:14.868Z","updated":"2026-09-30T13:37:18.204Z","title":"WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Permalink Manager for WooCommerce","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97271","published":"2026-09-30T12:28:14.127Z","updated":"2026-09-30T13:37:18.077Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97270","published":"2026-09-30T12:28:13.383Z","updated":"2026-09-30T13:27:15.930Z","title":"WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Justin Sternberg","product":"CMB2","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97267","published":"2026-09-30T12:28:12.615Z","updated":"2026-09-30T13:27:15.802Z","title":"WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"miniOrange","product":"Prevent files / folders access","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-97266","published":"2026-09-30T12:28:11.854Z","updated":"2026-09-30T13:27:15.676Z","title":"WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"Virtue/Ascend/Pinnacle Toolkit","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97262","published":"2026-09-30T12:28:11.079Z","updated":"2026-09-30T13:27:15.543Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-97261","published":"2026-09-30T12:28:10.327Z","updated":"2026-09-30T13:27:08.648Z","title":"WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Notivo","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-97253","published":"2026-09-30T12:28:08.717Z","updated":"2026-09-30T13:27:08.380Z","title":"WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kreatura","product":"LayerSlider","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97250","published":"2026-09-30T12:28:07.760Z","updated":"2026-09-30T13:37:17.941Z","title":"WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97249","published":"2026-09-30T12:28:06.973Z","updated":"2026-09-30T13:27:17.094Z","title":"WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-97248","published":"2026-09-30T12:28:06.228Z","updated":"2026-09-30T13:27:16.950Z","title":"WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-97247","published":"2026-09-30T12:28:05.461Z","updated":"2026-09-30T13:27:16.830Z","title":"WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Creative Themes","product":"Blocksy Companion","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-97246","published":"2026-09-30T12:28:04.695Z","updated":"2026-10-20T13:59:39.610Z","title":"WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability","severity":"MEDIUM","score":4.9,"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-97245","published":"2026-09-30T12:28:03.954Z","updated":"2026-09-30T13:27:08.243Z","title":"WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-97244","published":"2026-09-30T12:28:03.190Z","updated":"2026-09-30T13:27:08.110Z","title":"WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-97243","published":"2026-09-30T12:28:02.395Z","updated":"2026-09-30T13:27:07.953Z","title":"WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"flexyma","product":"AllAble Connector","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-97242","published":"2026-09-30T12:28:01.650Z","updated":"2026-09-30T13:27:15.413Z","title":"WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"phuongwebo","product":"WEBO MCP","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-97241","published":"2026-09-30T12:28:00.895Z","updated":"2026-09-30T13:27:15.143Z","title":"WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"PrecisionWP","product":"BackupEase","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-97240","published":"2026-09-30T12:28:00.148Z","updated":"2026-09-30T13:27:15.282Z","title":"WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Esteban","product":"StifLi Backup Tools","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-97239","published":"2026-09-30T12:27:59.387Z","updated":"2026-09-30T13:27:15.004Z","title":"WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jose Conti","product":"MCP Content Manager Lite","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-97238","published":"2026-09-30T12:27:58.524Z","updated":"2026-09-30T13:27:14.865Z","title":"WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-97237","published":"2026-09-30T12:27:57.787Z","updated":"2026-10-22T16:52:23.467Z","title":"WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97236","published":"2026-09-30T12:27:56.815Z","updated":"2026-09-30T13:27:14.608Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-97235","published":"2026-09-30T12:27:55.821Z","updated":"2026-09-30T13:27:14.478Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-97197","published":"2026-09-30T12:27:54.798Z","updated":"2026-09-30T13:27:14.350Z","title":"WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WebToffee","product":"WordPress Backup & Migration","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-97079","published":"2026-09-30T12:27:54.052Z","updated":"2026-09-30T13:27:14.224Z","title":"WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-97078","published":"2026-09-30T12:27:53.286Z","updated":"2026-09-30T13:27:07.807Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-97077","published":"2026-09-30T12:27:52.515Z","updated":"2026-09-30T13:27:07.680Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-97074","published":"2026-09-30T12:27:51.694Z","updated":"2026-09-30T13:27:07.547Z","title":"WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Omnisend","product":"Newsletters, Email Marketing, SMS and Popups by Omnisend","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-97067","published":"2026-09-30T12:27:50.923Z","updated":"2026-09-30T13:27:07.418Z","title":"WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shane Bishop","product":"EWWW Image Optimizer","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-97066","published":"2026-09-30T12:27:49.985Z","updated":"2026-09-30T13:27:05.026Z","title":"WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-97065","published":"2026-09-30T12:27:49.261Z","updated":"2026-09-30T13:27:04.897Z","title":"WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Happyforms","product":"Happyforms","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96838","published":"2026-09-30T12:27:48.524Z","updated":"2026-09-30T13:17:04.399Z","title":"WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"YoOhw Studio","product":"Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-96837","published":"2026-09-30T12:27:47.787Z","updated":"2026-09-30T13:27:14.092Z","title":"WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-96836","published":"2026-09-30T12:27:47.052Z","updated":"2026-09-30T13:27:13.962Z","title":"WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Morteza Geransayeh","product":"Parsi Date","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-96835","published":"2026-09-30T12:27:46.298Z","updated":"2026-09-30T13:27:13.573Z","title":"WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-96834","published":"2026-09-30T12:27:45.550Z","updated":"2026-09-30T13:27:13.706Z","title":"WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-96833","published":"2026-09-30T12:27:44.788Z","updated":"2026-09-30T13:27:13.430Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-96832","published":"2026-09-30T12:27:43.538Z","updated":"2026-09-30T13:27:13.298Z","title":"WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"keywordrush","product":"Content Egg","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-96831","published":"2026-09-30T12:27:42.335Z","updated":"2026-09-30T13:27:13.155Z","title":"WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"themifyme","product":"Themify Builder","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-96830","published":"2026-09-30T12:27:41.532Z","updated":"2026-09-30T13:27:13.017Z","title":"WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-96829","published":"2026-09-30T12:27:40.717Z","updated":"2026-09-30T13:27:12.888Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-96828","published":"2026-09-30T12:27:39.866Z","updated":"2026-09-30T13:27:12.757Z","title":"WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Vidish","product":"Category Discount Woocommerce","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-96827","published":"2026-09-30T12:27:38.966Z","updated":"2026-09-30T13:17:04.260Z","title":"WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melapress","product":"Admin Notices Manager","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-96825","published":"2026-09-30T12:27:38.067Z","updated":"2026-09-30T13:17:03.968Z","title":"WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.2,"vendor":"David Anderson / Team Updraft","product":"All In One WP Security & Firewall","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-96824","published":"2026-09-30T12:27:37.224Z","updated":"2026-09-30T13:17:04.118Z","title":"WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"envato","product":"Template Kit – Import","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-96823","published":"2026-09-30T12:27:36.403Z","updated":"2026-09-30T13:27:07.293Z","title":"WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"CusRev","product":"Customer Reviews for WooCommerce","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-96822","published":"2026-09-30T12:27:35.569Z","updated":"2026-09-30T13:27:07.162Z","title":"WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Hossni Mubarak","product":"Books Gallery","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-96821","published":"2026-09-30T12:27:34.720Z","updated":"2026-09-30T13:27:07.022Z","title":"WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-96820","published":"2026-09-30T12:27:33.889Z","updated":"2026-09-30T13:27:12.633Z","title":"WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"awesomesupport","product":"Awesome Support","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-96819","published":"2026-09-30T12:27:33.090Z","updated":"2026-09-30T13:27:12.502Z","title":"WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-96818","published":"2026-09-30T12:27:32.267Z","updated":"2026-09-30T13:27:12.372Z","title":"WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"mra13 / Team Tips and Tricks HQ","product":"WP Express Checkout (Accept PayPal Payments)","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-96817","published":"2026-09-30T12:27:31.463Z","updated":"2026-09-30T13:27:12.234Z","title":"WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"MakeCommerce.net","product":"MakeCommerce for WooCommerce","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-96816","published":"2026-09-30T12:27:30.621Z","updated":"2026-09-30T13:27:12.097Z","title":"WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"vendidero","product":"Trusted Shops Easy Integration for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96815","published":"2026-09-30T12:27:29.805Z","updated":"2026-09-30T13:27:11.963Z","title":"WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"appsbd","product":"Vitepos","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-96814","published":"2026-09-30T12:27:28.946Z","updated":"2026-09-30T13:27:11.837Z","title":"WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Titan Labs","product":"WooCommerce Product Table Lite","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96450","published":"2026-09-30T12:27:28.155Z","updated":"2026-09-30T13:27:11.697Z","title":"WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pixfort","product":"pixfort Core","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-96352","published":"2026-09-30T12:27:27.335Z","updated":"2026-09-30T13:27:11.550Z","title":"WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"YITHEMES","product":"YITH WooCommerce Ajax Search","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96351","published":"2026-09-30T12:27:26.574Z","updated":"2026-09-30T13:27:11.423Z","title":"WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-96350","published":"2026-09-30T12:27:25.767Z","updated":"2026-09-30T13:27:06.899Z","title":"WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-96349","published":"2026-09-30T12:27:24.923Z","updated":"2026-09-30T13:27:06.769Z","title":"WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2026-96348","published":"2026-09-30T12:27:24.147Z","updated":"2026-09-30T13:27:06.638Z","title":"WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-96347","published":"2026-09-30T12:27:23.350Z","updated":"2026-09-30T13:27:06.513Z","title":"WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-96346","published":"2026-09-30T12:27:22.510Z","updated":"2026-09-30T13:27:06.385Z","title":"WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-96345","published":"2026-09-30T12:27:21.780Z","updated":"2026-09-30T13:27:11.293Z","title":"WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-96344","published":"2026-09-30T12:27:19.627Z","updated":"2026-09-30T13:27:11.167Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-96343","published":"2026-09-30T12:27:18.779Z","updated":"2026-09-30T13:27:11.041Z","title":"WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-96338","published":"2026-09-30T12:27:17.984Z","updated":"2026-09-30T13:27:10.891Z","title":"WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-95587","published":"2026-09-30T12:27:17.181Z","updated":"2026-09-30T13:27:10.763Z","title":"WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Hostinger","product":"Hostinger Migrator","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-95531","published":"2026-09-30T12:27:16.378Z","updated":"2026-09-30T13:27:10.632Z","title":"WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-94683","published":"2026-09-30T12:27:15.502Z","updated":"2026-09-30T13:27:10.504Z","title":"WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Justin Nealey","product":"DesignSetGo","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-94681","published":"2026-09-30T12:27:14.658Z","updated":"2026-09-30T13:27:10.239Z","title":"WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tijmen Smit","product":"WP Store Locator","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-94678","published":"2026-09-30T12:27:13.854Z","updated":"2026-09-30T13:27:10.375Z","title":"WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Mat Lipe","product":"Go Live Update Urls","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-94677","published":"2026-09-30T12:27:13.048Z","updated":"2026-09-30T13:27:09.970Z","title":"WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Nexcess","product":"Kadence WooCommerce Email Designer","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-94674","published":"2026-09-30T12:27:12.235Z","updated":"2026-09-30T13:27:06.245Z","title":"WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SweetCode","product":"Pixel Manager for WooCommerce","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-94673","published":"2026-09-30T12:27:11.419Z","updated":"2026-09-30T13:27:06.112Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-94672","published":"2026-09-30T12:27:10.606Z","updated":"2026-09-30T13:17:03.818Z","title":"WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"10up","product":"Safe SVG","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-94499","published":"2026-09-30T12:27:09.786Z","updated":"2026-09-30T13:17:03.532Z","title":"WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"wpWax","product":"FormGent","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-94389","published":"2026-09-30T12:27:08.993Z","updated":"2026-09-30T13:17:03.665Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-94178","published":"2026-09-30T12:27:08.189Z","updated":"2026-09-30T13:17:03.251Z","title":"WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.5,"vendor":"Javier Carazo","product":"Import and export users and customers","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-94177","published":"2026-09-30T12:27:07.360Z","updated":"2026-10-17T08:26:28.978Z","title":"WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-94173","published":"2026-09-30T12:27:06.473Z","updated":"2026-09-30T13:17:02.231Z","title":"WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-94123","published":"2026-09-30T12:27:05.399Z","updated":"2026-09-30T13:17:02.051Z","title":"WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"NextGEN Gallery","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-94122","published":"2026-09-30T12:27:04.523Z","updated":"2026-09-30T13:27:05.961Z","title":"WordPress Responsive Slider Gallery  plugin <= 1.5.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"A WP Life","product":"Responsive Slider Gallery","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-94121","published":"2026-09-30T12:27:03.753Z","updated":"2026-09-30T13:27:05.814Z","title":"WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"10Web Booster – Website speed optimization, Cache & Page Speed optimizer","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-94120","published":"2026-09-30T12:27:02.938Z","updated":"2026-09-30T13:27:05.684Z","title":"WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"GravityKit","product":"GravityExport Lite for Gravity Forms","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-94115","published":"2026-09-30T12:27:02.147Z","updated":"2026-09-30T13:27:05.553Z","title":"WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Fatcatapps","product":"Easy Pricing Tables","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-94082","published":"2026-09-30T12:27:01.383Z","updated":"2026-09-30T13:27:05.423Z","title":"WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Fatcatapps","product":"Quiz Cat","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-94081","published":"2026-09-30T12:27:00.402Z","updated":"2026-09-30T13:27:10.108Z","title":"WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"lukeseager","product":"WordPress Persistent Login","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-94078","published":"2026-09-30T12:26:59.634Z","updated":"2026-09-30T13:27:09.841Z","title":"WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-94077","published":"2026-09-30T12:26:58.862Z","updated":"2026-09-30T13:27:09.698Z","title":"WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"10up","product":"Safe SVG","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-94076","published":"2026-09-30T12:26:57.989Z","updated":"2026-09-30T13:27:09.558Z","title":"WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-94074","published":"2026-09-30T12:26:57.128Z","updated":"2026-09-30T13:27:09.429Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-93771","published":"2026-09-30T12:26:56.235Z","updated":"2026-09-30T13:27:09.303Z","title":"WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WPFactory","product":"Cost of Goods for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-93770","published":"2026-09-30T12:26:55.398Z","updated":"2026-09-30T13:27:09.170Z","title":"WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-93651","published":"2026-09-30T12:26:54.433Z","updated":"2026-09-30T13:27:09.037Z","title":"WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Dotstore","product":"Minimum and Maximum Quantity for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-93624","published":"2026-09-30T12:26:53.638Z","updated":"2026-09-30T13:27:08.911Z","title":"WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"codepeople","product":"Music Player for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-93621","published":"2026-09-30T12:26:52.861Z","updated":"2026-09-30T13:27:08.774Z","title":"WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-93514","published":"2026-09-30T12:26:52.122Z","updated":"2026-09-30T13:17:01.912Z","title":"WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rainafarai","product":"Notification for Telegram","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-93512","published":"2026-09-30T12:26:51.372Z","updated":"2026-09-30T13:27:05.293Z","title":"WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ilGhera","product":"JW Player for WordPress","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-62085","published":"2026-09-30T12:26:50.618Z","updated":"2026-09-30T13:17:01.772Z","title":"WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-62083","published":"2026-09-30T12:26:49.874Z","updated":"2026-09-30T13:27:05.160Z","title":"WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-62081","published":"2026-09-30T12:26:49.127Z","updated":"2026-09-30T13:17:01.642Z","title":"WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpdesk","product":"Flexible PDF Coupons","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-62080","published":"2026-09-30T12:26:48.383Z","updated":"2026-09-30T13:17:03.388Z","title":"WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leevio","product":"Happy Addons for Elementor","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-62079","published":"2026-09-30T12:26:47.617Z","updated":"2026-09-30T13:17:03.111Z","title":"WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Qode","product":"Qi Addons For Elementor","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-62078","published":"2026-09-30T12:26:46.872Z","updated":"2026-09-30T13:17:02.953Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-27371","published":"2026-09-30T12:26:46.112Z","updated":"2026-09-30T13:17:02.664Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-27085","published":"2026-09-30T12:26:45.369Z","updated":"2026-09-30T13:17:02.530Z","title":"WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability","severity":"LOW","score":2.7,"vendor":"Brainstorm Force","product":"Astra WordPress Theme","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-96342","published":"2026-09-30T11:00:18.127Z","updated":"2026-09-30T13:37:20.706Z","title":"WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Amauri.IO","product":"WPMobile.App","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-97196","published":"2026-09-30T06:55:06.819Z","updated":"2026-09-30T13:37:20.996Z","title":"WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-62062","published":"2026-09-25T06:29:47.521Z","updated":"2026-09-25T13:30:26.115Z","title":"WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-96826","published":"2026-09-23T19:28:55.531Z","updated":"2026-09-24T10:42:07.538Z","title":"WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shazzad Hossain Khan","product":"W4 Post List","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-95604","published":"2026-09-23T18:14:50.570Z","updated":"2026-09-23T18:46:50.844Z","title":"WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Tangible","product":"Loops & Logic","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-95603","published":"2026-09-23T18:14:49.838Z","updated":"2026-09-23T19:27:12.535Z","title":"WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Victor Rodriguez","product":"Reycob Product Import Export","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-95602","published":"2026-09-23T18:14:49.104Z","updated":"2026-09-23T18:46:50.982Z","title":"WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Request A Quote","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-95601","published":"2026-09-23T18:14:48.373Z","updated":"2026-09-23T18:25:50.466Z","title":"WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW Plugins","product":"Product Filter by WBW","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-95600","published":"2026-09-23T18:14:47.636Z","updated":"2026-09-23T19:42:21.963Z","title":"WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TrustedLogin","product":"TrustedLogin Connector","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-95593","published":"2026-09-23T18:14:46.892Z","updated":"2026-09-23T18:46:51.132Z","title":"WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ben Roberts","product":"Ultimeter","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-95592","published":"2026-09-23T18:14:46.168Z","updated":"2026-09-23T19:26:53.613Z","title":"WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Oleh RadiusTheme","product":"Team","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-95590","published":"2026-09-23T18:14:45.310Z","updated":"2026-09-23T18:46:51.262Z","title":"WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"tainacan","product":"Tainacan","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-95586","published":"2026-09-23T18:14:44.579Z","updated":"2026-09-23T18:34:23.855Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-95530","published":"2026-09-23T18:14:43.846Z","updated":"2026-09-23T19:42:31.544Z","title":"WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PixelYourSite","product":"PixelYourSite – Your smart PIXEL (TAG) Manager","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-95529","published":"2026-09-23T18:14:43.141Z","updated":"2026-09-23T18:46:51.417Z","title":"WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Calculated Fields Form","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-95528","published":"2026-09-23T18:14:42.372Z","updated":"2026-09-23T19:26:39.019Z","title":"WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohammed Kaludi","product":"Core Web Vitals & PageSpeed Booster","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-95527","published":"2026-09-23T18:14:41.354Z","updated":"2026-09-23T18:46:51.553Z","title":"WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Conekta Group","product":"Conekta Payment Gateway","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-95525","published":"2026-09-23T18:14:40.636Z","updated":"2026-09-23T18:36:39.143Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-95524","published":"2026-09-23T18:14:39.894Z","updated":"2026-09-23T19:42:37.920Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-95523","published":"2026-09-23T18:14:39.173Z","updated":"2026-09-23T18:46:51.704Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-95522","published":"2026-09-23T18:14:38.436Z","updated":"2026-09-23T19:26:24.994Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Syed Balkhi","product":"Easy Digital Downloads","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-95515","published":"2026-09-23T18:14:37.715Z","updated":"2026-09-23T18:46:51.847Z","title":"WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-95514","published":"2026-09-23T18:14:36.996Z","updated":"2026-09-23T18:39:02.472Z","title":"WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"netgsm","product":"Netgsm","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-95513","published":"2026-09-23T18:14:36.285Z","updated":"2026-09-23T19:42:44.139Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-94682","published":"2026-09-23T18:14:34.839Z","updated":"2026-09-23T19:26:09.370Z","title":"WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SecondLineThemes","product":"Podcast Importer SecondLine","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94680","published":"2026-09-23T18:14:34.115Z","updated":"2026-09-23T18:46:52.161Z","title":"WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"The Post Grid","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94679","published":"2026-09-23T18:14:33.387Z","updated":"2026-09-23T18:42:48.734Z","title":"WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPManageNinja","product":"Fluent Support","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-94671","published":"2026-09-23T18:14:32.684Z","updated":"2026-09-23T19:42:51.020Z","title":"WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"The Post Grid","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94500","published":"2026-09-23T18:14:31.298Z","updated":"2026-09-23T18:46:52.294Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94498","published":"2026-09-23T18:14:30.567Z","updated":"2026-09-23T19:25:53.895Z","title":"WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AppMySite","product":"AppMySite","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-94487","published":"2026-09-23T18:14:29.856Z","updated":"2026-09-23T18:46:52.418Z","title":"WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-94461","published":"2026-09-23T18:14:28.137Z","updated":"2026-09-23T18:50:46.605Z","title":"WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94457","published":"2026-09-23T18:14:27.365Z","updated":"2026-09-23T19:43:23.776Z","title":"WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.8,"vendor":"WebFactory","product":"Captcha Code","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-94391","published":"2026-09-23T18:14:26.644Z","updated":"2026-09-23T18:46:52.545Z","title":"WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rustaurius","product":"Ultimate FAQ","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94179","published":"2026-09-23T18:14:25.872Z","updated":"2026-09-23T19:25:37.658Z","title":"WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Razorpay","product":"Razorpay Payment Button","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-94176","published":"2026-09-23T18:14:25.127Z","updated":"2026-09-23T18:46:52.679Z","title":"WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-94174","published":"2026-09-23T18:14:24.410Z","updated":"2026-09-23T18:54:11.830Z","title":"WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WebFactory","product":"Email Log","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-94168","published":"2026-09-23T18:14:23.687Z","updated":"2026-09-23T19:43:29.758Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94124","published":"2026-09-23T18:14:22.961Z","updated":"2026-09-23T18:46:52.813Z","title":"WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"levelfourdevelopment","product":"WP EasyCart","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-94118","published":"2026-09-23T18:14:22.243Z","updated":"2026-09-23T19:25:21.529Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-94080","published":"2026-09-23T18:14:21.380Z","updated":"2026-09-23T18:46:52.934Z","title":"WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebWizards","product":"MarketKing","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-94079","published":"2026-09-23T18:14:20.664Z","updated":"2026-09-23T18:57:17.565Z","title":"WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-93774","published":"2026-09-23T18:14:19.956Z","updated":"2026-09-23T19:43:35.854Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-93773","published":"2026-09-23T18:14:19.241Z","updated":"2026-09-23T18:46:53.072Z","title":"WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Nick van Wobbie","product":"Mollie Forms","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-93772","published":"2026-09-23T18:14:18.502Z","updated":"2026-09-23T19:25:06.505Z","title":"WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-93623","published":"2026-09-23T18:14:17.778Z","updated":"2026-09-23T18:46:53.207Z","title":"WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jordy Meow","product":"AI Engine","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-93622","published":"2026-09-23T18:14:17.046Z","updated":"2026-09-23T18:59:56.937Z","title":"WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NicolasKulka","product":"WPS Limit Login","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-93620","published":"2026-09-23T18:14:16.298Z","updated":"2026-09-23T19:43:43.342Z","title":"WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PayPlus Tech Team","product":"PayPlus Payment Gateway","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-93618","published":"2026-09-23T18:14:15.577Z","updated":"2026-09-23T18:46:53.343Z","title":"WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetTricks","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-93529","published":"2026-09-23T18:14:14.854Z","updated":"2026-09-23T19:24:50.495Z","title":"WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bilal Naseer","product":"WSP MCP &#8211; AI Agents Connector","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-93527","published":"2026-09-23T18:14:14.113Z","updated":"2026-09-23T18:46:53.472Z","title":"WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"bdthemes","product":"Live Copy Paste for Elementor","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-93526","published":"2026-09-23T18:14:13.387Z","updated":"2026-09-23T19:08:47.786Z","title":"WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-93513","published":"2026-09-23T18:14:12.633Z","updated":"2026-09-23T19:43:49.626Z","title":"WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-94117","published":"2026-09-22T09:13:36.705Z","updated":"2026-09-22T10:15:28.375Z","title":"WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"DevItems","product":"HashBar – WordPress Notification Bar","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-93928","published":"2026-09-22T08:42:37.147Z","updated":"2026-09-22T13:08:49.964Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-93485","published":"2026-09-18T06:00:05.645Z","updated":"2026-10-17T08:25:50.124Z","title":"WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Automattic","product":"WordPress","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2026-90887","published":"2026-09-17T13:24:58.522Z","updated":"2026-09-17T19:21:22.345Z","title":"WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Inventory","product":"WP Inventory Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78528","published":"2026-09-17T13:24:57.875Z","updated":"2026-09-19T02:24:15.823Z","title":"WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BerqWP","product":"BerqWP","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-78295","published":"2026-09-17T13:24:57.232Z","updated":"2026-09-17T14:07:07.641Z","title":"WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Xagio SEO","product":"Xagio SEO","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-78294","published":"2026-09-17T13:24:56.581Z","updated":"2026-09-19T14:21:53.594Z","title":"WordPress  Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-74017","published":"2026-09-17T13:24:55.939Z","updated":"2026-09-17T14:30:41.571Z","title":"WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-74005","published":"2026-09-17T13:24:54.225Z","updated":"2026-09-17T19:21:28.548Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74002","published":"2026-09-17T13:24:53.587Z","updated":"2026-09-19T02:23:47.056Z","title":"WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-74000","published":"2026-09-17T13:24:52.941Z","updated":"2026-09-17T14:06:46.131Z","title":"WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-73999","published":"2026-09-17T13:24:52.301Z","updated":"2026-09-19T14:21:53.749Z","title":"WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Gora Tech","product":"Cooked","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-66676","published":"2026-09-17T13:24:51.602Z","updated":"2026-09-17T14:33:02.524Z","title":"WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"MatrixAddons","product":"Easy Invoice","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-66631","published":"2026-09-17T13:24:50.942Z","updated":"2026-09-17T19:21:37.254Z","title":"WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Moreconvert Team","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66630","published":"2026-09-17T13:24:50.289Z","updated":"2026-09-19T02:23:16.128Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66628","published":"2026-09-17T13:24:49.626Z","updated":"2026-09-17T14:06:13.580Z","title":"WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WP Lab","product":"WP-Lister Lite for eBay","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66626","published":"2026-09-17T13:24:48.985Z","updated":"2026-09-19T14:21:53.896Z","title":"WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Sonal S Sinha","product":"SKT Addons for Elementor","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66625","published":"2026-09-17T13:24:48.331Z","updated":"2026-09-17T15:26:01.133Z","title":"WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WCVendors","product":"WC Vendors Marketplace","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66624","published":"2026-09-17T13:24:47.681Z","updated":"2026-09-17T19:21:47.942Z","title":"WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ludwig You","product":"WPMasterToolKit","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66619","published":"2026-09-17T13:24:47.029Z","updated":"2026-09-19T02:22:48.512Z","title":"WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66618","published":"2026-09-17T13:24:46.386Z","updated":"2026-09-17T14:05:51.372Z","title":"WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Flipper Code","product":"WP Maps","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-66617","published":"2026-09-17T13:24:45.744Z","updated":"2026-09-19T14:21:54.044Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66608","published":"2026-09-17T13:24:45.051Z","updated":"2026-09-17T14:33:50.066Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-66580","published":"2026-09-17T13:24:44.347Z","updated":"2026-09-17T19:21:55.178Z","title":"WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-66579","published":"2026-09-17T13:24:43.688Z","updated":"2026-09-19T02:22:13.087Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetElements For Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66578","published":"2026-09-17T13:24:43.035Z","updated":"2026-09-17T14:05:02.237Z","title":"WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66577","published":"2026-09-17T13:24:42.357Z","updated":"2026-09-19T14:21:54.197Z","title":"WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetSearch","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66576","published":"2026-09-17T13:24:41.678Z","updated":"2026-09-17T14:39:34.318Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBlocks For Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66575","published":"2026-09-17T13:24:41.005Z","updated":"2026-09-17T19:22:10.042Z","title":"WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-66574","published":"2026-09-17T13:24:40.352Z","updated":"2026-09-19T02:21:38.543Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66573","published":"2026-09-17T13:24:39.688Z","updated":"2026-09-17T14:04:42.971Z","title":"WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetTabs","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66572","published":"2026-09-17T13:24:39.046Z","updated":"2026-09-19T14:21:54.344Z","title":"WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBlog","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66571","published":"2026-09-17T13:24:38.306Z","updated":"2026-09-17T14:41:12.773Z","title":"WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gabe Livan","product":"Asset CleanUp: Page Speed Booster","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-62108","published":"2026-09-17T13:24:37.654Z","updated":"2026-09-17T19:22:16.573Z","title":"WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-62104","published":"2026-09-17T13:24:37.003Z","updated":"2026-09-19T02:18:44.706Z","title":"WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"superweby","product":"Migratico Lite","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-62101","published":"2026-09-17T13:24:36.362Z","updated":"2026-09-17T14:04:06.181Z","title":"WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Chris Åkerfeldt Wendel","product":"EduAdmin Booking","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-90986","published":"2026-09-17T13:24:35.727Z","updated":"2026-09-17T14:42:47.713Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CODEPRESS IT Solutions LLC","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78296","published":"2026-09-17T11:05:56.771Z","updated":"2026-09-19T14:21:54.487Z","title":"WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentAuth","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-92465","published":"2026-09-16T11:29:12.124Z","updated":"2026-09-16T15:52:52.488Z","title":"WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Themeum","product":"WP Mega Menu","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-62088","published":"2026-09-11T18:26:40.927Z","updated":"2026-09-11T20:28:43.826Z","title":"WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"10up","product":"ElasticPress","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-62089","published":"2026-09-11T18:16:57.519Z","updated":"2026-09-11T20:19:10.568Z","title":"WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixar Labs","product":"Master Addons for Elementor","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-62139","published":"2026-09-11T18:12:14.315Z","updated":"2026-09-11T19:29:07.431Z","title":"WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Google","product":"Site Kit by Google","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-62138","published":"2026-09-11T18:12:13.656Z","updated":"2026-09-11T19:40:26.682Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-62137","published":"2026-09-11T18:12:13.003Z","updated":"2026-09-11T20:19:10.766Z","title":"WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John James Jacoby","product":"bbPress","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-62136","published":"2026-09-11T18:12:12.338Z","updated":"2026-09-11T20:28:51.630Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdesk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-62135","published":"2026-09-11T18:12:11.688Z","updated":"2026-09-11T20:19:10.946Z","title":"WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-62134","published":"2026-09-11T18:12:11.038Z","updated":"2026-09-11T19:29:50.563Z","title":"WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-62133","published":"2026-09-11T18:12:10.385Z","updated":"2026-09-11T19:43:11.318Z","title":"WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-62132","published":"2026-09-11T18:12:09.722Z","updated":"2026-09-11T20:19:11.115Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-62114","published":"2026-09-11T18:12:09.075Z","updated":"2026-09-11T20:28:58.557Z","title":"WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-62113","published":"2026-09-11T18:12:08.417Z","updated":"2026-09-11T20:19:11.274Z","title":"WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Anh Tran","product":"Slim SEO","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-62112","published":"2026-09-11T18:12:07.755Z","updated":"2026-09-11T19:30:36.353Z","title":"WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melograno Venture Studio","product":"Amelia","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-62111","published":"2026-09-11T18:12:07.099Z","updated":"2026-09-11T19:45:17.374Z","title":"WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-62110","published":"2026-09-11T18:12:06.441Z","updated":"2026-09-11T20:19:11.447Z","title":"WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-62109","published":"2026-09-11T18:12:05.789Z","updated":"2026-09-11T20:29:07.154Z","title":"WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"wowDevs","product":"Sky Addons for Elementor","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-62107","published":"2026-09-11T18:12:05.129Z","updated":"2026-09-11T20:19:11.606Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-62106","published":"2026-09-11T18:12:04.468Z","updated":"2026-09-11T19:31:10.351Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-62105","published":"2026-09-11T18:12:03.817Z","updated":"2026-09-11T19:46:19.109Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-62103","published":"2026-09-11T18:12:03.157Z","updated":"2026-09-11T20:19:11.777Z","title":"WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpeverest","product":"Everest Forms","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-62102","published":"2026-09-11T18:12:02.495Z","updated":"2026-09-11T20:29:14.133Z","title":"WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Gato GraphQL","product":"Gato GraphQL","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-27378","published":"2026-09-11T18:12:01.830Z","updated":"2026-09-11T19:31:40.813Z","title":"WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Deposits and Partial Payments for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-62140","published":"2026-09-11T18:12:01.178Z","updated":"2026-09-11T20:19:11.936Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-84821","published":"2026-09-10T14:23:52.549Z","updated":"2026-09-10T14:53:15.486Z","title":"WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Epsiloncool","product":"WP Fast Total Search","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-84819","published":"2026-09-10T14:23:51.889Z","updated":"2026-09-10T17:46:49.586Z","title":"WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84816","published":"2026-09-10T14:23:51.226Z","updated":"2026-09-11T20:19:12.902Z","title":"WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"WPCS","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81805","published":"2026-09-10T14:23:50.566Z","updated":"2026-09-10T15:10:00.876Z","title":"WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-81804","published":"2026-09-10T14:23:49.922Z","updated":"2026-09-10T21:00:25.193Z","title":"WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Zain Hassan","product":"ZHBackup – Backup, Restore &amp; Migration","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-81803","published":"2026-09-10T14:23:49.263Z","updated":"2026-09-10T14:53:46.827Z","title":"WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.5,"vendor":"Ateeq Rafeeq","product":"RepairBuddy","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-81801","published":"2026-09-10T14:23:48.615Z","updated":"2026-09-10T17:46:59.598Z","title":"WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability","severity":"HIGH","score":8.1,"vendor":"UDX Usability Dynamics","product":"WP-Stateless","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-81800","published":"2026-09-10T14:23:47.971Z","updated":"2026-09-11T20:19:13.077Z","title":"WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Par avisverifies","product":"Verified Reviews (Avis Vérifiés)","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-81799","published":"2026-09-10T14:23:47.342Z","updated":"2026-11-02T06:43:27.845Z","title":"WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Return Refund and Exchange For WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-81796","published":"2026-09-10T14:23:46.684Z","updated":"2026-09-21T10:58:40.731Z","title":"WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"WEN Solutions","product":"WP Travel","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-81795","published":"2026-09-10T14:23:46.022Z","updated":"2026-09-10T14:54:53.546Z","title":"WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Denis Botić","product":"Page Visits Counter &#8211; Lite","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81794","published":"2026-09-10T14:23:45.369Z","updated":"2026-09-10T17:47:08.914Z","title":"WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"mlfactory","product":"Shirt Product Designer for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-81793","published":"2026-09-10T14:23:44.728Z","updated":"2026-10-05T07:02:00.669Z","title":"WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-81791","published":"2026-09-10T14:23:44.073Z","updated":"2026-09-10T15:08:51.334Z","title":"WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-81789","published":"2026-09-10T14:23:43.376Z","updated":"2026-09-11T13:55:46.684Z","title":"WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Studio Wombat","product":"Advanced Product Fields Extended for WooCommerce","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-81788","published":"2026-09-10T14:23:42.741Z","updated":"2026-09-10T14:55:44.413Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-81787","published":"2026-09-10T14:23:42.088Z","updated":"2026-09-10T17:47:18.318Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-81786","published":"2026-09-10T14:23:41.439Z","updated":"2026-09-11T20:19:13.398Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-81785","published":"2026-09-10T14:23:40.798Z","updated":"2026-09-10T15:08:25.400Z","title":"WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themekraft","product":"BuddyForms","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-81784","published":"2026-09-10T14:23:40.119Z","updated":"2026-10-06T09:27:41.502Z","title":"WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-81783","published":"2026-09-10T14:23:39.450Z","updated":"2026-09-10T14:56:26.055Z","title":"WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"mailmunch","product":"MailMunch – Grow your Email List","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-81782","published":"2026-09-10T14:23:38.803Z","updated":"2026-09-10T17:47:27.891Z","title":"WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fahad Mahmood","product":"WP Docs","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-81275","published":"2026-09-10T14:23:38.164Z","updated":"2026-09-11T20:19:13.564Z","title":"WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-78536","published":"2026-09-10T14:23:37.516Z","updated":"2026-09-10T15:07:54.276Z","title":"WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"robokassa","product":"Robokassa payment gateway for Woocommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-66674","published":"2026-09-10T14:23:36.854Z","updated":"2026-09-10T21:00:25.882Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Elliot Sowers/ RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-66632","published":"2026-09-10T14:23:36.222Z","updated":"2026-09-10T14:57:19.987Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elliot Sowers/ RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-85310","published":"2026-09-10T14:23:35.573Z","updated":"2026-09-10T21:00:26.024Z","title":"WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-81806","published":"2026-09-08T07:26:40.367Z","updated":"2026-09-08T10:34:56.294Z","title":"WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"John Darrel","product":"Hide My WP Ghost","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-48888","published":"2026-09-08T07:25:20.910Z","updated":"2026-09-08T10:34:56.442Z","title":"WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-81781","published":"2026-09-08T07:23:38.441Z","updated":"2026-09-08T10:34:56.591Z","title":"WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Unbounce","product":"Unbounce Landing Pages","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-81790","published":"2026-09-08T07:20:46.294Z","updated":"2026-09-08T10:34:56.735Z","title":"WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Viszt Péter","product":"Csomagpontok és szállítási címkék WooCommerce-hez","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-81798","published":"2026-09-08T07:18:21.779Z","updated":"2026-09-08T10:34:56.879Z","title":"WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Easy Appointments","product":"Easy Appointments","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84818","published":"2026-09-08T07:15:59.924Z","updated":"2026-09-08T10:34:57.022Z","title":"WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"100plugins","product":"Open User Map","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84817","published":"2026-09-08T07:15:59.268Z","updated":"2026-09-08T10:34:57.166Z","title":"WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81802","published":"2026-09-08T07:15:58.621Z","updated":"2026-09-08T10:34:57.313Z","title":"WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-81792","published":"2026-09-08T07:15:57.963Z","updated":"2026-10-07T07:42:07.273Z","title":"WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"Product Catalog Enquiry for WooCommerce by MultiVendorX","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-84820","published":"2026-09-08T07:15:57.318Z","updated":"2026-09-08T10:34:57.606Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27347","published":"2026-09-04T10:49:09.887Z","updated":"2026-09-04T18:25:10.542Z","title":"WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-27086","published":"2026-09-04T09:22:57.652Z","updated":"2026-09-07T11:17:27.665Z","title":"WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xtemos","product":"WoodMart","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-27432","published":"2026-09-04T08:45:06.734Z","updated":"2026-09-04T18:14:33.316Z","title":"WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sc Internet Vivoo","product":"WP Rentals","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-57777","published":"2026-09-04T08:12:00.611Z","updated":"2026-09-04T16:36:55.172Z","title":"WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-85311","published":"2026-09-04T08:07:22.994Z","updated":"2026-09-07T11:17:27.901Z","title":"WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kings Plugins","product":"MarketKing","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-32480","published":"2026-09-04T08:02:19.141Z","updated":"2026-09-04T18:25:21.366Z","title":"WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-85304","published":"2026-09-03T16:56:12.611Z","updated":"2026-09-03T17:33:06.713Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-85309","published":"2026-09-03T16:55:16.232Z","updated":"2026-09-05T01:58:51.687Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-85308","published":"2026-09-03T16:54:38.155Z","updated":"2026-09-07T11:17:28.204Z","title":"WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-85307","published":"2026-09-03T16:53:59.187Z","updated":"2026-09-03T17:20:16.325Z","title":"WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kevin Pirnie","product":"KP Agent Ready","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-85306","published":"2026-09-03T16:53:00.347Z","updated":"2026-09-04T13:42:18.681Z","title":"WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cascadia Web Services","product":"MountDev AI MCP Connector for WordPress","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-85305","published":"2026-09-03T16:52:01.739Z","updated":"2026-09-05T01:54:03.387Z","title":"WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SEOPress","product":"SEOPress","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-85303","published":"2026-09-03T16:51:19.589Z","updated":"2026-09-03T17:33:24.213Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-85302","published":"2026-09-03T16:42:40.995Z","updated":"2026-09-07T11:17:28.344Z","title":"WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPKoi WordPress Themes","product":"WPKoi Templates for Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-84848","published":"2026-09-03T16:32:01.188Z","updated":"2026-09-04T13:42:26.012Z","title":"WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"brightvesseldev","product":"Quick Event Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84847","published":"2026-09-03T16:32:00.540Z","updated":"2026-09-05T01:53:25.178Z","title":"WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"brightvesseldev","product":"Quick Event Manager","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-84836","published":"2026-09-03T16:31:59.890Z","updated":"2026-09-03T17:33:42.493Z","title":"WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.1,"vendor":"kirillbdev","product":"WC Ukraine Shipping","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-84834","published":"2026-09-03T16:31:59.240Z","updated":"2026-09-07T11:17:28.485Z","title":"WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-84814","published":"2026-09-03T16:31:58.592Z","updated":"2026-09-03T17:25:47.898Z","title":"WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Bricksforge.","product":"Bricksforge","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-84813","published":"2026-09-03T16:31:57.948Z","updated":"2026-09-04T13:42:33.658Z","title":"WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-84812","published":"2026-09-03T16:31:57.216Z","updated":"2026-09-05T01:52:44.805Z","title":"WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84779","published":"2026-09-03T16:31:56.043Z","updated":"2026-09-03T17:34:02.104Z","title":"WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Sheikh Heera","product":"Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-84778","published":"2026-09-03T16:31:55.358Z","updated":"2026-09-07T11:17:28.626Z","title":"WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"migrateguru","product":"Migrate Guru – Site Migration &amp; Cloning","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-84777","published":"2026-09-03T16:31:54.706Z","updated":"2026-09-03T17:27:36.199Z","title":"WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability","severity":"HIGH","score":7.4,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-84776","published":"2026-09-03T16:31:54.057Z","updated":"2026-09-04T13:42:39.569Z","title":"WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"malcare","product":"MalCare Security","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-84774","published":"2026-09-03T16:31:53.401Z","updated":"2026-09-05T01:52:15.766Z","title":"WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-84773","published":"2026-09-03T16:31:52.758Z","updated":"2026-09-03T17:34:17.591Z","title":"WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.2,"vendor":"作者: Shane Bishop","product":"EWWW Image Optimizer","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-84769","published":"2026-09-03T16:31:52.055Z","updated":"2026-09-07T11:17:28.766Z","title":"WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-84768","published":"2026-09-03T16:31:51.409Z","updated":"2026-09-03T17:33:46.904Z","title":"WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"e4jvikwp","product":"VikAppointments Services Booking Calendar","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-84767","published":"2026-09-03T16:31:50.759Z","updated":"2026-09-04T13:42:48.432Z","title":"WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"BookIt","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-84766","published":"2026-09-03T16:31:50.113Z","updated":"2026-09-05T01:51:20.874Z","title":"WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-84765","published":"2026-09-03T16:31:49.456Z","updated":"2026-09-03T17:34:30.862Z","title":"WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"John Havlik","product":"Breadcrumb NavXT","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84763","published":"2026-09-03T16:31:48.809Z","updated":"2026-09-07T11:17:28.908Z","title":"WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-84762","published":"2026-09-03T16:31:48.165Z","updated":"2026-09-03T17:41:42.653Z","title":"WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-84761","published":"2026-09-03T16:31:47.490Z","updated":"2026-09-04T13:42:54.385Z","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"LiteSpeed Technologies","product":"LiteSpeed Cache","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-84758","published":"2026-09-03T16:31:46.832Z","updated":"2026-09-05T01:50:37.262Z","title":"WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-84757","published":"2026-09-03T16:31:46.180Z","updated":"2026-09-03T17:35:28.197Z","title":"WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability","severity":"HIGH","score":8.2,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-84756","published":"2026-09-03T16:31:45.530Z","updated":"2026-09-07T11:17:29.055Z","title":"WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-84755","published":"2026-09-03T16:31:44.890Z","updated":"2026-09-03T17:49:11.617Z","title":"WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-84754","published":"2026-09-03T16:31:44.152Z","updated":"2026-09-04T13:43:01.270Z","title":"WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-84753","published":"2026-09-03T16:31:43.498Z","updated":"2026-09-05T01:49:00.634Z","title":"WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-84752","published":"2026-09-03T16:31:42.851Z","updated":"2026-09-03T17:35:53.825Z","title":"WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-84238","published":"2026-09-03T16:31:42.196Z","updated":"2026-09-07T11:17:29.207Z","title":"WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"YITH","product":"YITH Request a Quote for WooCommerce Premium","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-84215","published":"2026-09-03T16:31:41.541Z","updated":"2026-09-03T17:49:47.876Z","title":"WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-81776","published":"2026-09-03T16:31:40.864Z","updated":"2026-09-04T13:43:10.968Z","title":"WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"advanpix","product":"WP QuickLaTeX","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81773","published":"2026-09-03T16:31:40.114Z","updated":"2026-09-05T01:47:25.441Z","title":"WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saturday Drive","product":"Ninja Forms File Uploads Extension","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81300","published":"2026-09-03T16:31:39.404Z","updated":"2026-09-03T17:36:50.943Z","title":"WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"silverplugins217","product":"Calculation For Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81295","published":"2026-09-03T16:31:38.086Z","updated":"2026-09-07T11:17:29.350Z","title":"WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UnderConstructionPage","product":"Under Construction","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81292","published":"2026-09-03T16:31:37.381Z","updated":"2026-09-03T17:50:49.763Z","title":"WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81282","published":"2026-09-03T16:31:36.707Z","updated":"2026-09-04T13:43:16.526Z","title":"WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Product Variations Swatches for WooCommerce","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-81281","published":"2026-09-03T16:31:36.053Z","updated":"2026-09-05T01:44:45.050Z","title":"WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"silverks","product":"Graphene","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-84849","published":"2026-09-03T16:31:35.390Z","updated":"2026-09-03T17:51:33.797Z","title":"WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"brightvesseldev","product":"Pre-Orders for WooCommerce","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-84815","published":"2026-09-03T13:37:57.078Z","updated":"2026-09-03T13:50:07.824Z","title":"WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Kriesi","product":"Enfold","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-84217","published":"2026-09-02T11:56:20.758Z","updated":"2026-09-23T08:53:29.505Z","title":"WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-84835","published":"2026-09-02T11:52:49.187Z","updated":"2026-09-23T08:50:36.357Z","title":"WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DimaFreund","product":"Rentsyst","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-66652","published":"2026-09-02T11:50:02.775Z","updated":"2026-09-02T16:00:15.350Z","title":"WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Tour","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-84780","published":"2026-09-02T11:37:37.067Z","updated":"2026-09-04T02:31:25.096Z","title":"WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGMaps","product":"WP Go Maps","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-84775","published":"2026-09-02T11:37:36.419Z","updated":"2026-09-02T12:32:33.072Z","title":"WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-84772","published":"2026-09-02T11:37:35.760Z","updated":"2026-09-03T13:46:06.893Z","title":"WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"WPMU DEV","product":"Broken Link Checker","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-84771","published":"2026-09-02T11:37:35.110Z","updated":"2026-09-02T12:45:52.518Z","title":"WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PublishPress","product":"PublishPress Permissions","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-84770","published":"2026-09-02T11:37:34.455Z","updated":"2026-09-02T16:00:21.795Z","title":"WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-84764","published":"2026-09-02T11:37:33.808Z","updated":"2026-09-04T02:30:44.429Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-84760","published":"2026-09-02T11:37:33.154Z","updated":"2026-09-02T12:33:05.545Z","title":"WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Swings","product":"Ultimate Gift Cards For WooCommerce","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-84759","published":"2026-09-02T11:37:32.506Z","updated":"2026-09-03T13:45:10.838Z","title":"WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Activity Log","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-83562","published":"2026-09-02T11:37:31.847Z","updated":"2026-09-02T13:04:21.566Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-82223","published":"2026-09-02T11:37:31.194Z","updated":"2026-09-02T16:00:29.434Z","title":"WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-81775","published":"2026-09-02T11:37:30.516Z","updated":"2026-09-04T02:30:08.130Z","title":"WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81774","published":"2026-09-02T11:37:29.866Z","updated":"2026-10-12T14:28:30.021Z","title":"WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Dotstore","product":"WooCommerce Product Attachment","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-81772","published":"2026-09-02T11:37:29.218Z","updated":"2026-09-03T13:50:56.942Z","title":"WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Saturday Drive","product":"Ninja Forms - Layout & Styles","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-81771","published":"2026-09-02T11:37:28.566Z","updated":"2026-09-02T13:07:14.632Z","title":"WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TrustedSite","product":"TrustedSite","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81770","published":"2026-09-02T11:37:27.917Z","updated":"2026-09-02T16:00:37.472Z","title":"WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"MapGeo","product":"Interactive Geo Maps","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81769","published":"2026-09-02T11:37:27.271Z","updated":"2026-09-04T02:29:32.673Z","title":"WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"Booking Hub","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-81294","published":"2026-09-02T11:37:26.607Z","updated":"2026-09-02T12:35:11.886Z","title":"WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Paul Ryan","product":"Authorizer","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-81289","published":"2026-09-02T11:37:25.950Z","updated":"2026-09-02T13:08:52.271Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81288","published":"2026-09-02T11:37:25.308Z","updated":"2026-09-02T16:00:43.097Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81286","published":"2026-09-02T11:37:24.650Z","updated":"2026-09-04T02:28:24.901Z","title":"WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-81283","published":"2026-09-02T11:37:23.998Z","updated":"2026-09-02T12:35:46.826Z","title":"WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-84781","published":"2026-09-02T11:37:23.339Z","updated":"2026-09-03T13:50:10.163Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-82883","published":"2026-09-02T06:52:38.345Z","updated":"2026-09-03T13:49:13.696Z","title":"WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Marcus","product":"Login With Ajax","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81779","published":"2026-08-31T20:42:27.262Z","updated":"2026-09-01T13:48:21.018Z","title":"WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability","severity":"CRITICAL","score":10,"vendor":"Silk Themes","product":"Newspapers X","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-81278","published":"2026-08-31T20:40:33.217Z","updated":"2026-09-01T14:58:13.959Z","title":"WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPExperts","product":"Post SMTP","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-82229","published":"2026-08-31T20:30:56.269Z","updated":"2026-09-01T14:40:29.193Z","title":"WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-82228","published":"2026-08-31T20:30:55.611Z","updated":"2026-09-01T18:08:35.434Z","title":"WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability","severity":"HIGH","score":8.1,"vendor":"SiteGround","product":"SiteGround Security","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-82226","published":"2026-08-31T20:30:54.958Z","updated":"2026-09-01T13:51:19.582Z","title":"WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-82225","published":"2026-08-31T20:30:54.290Z","updated":"2026-09-01T14:58:28.324Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability","severity":"HIGH","score":7.4,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-82224","published":"2026-08-31T20:30:53.635Z","updated":"2026-09-02T17:31:27.827Z","title":"WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-82221","published":"2026-08-31T20:30:52.985Z","updated":"2026-09-01T14:40:50.144Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81780","published":"2026-08-31T20:30:52.324Z","updated":"2026-09-01T18:11:04.583Z","title":"WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"hashthemes","product":"Hash Form","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-81778","published":"2026-08-31T20:30:51.644Z","updated":"2026-09-01T13:51:57.100Z","title":"WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"The4","product":"Kalles Addons","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-81768","published":"2026-08-31T20:30:50.989Z","updated":"2026-09-01T14:58:34.761Z","title":"WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81765","published":"2026-08-31T20:30:50.339Z","updated":"2026-09-02T17:30:08.992Z","title":"WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81764","published":"2026-08-31T20:30:49.689Z","updated":"2026-09-01T14:41:34.019Z","title":"WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Acato","product":"Email Essentials","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81763","published":"2026-08-31T20:30:49.036Z","updated":"2026-09-01T18:12:24.672Z","title":"WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ウェブ屋のさとーさん","product":"Throws SPAM Away","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-81762","published":"2026-08-31T20:30:48.385Z","updated":"2026-09-01T13:53:06.585Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-81758","published":"2026-08-31T20:30:47.725Z","updated":"2026-09-01T14:58:43.508Z","title":"WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"OwnerRez","product":"OwnerRez API","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-81756","published":"2026-08-31T20:30:47.073Z","updated":"2026-09-02T14:19:08.224Z","title":"WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Autorius E-goi","product":"Smart Marketing SMS and Newsletters Forms","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-81298","published":"2026-08-31T20:30:46.414Z","updated":"2026-09-01T14:41:57.600Z","title":"WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"varunvairavanlc","product":"LeadConnector","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81297","published":"2026-08-31T20:30:45.760Z","updated":"2026-09-01T18:13:13.242Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-81296","published":"2026-08-31T20:30:45.101Z","updated":"2026-09-01T13:54:20.076Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-81293","published":"2026-08-31T20:30:44.373Z","updated":"2026-09-01T14:58:50.742Z","title":"WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-81291","published":"2026-08-31T20:30:43.716Z","updated":"2026-09-02T14:16:01.854Z","title":"WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Uncode","product":"Uncode","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81290","published":"2026-08-31T20:30:43.061Z","updated":"2026-09-01T14:42:28.753Z","title":"WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Icegram","product":"Email Subscribers & Newsletters","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81287","published":"2026-08-31T20:30:42.386Z","updated":"2026-09-01T18:09:55.563Z","title":"WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-81280","published":"2026-08-31T20:30:41.734Z","updated":"2026-09-01T15:15:40.199Z","title":"WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UKR Solution","product":"Print Barcode Labels for your WooCommerce products/orders","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-82852","published":"2026-08-31T20:30:41.084Z","updated":"2026-09-02T14:13:37.274Z","title":"WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"MapSVG","product":"MapSVG","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-82970","published":"2026-08-31T14:43:38.358Z","updated":"2026-08-31T18:51:27.733Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-74010","published":"2026-08-31T12:07:43.112Z","updated":"2026-09-02T13:52:23.681Z","title":"WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John James Jacoby","product":"bbPress","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-82220","published":"2026-08-28T14:33:37.550Z","updated":"2026-08-28T16:04:12.622Z","title":"WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-81767","published":"2026-08-28T14:33:36.833Z","updated":"2026-08-28T16:04:28.368Z","title":"WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"yalla ya!","product":"Simple Payment","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-81761","published":"2026-08-28T14:33:36.126Z","updated":"2026-08-28T15:52:16.879Z","title":"WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-81760","published":"2026-08-28T14:33:35.404Z","updated":"2026-08-28T18:35:55.458Z","title":"WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-81759","published":"2026-08-28T14:33:34.687Z","updated":"2026-08-28T16:08:16.510Z","title":"WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-81757","published":"2026-08-28T14:33:33.960Z","updated":"2026-08-28T16:03:21.825Z","title":"WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.2,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00777,"kevAdded":null},{"id":"CVE-2026-81299","published":"2026-08-28T14:33:33.228Z","updated":"2026-08-28T16:06:39.220Z","title":"WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-81285","published":"2026-08-28T14:33:32.509Z","updated":"2026-08-28T15:52:24.225Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-81284","published":"2026-08-28T14:33:31.799Z","updated":"2026-08-28T18:35:55.627Z","title":"WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-82227","published":"2026-08-28T14:33:31.083Z","updated":"2026-08-28T16:08:35.467Z","title":"WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"WPBulky","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-82222","published":"2026-08-28T10:46:14.315Z","updated":"2026-08-28T14:50:53.520Z","title":"WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.0225,"kevAdded":null},{"id":"CVE-2026-81777","published":"2026-08-28T09:42:11.752Z","updated":"2026-08-28T15:28:16.134Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-81277","published":"2026-08-27T09:00:10.584Z","updated":"2026-08-27T14:31:08.991Z","title":"WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"Suggestion Engine for WooCommerce","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-81276","published":"2026-08-27T09:00:09.884Z","updated":"2026-08-28T18:35:56.466Z","title":"WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Kali Forms","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-81274","published":"2026-08-27T09:00:09.177Z","updated":"2026-08-27T12:31:07.802Z","title":"WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-81273","published":"2026-08-27T09:00:08.436Z","updated":"2026-08-27T15:00:53.378Z","title":"WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-81272","published":"2026-08-27T09:00:07.759Z","updated":"2026-08-27T12:16:35.326Z","title":"WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WP Manage Ninja","product":"FluentPlayer Pro","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-81271","published":"2026-08-27T09:00:07.037Z","updated":"2026-08-27T14:31:22.769Z","title":"WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-80433","published":"2026-08-27T09:00:06.310Z","updated":"2026-08-28T18:35:56.613Z","title":"WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Brainstorm Force","product":"SureFeedback Client Site","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-78293","published":"2026-08-27T09:00:05.589Z","updated":"2026-08-27T12:34:46.504Z","title":"WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78292","published":"2026-08-27T09:00:04.876Z","updated":"2026-08-27T15:01:46.688Z","title":"WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"hashthemes","product":"Hash Form","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-78289","published":"2026-08-27T09:00:04.174Z","updated":"2026-08-27T12:17:17.638Z","title":"WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LoftOcean","product":"CozyStay","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78288","published":"2026-08-27T09:00:03.442Z","updated":"2026-08-27T14:31:34.403Z","title":"WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jonathan de Jong","product":"Beautiful Taxonomy Filters","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-78286","published":"2026-08-27T09:00:02.731Z","updated":"2026-08-28T18:35:56.758Z","title":"WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"INFINITUM FORM","product":"Geo Controller","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-78285","published":"2026-08-27T09:00:02.000Z","updated":"2026-08-27T12:35:27.910Z","title":"WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LikeBtn","product":"Like Button Rating","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-78283","published":"2026-08-27T09:00:01.262Z","updated":"2026-08-27T14:57:20.125Z","title":"WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Music Player for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78281","published":"2026-08-27T09:00:00.322Z","updated":"2026-08-27T12:17:56.974Z","title":"WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"CP Media Player","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78276","published":"2026-08-27T08:59:59.412Z","updated":"2026-08-27T14:31:45.079Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-78275","published":"2026-08-27T08:59:58.666Z","updated":"2026-08-28T18:35:56.902Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-78274","published":"2026-08-27T08:59:57.951Z","updated":"2026-08-27T12:35:47.806Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-78273","published":"2026-08-27T08:59:57.217Z","updated":"2026-08-27T14:58:28.038Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-78271","published":"2026-08-27T08:59:56.487Z","updated":"2026-08-27T12:18:28.265Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Manage Ninja","product":"FluentCRM Pro","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-78261","published":"2026-08-27T08:59:55.779Z","updated":"2026-08-27T14:31:54.357Z","title":"WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Realtyna","product":"Realtyna Organic IDX plugin","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78260","published":"2026-08-27T08:59:55.061Z","updated":"2026-08-28T18:35:57.056Z","title":"WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ePayco","product":"Epayco","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-78257","published":"2026-08-27T08:59:54.300Z","updated":"2026-08-27T12:36:34.010Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-32566","published":"2026-08-27T08:59:53.588Z","updated":"2026-08-27T14:59:23.882Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ACPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-32564","published":"2026-08-27T08:59:52.862Z","updated":"2026-08-27T12:37:19.730Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ACPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-32550","published":"2026-08-27T08:59:52.137Z","updated":"2026-08-27T14:32:04.233Z","title":"WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Liquid Web, LLC","product":"Kadence Shop Kit","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-32479","published":"2026-08-27T08:59:51.431Z","updated":"2026-08-28T18:35:57.204Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CODEPRESS IT Solutions LLC","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-27330","published":"2026-08-27T08:59:50.734Z","updated":"2026-08-27T12:30:46.259Z","title":"WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability","severity":"HIGH","score":8.6,"vendor":"Weptile","product":"Mobile App for WooCommerce","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-81279","published":"2026-08-27T08:59:49.996Z","updated":"2026-08-27T13:02:36.447Z","title":"WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Murali","product":"Push Notification for Post and BuddyPress","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-78282","published":"2026-08-24T21:31:35.725Z","updated":"2026-08-25T19:05:40.876Z","title":"WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mra13","product":"Stripe Payments","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78268","published":"2026-08-24T21:31:34.955Z","updated":"2026-08-25T19:22:54.673Z","title":"WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Extend Themes","product":"Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-78267","published":"2026-08-24T21:31:34.248Z","updated":"2026-08-27T14:26:13.797Z","title":"WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-78266","published":"2026-08-24T21:31:33.520Z","updated":"2026-08-25T19:02:39.587Z","title":"WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-78265","published":"2026-08-24T21:31:32.805Z","updated":"2026-08-25T14:40:53.886Z","title":"WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Nexcess","product":"The Events Calendar","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-78264","published":"2026-08-24T21:31:32.102Z","updated":"2026-08-25T19:06:19.855Z","title":"WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Site Building with Toolset","product":"Toolset Blocks","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78263","published":"2026-08-24T21:31:31.391Z","updated":"2026-08-25T19:23:05.855Z","title":"WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78262","published":"2026-08-24T21:31:30.692Z","updated":"2026-08-27T14:25:00.255Z","title":"WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-78259","published":"2026-08-24T21:31:29.978Z","updated":"2026-08-25T19:03:02.064Z","title":"WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"WP Legal Pages","product":"WPLegalPages","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-32563","published":"2026-08-24T21:31:29.268Z","updated":"2026-08-25T14:44:09.356Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"A CPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-32561","published":"2026-08-24T21:31:28.568Z","updated":"2026-08-25T19:17:36.940Z","title":"WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"Booking Hub","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-32560","published":"2026-08-24T21:31:27.848Z","updated":"2026-08-25T19:23:15.522Z","title":"WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2026-32559","published":"2026-08-24T21:31:27.138Z","updated":"2026-08-27T14:19:57.548Z","title":"WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"tophive","product":"UltimateAI","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-32556","published":"2026-08-24T21:31:26.430Z","updated":"2026-08-25T19:03:29.234Z","title":"WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PixelYourSite Professional","product":"Boost","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-32555","published":"2026-08-24T21:31:25.718Z","updated":"2026-08-25T14:43:17.674Z","title":"WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"PixelYourSite Professional","product":"Boost","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-32554","published":"2026-08-24T21:31:25.000Z","updated":"2026-08-25T19:12:24.665Z","title":"WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW","product":"WooBeWoo Product Filter Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-27364","published":"2026-08-24T21:31:24.274Z","updated":"2026-08-25T19:23:25.508Z","title":"WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AnalogWP","product":"Style Kits","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-78284","published":"2026-08-24T21:31:23.567Z","updated":"2026-08-25T14:42:01.677Z","title":"WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-66670","published":"2026-08-24T11:54:58.853Z","updated":"2026-08-24T12:51:05.899Z","title":"WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Måne","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66650","published":"2026-08-24T11:54:58.146Z","updated":"2026-08-24T12:51:06.094Z","title":"WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Theme-Rex","product":"FreightCo","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-66648","published":"2026-08-24T11:54:57.395Z","updated":"2026-08-24T12:51:06.281Z","title":"WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"MVPThemes","product":"Jawn","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-66610","published":"2026-08-24T11:54:56.693Z","updated":"2026-08-24T12:51:06.469Z","title":"WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"thembay","product":"Urna","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66587","published":"2026-08-24T11:54:55.860Z","updated":"2026-08-24T12:51:06.656Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPCafe","product":"WP Cafe Pro","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2026-66585","published":"2026-08-24T11:54:55.162Z","updated":"2026-08-24T12:51:06.823Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPCafe","product":"WP Cafe Pro","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-32558","published":"2026-08-24T11:54:54.444Z","updated":"2026-08-24T12:51:07.003Z","title":"WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"RedefiningTheWeb","product":"Affiliate Pro - Affiliate Program for WooCommerce & WordPress","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-32551","published":"2026-08-24T11:54:53.749Z","updated":"2026-09-21T10:20:52.856Z","title":"WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"DiviNext","product":"Woo Essential","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-32478","published":"2026-08-24T11:54:52.862Z","updated":"2026-08-24T12:51:07.396Z","title":"WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"weDevs Pte. Ltd","product":"WP Project Manager Pro","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-32477","published":"2026-08-24T11:54:52.156Z","updated":"2026-08-24T12:51:07.579Z","title":"WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"RadiusTheme, LLC","product":"ShopBuilder Pro – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-32476","published":"2026-08-24T11:54:51.439Z","updated":"2026-08-24T12:51:07.774Z","title":"WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AmpleByte Pvt Limited","product":"Brave Conversion Engine (PRO)","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-32471","published":"2026-08-24T11:54:50.606Z","updated":"2026-08-24T12:51:07.961Z","title":"WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ThemeBing","product":"ProLancer Element","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-28190","published":"2026-08-24T11:54:49.905Z","updated":"2026-08-24T12:51:08.157Z","title":"WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeBing","product":"ProLancer Element","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-28171","published":"2026-08-24T11:54:49.194Z","updated":"2026-08-24T12:51:08.368Z","title":"WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"vanquish","product":"WooCommerce File Approval","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-28167","published":"2026-08-24T11:54:48.479Z","updated":"2026-10-27T14:46:39.454Z","title":"WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"WebRehab","product":"Super Forms","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-28166","published":"2026-08-24T11:54:47.762Z","updated":"2026-08-24T12:51:08.754Z","title":"WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GoodLayers","product":"Tourmaster","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28165","published":"2026-08-24T11:54:47.057Z","updated":"2026-08-24T12:51:08.931Z","title":"WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"UnitedOver, LLC","product":"Digits","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-28162","published":"2026-08-24T11:54:46.330Z","updated":"2026-08-24T12:51:09.122Z","title":"WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Franky","product":"Events Made Easy","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28153","published":"2026-08-24T11:54:45.622Z","updated":"2026-08-24T12:51:09.284Z","title":"WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Notification Master","product":"Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-28152","published":"2026-08-24T11:54:44.900Z","updated":"2026-08-24T12:51:09.441Z","title":"WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Tonda Core","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-28151","published":"2026-08-24T11:54:44.199Z","updated":"2026-08-24T12:51:09.610Z","title":"WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Tonda","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66671","published":"2026-08-24T11:54:43.488Z","updated":"2026-08-24T12:51:09.760Z","title":"WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Verdure Core","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-78290","published":"2026-08-24T11:39:41.909Z","updated":"2026-08-24T12:51:09.915Z","title":"WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"Magazine Blocks","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-78280","published":"2026-08-24T11:39:41.194Z","updated":"2026-08-24T12:51:10.074Z","title":"WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HashThemes","product":"Hash Form","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-78279","published":"2026-08-24T11:39:40.482Z","updated":"2026-08-24T12:51:10.228Z","title":"WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Support Pro","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-78278","published":"2026-08-24T11:39:39.768Z","updated":"2026-08-24T12:51:10.381Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Boards Pro","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-78277","published":"2026-08-24T11:39:39.066Z","updated":"2026-08-24T12:51:10.534Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WP ManageNinja LLC","product":"FluentCRM Pro","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-78272","published":"2026-08-24T11:39:38.361Z","updated":"2026-08-24T12:51:10.682Z","title":"WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Support Pro","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-78270","published":"2026-08-24T11:39:37.644Z","updated":"2026-08-24T12:51:10.833Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WP ManageNinja LLC","product":"FluentCRM Pro","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-78269","published":"2026-08-24T11:39:36.942Z","updated":"2026-08-24T13:01:26.354Z","title":"WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Tammersoft","product":"Shared Files","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-78258","published":"2026-08-24T11:39:36.234Z","updated":"2026-08-24T13:01:26.505Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-66623","published":"2026-08-24T11:39:35.516Z","updated":"2026-08-24T13:01:26.659Z","title":"WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Inisev","product":"Social Media & Share Icons","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66599","published":"2026-08-24T11:39:34.813Z","updated":"2026-08-24T13:01:26.816Z","title":"WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"WPComplete","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66584","published":"2026-08-24T11:39:34.110Z","updated":"2026-08-24T12:51:11.006Z","title":"WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Code for Recovery","product":"12 Step Meeting List","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-78291","published":"2026-08-24T11:39:33.406Z","updated":"2026-08-24T12:51:11.182Z","title":"WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-28164","published":"2026-08-20T12:38:06.554Z","updated":"2026-08-20T14:36:17.293Z","title":"WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"HashThemes","product":"Easy Elementor Addons","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-28163","published":"2026-08-20T12:36:33.135Z","updated":"2026-08-20T16:27:27.038Z","title":"WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"New User Approve","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-74011","published":"2026-08-20T12:32:27.873Z","updated":"2026-08-20T16:27:27.196Z","title":"WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"revmakx","product":"InfiniteWP Client","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-74020","published":"2026-08-20T12:07:27.001Z","updated":"2026-08-20T15:18:25.615Z","title":"WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Anders Norén","product":"Koji","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-74019","published":"2026-08-20T12:07:26.307Z","updated":"2026-08-24T13:01:25.744Z","title":"WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"paulepro2019","product":"EPROLO Dropshipping","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-74018","published":"2026-08-20T12:07:25.611Z","updated":"2026-08-20T14:35:42.597Z","title":"WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Warehouse Cargo","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74016","published":"2026-08-20T12:07:24.899Z","updated":"2026-08-20T18:43:11.871Z","title":"WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Smart Cleaning","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74014","published":"2026-08-20T12:07:24.174Z","updated":"2026-08-20T16:27:27.358Z","title":"WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"indithemes","product":"IT Residence","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74013","published":"2026-08-20T12:07:23.437Z","updated":"2026-08-20T15:18:31.158Z","title":"WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WordPress.com","product":"eShipper Commerce","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-74001","published":"2026-08-20T12:07:22.716Z","updated":"2026-08-20T16:27:27.512Z","title":"WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPEverest","product":"User Registration & Membership Pro","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-73998","published":"2026-08-20T12:07:22.022Z","updated":"2026-08-20T14:35:21.404Z","title":"WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-73993","published":"2026-08-20T12:07:21.318Z","updated":"2026-08-20T16:27:27.661Z","title":"WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73992","published":"2026-08-20T12:07:20.613Z","updated":"2026-08-20T16:27:27.808Z","title":"WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Jonathan Daggerhart","product":"Query Wrangler","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-73402","published":"2026-08-20T12:07:19.931Z","updated":"2026-08-20T15:18:40.359Z","title":"WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-68566","published":"2026-08-20T12:07:19.235Z","updated":"2026-08-20T16:27:27.956Z","title":"WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Repute Infosystems","product":"BookingPress Appointment Booking Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-68564","published":"2026-08-20T12:07:18.510Z","updated":"2026-08-20T14:34:48.448Z","title":"WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NotificationX","product":"NotificationX Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66682","published":"2026-08-20T12:07:17.801Z","updated":"2026-08-20T16:27:28.117Z","title":"WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tyche Softwares.","product":"Abandoned Cart Pro for WooCommerce","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-66680","published":"2026-08-20T12:07:17.098Z","updated":"2026-08-20T15:58:57.133Z","title":"WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"plainware","product":"Locatoraid Store Locator","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66677","published":"2026-08-20T12:07:16.399Z","updated":"2026-08-20T15:18:49.424Z","title":"WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.6,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-66673","published":"2026-08-20T12:07:15.672Z","updated":"2026-08-20T16:27:28.265Z","title":"WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Monkeysan","product":"Flatastic","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66672","published":"2026-08-20T12:07:14.963Z","updated":"2026-08-20T14:34:23.631Z","title":"WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Monkeysan","product":"Flatastic","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-66649","published":"2026-08-20T12:07:14.263Z","updated":"2026-08-20T16:27:28.433Z","title":"WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66647","published":"2026-08-20T12:07:13.567Z","updated":"2026-08-20T15:54:40.158Z","title":"WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"Homlisti","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-66616","published":"2026-08-20T12:07:12.870Z","updated":"2026-10-06T15:24:44.920Z","title":"WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Form Maker by 10Web","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66615","published":"2026-08-20T12:07:12.178Z","updated":"2026-08-20T16:27:28.587Z","title":"WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Eric Teubert","product":"Podlove Podcast Publisher","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66614","published":"2026-08-20T12:07:11.471Z","updated":"2026-08-20T14:33:59.957Z","title":"WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66612","published":"2026-08-20T12:07:10.767Z","updated":"2026-08-20T18:42:34.799Z","title":"WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"thembay","product":"Aora","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66611","published":"2026-08-20T12:07:10.069Z","updated":"2026-08-20T15:51:26.201Z","title":"WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Paymob","product":"Paymob for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66609","published":"2026-08-20T12:07:09.369Z","updated":"2026-08-20T15:19:03.296Z","title":"WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66607","published":"2026-08-20T12:07:08.665Z","updated":"2026-08-24T13:01:25.890Z","title":"WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Advance Product Search","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66606","published":"2026-08-20T12:07:07.969Z","updated":"2026-08-20T14:32:54.395Z","title":"WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"SmartSMTP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66605","published":"2026-08-20T12:07:07.274Z","updated":"2026-08-20T16:27:28.745Z","title":"WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"HasThemes","product":"Swatchly – WooCommerce Variation Swatches for Products","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66604","published":"2026-08-20T12:07:06.562Z","updated":"2026-08-20T16:01:18.671Z","title":"WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66601","published":"2026-08-20T12:07:05.865Z","updated":"2026-08-20T15:19:09.602Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66600","published":"2026-08-20T12:07:05.035Z","updated":"2026-08-20T16:27:28.888Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-66598","published":"2026-08-20T12:07:04.198Z","updated":"2026-08-20T14:32:12.128Z","title":"WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kingtech LLC.","product":"B2BKing Premium","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66597","published":"2026-08-20T12:07:03.495Z","updated":"2026-08-20T16:27:29.052Z","title":"WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Melograno Venture Studio","product":"wpDataTables","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66595","published":"2026-08-20T12:07:02.785Z","updated":"2026-08-20T15:45:14.902Z","title":"WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-66594","published":"2026-08-20T12:07:02.089Z","updated":"2026-08-20T15:19:16.202Z","title":"WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"lukeseager","product":"WordPress Persistent Login","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-66593","published":"2026-08-20T12:07:01.372Z","updated":"2026-08-20T16:27:29.203Z","title":"WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CleanTalk Inc","product":"Security & Malware scan by CleanTalk","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66592","published":"2026-08-20T12:07:00.502Z","updated":"2026-10-26T06:52:32.426Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66590","published":"2026-08-20T12:06:59.788Z","updated":"2026-08-20T16:27:29.351Z","title":"WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tagembed","product":"Tagembed","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66586","published":"2026-08-20T12:06:59.091Z","updated":"2026-08-20T15:44:24.366Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Themewinter","product":"WP Cafe Pro","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-66583","published":"2026-08-20T12:06:58.385Z","updated":"2026-08-20T15:19:23.111Z","title":"WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-66582","published":"2026-08-20T12:06:57.691Z","updated":"2026-08-20T16:27:29.501Z","title":"WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66581","published":"2026-08-20T12:06:56.990Z","updated":"2026-08-20T14:31:02.807Z","title":"WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28150","published":"2026-08-20T12:06:56.279Z","updated":"2026-08-20T16:27:29.655Z","title":"WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"uxper","product":"Golo Framework","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-53999","published":"2026-08-20T12:06:55.577Z","updated":"2026-08-20T15:43:51.353Z","title":"WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGoods","product":"Altair","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-15689","published":"2026-08-20T12:06:54.759Z","updated":"2026-08-20T15:19:28.954Z","title":"WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Capella","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-15688","published":"2026-08-20T12:06:54.063Z","updated":"2026-08-20T16:27:29.806Z","title":"WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThemeGoods","product":"Capella","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2025-15637","published":"2026-08-20T12:06:53.364Z","updated":"2026-08-20T14:30:35.621Z","title":"WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge Themes","product":"Shuffle","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-74021","published":"2026-08-20T12:06:52.666Z","updated":"2026-08-20T15:43:14.059Z","title":"WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Anders Norén","product":"Chaplin","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-32475","published":"2026-08-19T17:24:55.906Z","updated":"2026-08-20T18:28:10.957Z","title":"WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Elementor","product":"Elementor Pro","kev":false,"epss":0.01995,"kevAdded":null},{"id":"CVE-2026-73391","published":"2026-08-19T12:38:57.462Z","updated":"2026-08-19T14:39:09.830Z","title":"WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73390","published":"2026-08-19T12:38:56.746Z","updated":"2026-08-20T15:57:12.626Z","title":"WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-73389","published":"2026-08-19T12:38:56.047Z","updated":"2026-08-20T15:57:12.782Z","title":"WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"The4","product":"Kalles Addons","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73388","published":"2026-08-19T12:38:55.331Z","updated":"2026-08-19T19:53:03.144Z","title":"WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Nikstore Core","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73387","published":"2026-08-19T12:38:54.622Z","updated":"2026-08-19T15:34:24.261Z","title":"WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SmartDataSoft","product":"Resido","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-73386","published":"2026-08-19T12:38:53.910Z","updated":"2026-08-19T14:39:15.284Z","title":"WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"ZealousWeb","product":"Track Geolocation Of Users Using Contact Form 7","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-73385","published":"2026-08-19T12:38:53.203Z","updated":"2026-08-20T15:57:12.951Z","title":"WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Outanking Team","product":"Outranking Plugin Options","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-73384","published":"2026-08-19T12:38:52.472Z","updated":"2026-08-20T15:57:13.136Z","title":"WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"cmsMinds","product":"Pay with Contact Form 7","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-73364","published":"2026-08-19T12:38:51.770Z","updated":"2026-08-19T19:29:12.770Z","title":"WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpdesk","product":"Flexible Subscriptions","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73363","published":"2026-08-19T12:38:51.062Z","updated":"2026-08-19T15:35:25.996Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-73354","published":"2026-08-19T12:38:50.350Z","updated":"2026-08-19T14:39:20.792Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ReichertBrothers","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73347","published":"2026-08-19T12:38:49.650Z","updated":"2026-08-20T15:57:13.300Z","title":"WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemetechMount","product":"TrueBooker","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-73185","published":"2026-08-19T12:38:48.929Z","updated":"2026-08-20T15:57:13.462Z","title":"WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpo-HR","product":"NGG Smart Image Search","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73184","published":"2026-08-19T12:38:48.218Z","updated":"2026-08-19T19:36:39.221Z","title":"WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LCweb","product":"Global Gallery","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73183","published":"2026-08-19T12:38:47.503Z","updated":"2026-08-19T15:36:07.932Z","title":"WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Get Maps Marker Pro","product":"Maps Marker Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73182","published":"2026-08-19T12:38:46.814Z","updated":"2026-08-19T14:39:26.160Z","title":"WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jeff Starr","product":"BBQ Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66668","published":"2026-08-19T12:38:46.116Z","updated":"2026-08-20T15:57:13.624Z","title":"WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PeepSo","product":"Community by PeepSo","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-66613","published":"2026-08-19T12:38:45.424Z","updated":"2026-08-20T15:57:13.783Z","title":"WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-66596","published":"2026-08-19T12:38:44.706Z","updated":"2026-08-19T19:38:36.483Z","title":"WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stefano Lissa","product":"Newsletter","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61986","published":"2026-08-19T12:38:43.997Z","updated":"2026-08-19T15:37:14.491Z","title":"WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-32552","published":"2026-08-19T12:38:43.301Z","updated":"2026-08-19T14:39:31.750Z","title":"WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"YITH","product":"YITH WooCommerce Membership Premium","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-73394","published":"2026-08-19T12:38:42.578Z","updated":"2026-08-19T15:38:15.797Z","title":"WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Stitchexpress","product":"Stitch Express","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-27365","published":"2026-08-18T22:19:15.926Z","updated":"2026-08-19T19:28:14.918Z","title":"WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-66589","published":"2026-08-18T22:17:42.065Z","updated":"2026-08-21T16:19:15.553Z","title":"WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Kings Plugins","product":"B2BKing","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-66591","published":"2026-08-18T22:15:08.546Z","updated":"2026-08-21T16:19:32.960Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66602","published":"2026-08-18T22:03:24.596Z","updated":"2026-08-19T15:50:36.779Z","title":"WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"DevItems","product":"HashBar – WordPress Notification Bar","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-66603","published":"2026-08-18T22:02:00.833Z","updated":"2026-08-19T14:39:48.484Z","title":"WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Artiss","product":"Draft List","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-74015","published":"2026-08-18T14:00:52.479Z","updated":"2026-08-18T21:25:55.065Z","title":"WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"merkulove","product":"Readabler","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-74012","published":"2026-08-18T14:00:49.610Z","updated":"2026-08-20T18:20:01.309Z","title":"WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"TaxoPress","product":"TaxoPress","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-74009","published":"2026-08-18T14:00:47.602Z","updated":"2026-08-18T19:48:18.126Z","title":"WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Razorpay","product":"Razorpay for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-74008","published":"2026-08-18T14:00:46.192Z","updated":"2026-10-07T14:58:55.901Z","title":"WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Averta LTD","product":"Shortcodes and extra features for Phlox theme","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-74007","published":"2026-08-18T14:00:45.367Z","updated":"2026-08-18T15:10:51.007Z","title":"WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iberezansky","product":"3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-74006","published":"2026-08-18T14:00:44.284Z","updated":"2026-08-18T19:48:18.310Z","title":"WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Table Builder","product":"WP Table Builder","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-74004","published":"2026-08-18T14:00:43.489Z","updated":"2026-08-18T14:40:50.332Z","title":"WordPress Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpmonks","product":"Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-74003","published":"2026-08-18T14:00:42.686Z","updated":"2026-08-18T19:48:18.485Z","title":"WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rometheme","product":"RomethemeForm For Elementor","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-73997","published":"2026-08-18T14:00:41.883Z","updated":"2026-08-18T14:35:29.908Z","title":"WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"Nexcess","product":"Starter Templates by Kadence WP","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-73996","published":"2026-08-18T14:00:41.020Z","updated":"2026-08-18T15:10:57.008Z","title":"WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.8,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-73995","published":"2026-08-18T14:00:40.199Z","updated":"2026-08-18T19:48:18.671Z","title":"WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-73994","published":"2026-08-18T14:00:38.317Z","updated":"2026-08-18T14:40:32.132Z","title":"WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-73404","published":"2026-08-18T14:00:37.489Z","updated":"2026-08-18T19:48:18.853Z","title":"WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-73400","published":"2026-08-18T14:00:36.638Z","updated":"2026-08-18T14:40:51.422Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-73399","published":"2026-08-18T14:00:35.830Z","updated":"2026-08-18T15:11:03.118Z","title":"WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"flutterwave","product":"Flutterwave WooCommerce","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-73398","published":"2026-08-18T14:00:35.014Z","updated":"2026-08-18T19:48:19.040Z","title":"WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Papaki (Enartia S.A.)","product":"Piraeus Bank WooCommerce Payment Gateway","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-73397","published":"2026-08-18T14:00:33.995Z","updated":"2026-08-18T14:40:10.639Z","title":"WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73396","published":"2026-08-18T14:00:33.150Z","updated":"2026-08-18T19:48:19.224Z","title":"WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"MakeWebBetter","product":"MWB HubSpot for WooCommerce","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-73395","published":"2026-08-18T14:00:32.204Z","updated":"2026-08-18T14:41:12.982Z","title":"WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevart","product":"Booking calendar, Appointment Booking System","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-73393","published":"2026-08-18T14:00:31.391Z","updated":"2026-08-18T15:11:14.154Z","title":"WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"Subscribe2","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73383","published":"2026-08-18T14:00:29.602Z","updated":"2026-08-18T14:39:14.588Z","title":"WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WebAppick","product":"CTX Feed","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2026-73382","published":"2026-08-18T14:00:28.735Z","updated":"2026-10-02T06:16:53.717Z","title":"WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73381","published":"2026-08-18T14:00:27.906Z","updated":"2026-08-18T14:42:57.901Z","title":"WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.1,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-73380","published":"2026-08-18T14:00:27.070Z","updated":"2026-08-18T15:11:20.172Z","title":"WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73379","published":"2026-08-18T14:00:26.212Z","updated":"2026-08-18T19:48:19.778Z","title":"WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-73378","published":"2026-08-18T14:00:25.346Z","updated":"2026-08-18T14:38:51.830Z","title":"WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73377","published":"2026-08-18T14:00:24.523Z","updated":"2026-08-18T19:48:19.960Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-73376","published":"2026-08-18T14:00:23.686Z","updated":"2026-08-18T14:44:47.150Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73375","published":"2026-08-18T14:00:22.860Z","updated":"2026-08-18T15:11:25.615Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73367","published":"2026-08-18T14:00:22.050Z","updated":"2026-08-18T19:48:20.165Z","title":"WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability","severity":"HIGH","score":7.2,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-73366","published":"2026-08-18T14:00:21.209Z","updated":"2026-08-18T14:38:24.758Z","title":"WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73365","published":"2026-08-18T14:00:20.366Z","updated":"2026-08-18T21:25:57.589Z","title":"WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetAppointment","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73362","published":"2026-08-18T14:00:19.573Z","updated":"2026-08-18T14:48:46.405Z","title":"WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KaizenCoders","product":"URL Shortify","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73361","published":"2026-08-18T14:00:18.724Z","updated":"2026-08-18T15:11:31.391Z","title":"WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPZOOM","product":"Recipe Card Blocks for Gutenberg & Elementor","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73360","published":"2026-08-18T14:00:17.897Z","updated":"2026-08-18T21:25:56.345Z","title":"WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premio","product":"Chaty Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73359","published":"2026-08-18T14:00:17.072Z","updated":"2026-08-18T14:38:06.056Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-73358","published":"2026-08-18T14:00:16.166Z","updated":"2026-08-18T19:48:20.715Z","title":"WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73356","published":"2026-08-18T14:00:15.318Z","updated":"2026-08-18T14:51:00.213Z","title":"WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":8.2,"vendor":"Cloudways","product":"Breeze","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-73355","published":"2026-08-18T14:00:14.469Z","updated":"2026-08-18T15:11:36.750Z","title":"WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73352","published":"2026-08-18T14:00:13.661Z","updated":"2026-08-18T19:48:20.899Z","title":"WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-73351","published":"2026-08-18T14:00:12.783Z","updated":"2026-08-18T14:37:41.572Z","title":"WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73350","published":"2026-08-18T14:00:11.942Z","updated":"2026-08-18T19:48:21.085Z","title":"WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability","severity":"HIGH","score":8.2,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-73348","published":"2026-08-18T14:00:11.121Z","updated":"2026-08-18T14:54:51.577Z","title":"WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-73345","published":"2026-08-18T14:00:10.294Z","updated":"2026-08-18T15:11:43.790Z","title":"WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"License Manager for WooCommerce","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-73343","published":"2026-08-18T14:00:09.450Z","updated":"2026-08-18T19:48:21.270Z","title":"WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-73342","published":"2026-08-18T14:00:08.590Z","updated":"2026-08-18T14:37:12.251Z","title":"WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Magazine3","product":"WP Multilang","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73341","published":"2026-08-18T14:00:07.757Z","updated":"2026-08-18T19:48:21.449Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-73339","published":"2026-08-18T14:00:06.883Z","updated":"2026-08-18T21:25:52.497Z","title":"WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Webnus Inc.","product":"Modern Events Calendar","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73338","published":"2026-08-18T14:00:05.818Z","updated":"2026-08-18T15:11:59.072Z","title":"WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Autopay","product":"Autopay","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73190","published":"2026-08-18T14:00:04.591Z","updated":"2026-10-14T17:16:14.522Z","title":"WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"W3 Eden","product":"WPDM – Premium Packages","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-73187","published":"2026-08-18T14:00:01.763Z","updated":"2026-08-18T19:48:21.814Z","title":"WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"gingerplugins","product":"Sticky Chat Widget","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-73181","published":"2026-08-18T14:00:00.719Z","updated":"2026-08-18T21:25:50.062Z","title":"WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeComplete","product":"Extra Product Options & Add-Ons for WooCommerce","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-68568","published":"2026-08-18T13:59:59.318Z","updated":"2026-08-18T15:12:08.143Z","title":"WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-68567","published":"2026-08-18T13:59:58.296Z","updated":"2026-10-28T13:40:15.891Z","title":"WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Grids","product":"EasyTest – Simplify A/B Testing","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-68565","published":"2026-08-18T13:59:57.213Z","updated":"2026-08-18T14:28:10.031Z","title":"WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66679","published":"2026-08-18T13:59:56.075Z","updated":"2026-08-18T19:48:22.173Z","title":"WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Appointment Hour Booking","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-66667","published":"2026-08-18T13:59:55.063Z","updated":"2026-08-18T15:03:18.743Z","title":"WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDeveloper","product":"Templately","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66651","published":"2026-08-18T13:59:53.620Z","updated":"2026-10-13T06:13:44.698Z","title":"WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-66646","published":"2026-08-18T13:59:52.544Z","updated":"2026-08-18T19:48:22.350Z","title":"WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MyThemeShop","product":"WP Tab Widget","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66645","published":"2026-08-18T13:59:51.492Z","updated":"2026-08-18T14:27:51.121Z","title":"WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Table Of Contents Block","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66644","published":"2026-08-18T13:59:50.449Z","updated":"2026-08-18T19:48:22.530Z","title":"WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"93digital","product":"Typing Effect","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66643","published":"2026-08-18T13:59:49.434Z","updated":"2026-08-18T15:11:45.300Z","title":"WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wronganswersonly","product":"Wufoo Shortcode","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66641","published":"2026-08-18T13:59:48.310Z","updated":"2026-08-18T15:12:20.582Z","title":"WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66640","published":"2026-08-18T13:59:47.233Z","updated":"2026-08-18T19:48:22.715Z","title":"WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marcus (aka @msykes)","product":"Login With Ajax","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66639","published":"2026-08-18T13:59:45.983Z","updated":"2026-08-18T14:27:29.922Z","title":"WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPZOOM","product":"WPZOOM Forms – Contact Form Plugin for Gutenberg","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66638","published":"2026-08-18T13:59:44.886Z","updated":"2026-08-18T19:48:22.894Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66637","published":"2026-08-18T13:59:43.817Z","updated":"2026-08-18T15:24:33.414Z","title":"WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Alex","product":"Featured Video Plus","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66636","published":"2026-08-18T13:59:42.791Z","updated":"2026-10-07T14:58:51.805Z","title":"WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66635","published":"2026-08-18T13:59:41.813Z","updated":"2026-10-06T15:24:48.514Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.4,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-66634","published":"2026-08-18T13:59:40.889Z","updated":"2026-08-18T21:25:53.749Z","title":"WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Pantherius","product":"Modal Survey","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-66633","published":"2026-08-18T13:59:40.046Z","updated":"2026-08-18T21:25:51.292Z","title":"WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66629","published":"2026-08-18T13:59:39.209Z","updated":"2026-08-18T15:26:03.452Z","title":"WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66627","published":"2026-08-18T13:59:38.145Z","updated":"2026-09-07T23:48:11.365Z","title":"WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"EDGE22 Studios Ltd.","product":"GP Premium","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-66622","published":"2026-08-18T13:59:36.834Z","updated":"2026-08-18T19:48:23.446Z","title":"WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"averta","product":"Depicter Slider","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-66621","published":"2026-08-18T13:59:35.306Z","updated":"2026-10-05T10:45:22.510Z","title":"WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ultimate Dashboard","product":"Ultimate Dashboard Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66620","published":"2026-08-18T13:59:32.986Z","updated":"2026-08-18T19:48:23.621Z","title":"WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Derek Herman","product":"OptionTree","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-32553","published":"2026-08-18T13:59:31.882Z","updated":"2026-08-18T15:27:44.520Z","title":"WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-32549","published":"2026-08-18T13:59:30.694Z","updated":"2026-08-18T15:12:43.305Z","title":"WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Codexpert, Inc","product":"ThumbPress","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-32547","published":"2026-08-18T13:59:29.548Z","updated":"2026-08-18T19:48:23.801Z","title":"WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-32481","published":"2026-08-18T13:59:28.326Z","updated":"2026-08-18T14:21:08.222Z","title":"WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"ezoic","product":"Ezoic","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-32474","published":"2026-08-18T13:59:27.293Z","updated":"2026-08-18T19:48:23.980Z","title":"WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"wpWax","product":"Templatiq","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-32473","published":"2026-08-18T13:59:26.158Z","updated":"2026-08-18T15:28:35.106Z","title":"WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"DeKnows","product":"PDF Smart Viewer for Elementor","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-32472","published":"2026-08-18T13:59:25.220Z","updated":"2026-08-18T15:12:49.658Z","title":"WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wbolt.com","product":"Online Contact Widget","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-32470","published":"2026-08-18T13:59:24.334Z","updated":"2026-08-18T19:48:24.165Z","title":"WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-32468","published":"2026-08-18T13:59:23.182Z","updated":"2026-08-18T14:19:13.853Z","title":"WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"rayhanduitku","product":"Duitku Payment Gateway","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-32467","published":"2026-08-18T13:59:21.835Z","updated":"2026-08-18T19:48:24.345Z","title":"WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6,"vendor":"apoyl","product":"[Aotuman] Grab WeChat Articles","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-32466","published":"2026-08-18T13:59:20.788Z","updated":"2026-08-18T21:25:44.835Z","title":"WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WPExperts","product":"Gravity Forms Bookings premium","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-32465","published":"2026-08-18T13:59:14.771Z","updated":"2026-08-18T15:12:55.780Z","title":"WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-32464","published":"2026-08-18T13:59:13.815Z","updated":"2026-08-18T19:48:24.526Z","title":"WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Vladimir Prelovac","product":"Theme Test Drive","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-32463","published":"2026-08-18T13:59:12.665Z","updated":"2026-08-18T14:19:42.781Z","title":"WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Kamlesh Parmar","product":"Sync Post With Other Site","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-32444","published":"2026-08-18T13:59:11.395Z","updated":"2026-08-18T21:25:43.571Z","title":"WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Cwicly","product":"Cwicly","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-32333","published":"2026-08-18T13:59:09.867Z","updated":"2026-08-18T21:25:42.317Z","title":"WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TeconceTheme","product":"Mayosis Core","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28571","published":"2026-08-18T13:59:08.557Z","updated":"2026-08-18T15:13:01.801Z","title":"WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPPOOL","product":"FormyChat","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-28570","published":"2026-08-18T13:59:07.041Z","updated":"2026-08-18T21:25:41.022Z","title":"WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SpabRice","product":"Vavo Core","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-28569","published":"2026-08-18T13:59:05.826Z","updated":"2026-08-18T14:20:08.241Z","title":"WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SSL Zen","product":"SSL Zen","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28568","published":"2026-08-18T13:59:04.592Z","updated":"2026-08-18T19:48:25.076Z","title":"WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohamed Magdy","product":"Quill Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28567","published":"2026-08-18T13:59:03.244Z","updated":"2026-08-18T18:04:17.996Z","title":"WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Fahad Mahmood","product":"WP Sort Order","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-28192","published":"2026-08-18T13:59:02.104Z","updated":"2026-08-18T21:25:39.735Z","title":"WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Piotnet","product":"Piotnet Addons For Elementor Pro","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-28191","published":"2026-08-18T13:59:00.946Z","updated":"2026-09-01T14:41:15.534Z","title":"WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeOne","product":"The Grid","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-28154","published":"2026-08-13T14:25:55.401Z","updated":"2026-08-14T15:38:40.881Z","title":"WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"snstheme","product":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-28002","published":"2026-08-13T13:42:09.081Z","updated":"2026-08-13T15:33:53.641Z","title":"WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-73403","published":"2026-08-13T13:37:25.760Z","updated":"2026-08-13T15:33:35.336Z","title":"WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-73401","published":"2026-08-13T13:37:25.109Z","updated":"2026-08-13T15:45:36.002Z","title":"WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-73357","published":"2026-08-13T13:37:24.466Z","updated":"2026-08-13T15:33:21.755Z","title":"WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-73353","published":"2026-08-13T13:37:23.829Z","updated":"2026-08-13T15:33:08.182Z","title":"WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"revolutbusiness","product":"Revolut Gateway for WooCommerce","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-73349","published":"2026-08-13T13:37:23.200Z","updated":"2026-08-13T15:32:54.081Z","title":"WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-73346","published":"2026-08-13T13:37:22.568Z","updated":"2026-08-13T15:47:13.176Z","title":"WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Mailchimp","product":"MailChimp For WooCommerce","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-73344","published":"2026-08-13T13:37:21.936Z","updated":"2026-08-13T15:32:23.285Z","title":"WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-73340","published":"2026-08-13T13:37:21.296Z","updated":"2026-08-13T15:32:39.087Z","title":"WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66704","published":"2026-08-13T13:37:19.999Z","updated":"2026-08-13T15:47:16.363Z","title":"WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Jegstudio","product":"Gutenverse Companion","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-66700","published":"2026-08-13T13:37:19.362Z","updated":"2026-08-13T15:31:54.857Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66698","published":"2026-08-13T13:37:18.719Z","updated":"2026-08-13T15:31:41.324Z","title":"WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66697","published":"2026-08-13T13:37:18.059Z","updated":"2026-08-13T15:21:39.897Z","title":"WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Colissimo","product":"Colissimo Officiel : Méthodes de livraison pour WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66693","published":"2026-08-13T13:37:17.420Z","updated":"2026-08-13T15:47:19.753Z","title":"WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-66691","published":"2026-08-13T13:37:16.786Z","updated":"2026-08-13T15:21:26.541Z","title":"WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Nokri","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-66689","published":"2026-08-13T13:37:16.143Z","updated":"2026-08-13T15:20:59.484Z","title":"WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"AcyMailing Newsletter Team","product":"Anti Spam and list cleaner &#8211; AcyChecker","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-66687","published":"2026-08-13T13:37:15.506Z","updated":"2026-08-13T15:21:13.231Z","title":"WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"WpBookingly","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66661","published":"2026-08-13T13:37:14.866Z","updated":"2026-08-13T15:47:23.054Z","title":"WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability","severity":"HIGH","score":7.7,"vendor":"Onokazu","product":"Directories Pro","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-66660","published":"2026-08-13T13:37:14.229Z","updated":"2026-08-13T15:20:29.255Z","title":"WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Scott Paterson","product":"Contact Form 7 – PayPal & Stripe Add-on","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-66658","published":"2026-08-13T13:37:13.580Z","updated":"2026-08-13T15:20:09.307Z","title":"WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"MVPThemes","product":"Reviewer","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-66657","published":"2026-08-13T13:37:12.967Z","updated":"2026-08-13T15:20:44.619Z","title":"WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Biagiotti Core","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66656","published":"2026-08-13T13:37:12.331Z","updated":"2026-08-13T15:47:27.895Z","title":"WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Foton Core","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66655","published":"2026-08-13T13:37:11.692Z","updated":"2026-08-13T15:19:36.757Z","title":"WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"multiparcels","product":"MultiParcels Shipping For WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66654","published":"2026-08-13T13:37:11.048Z","updated":"2026-08-13T15:19:50.154Z","title":"WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6,"vendor":"TangibleWP","product":"Vehica Core","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-66653","published":"2026-08-13T13:37:10.397Z","updated":"2026-08-13T15:31:27.425Z","title":"WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Barista","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66478","published":"2026-08-13T13:37:09.733Z","updated":"2026-08-13T15:47:31.186Z","title":"WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66472","published":"2026-08-13T13:37:09.069Z","updated":"2026-08-13T15:31:12.733Z","title":"WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66471","published":"2026-08-13T13:37:08.421Z","updated":"2026-08-13T15:30:45.164Z","title":"WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Accordion","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66469","published":"2026-08-13T13:37:07.274Z","updated":"2026-08-13T15:30:59.316Z","title":"WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Afonso Matos","product":"Arvow AI SEO Writer","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66468","published":"2026-08-13T13:37:06.613Z","updated":"2026-08-13T15:47:34.247Z","title":"WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"powerfulwp","product":"Local Delivery Drivers for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66467","published":"2026-08-13T13:37:05.957Z","updated":"2026-08-13T15:30:31.805Z","title":"WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPManageNinja","product":"FluentCommunity","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66466","published":"2026-08-13T13:37:05.302Z","updated":"2026-08-13T15:30:01.799Z","title":"WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"weDevs","product":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66465","published":"2026-08-13T13:37:04.631Z","updated":"2026-08-13T15:30:16.995Z","title":"WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AgniHD","product":"Cartify","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-66464","published":"2026-08-13T13:37:03.988Z","updated":"2026-08-13T15:47:37.888Z","title":"WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Toast Plugins","product":"Internal Link Optimiser","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-66463","published":"2026-08-13T13:37:03.342Z","updated":"2026-08-13T15:29:32.291Z","title":"WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Hassan Fakih","product":"iCARRY","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-66462","published":"2026-08-13T13:37:02.702Z","updated":"2026-08-13T15:29:47.048Z","title":"WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BookingWP","product":"WooCommerce Appointments","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-66461","published":"2026-08-13T13:37:02.062Z","updated":"2026-08-13T15:29:18.027Z","title":"WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"smepay","product":"SMEPay: UPI Gateway for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66460","published":"2026-08-13T13:37:01.431Z","updated":"2026-08-13T15:47:41.681Z","title":"WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AfterShip & Automizely","product":"AfterShip Tracking","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66459","published":"2026-08-13T13:37:00.782Z","updated":"2026-08-13T15:28:49.306Z","title":"WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Space Codes","product":"AI for SEO","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-66458","published":"2026-08-13T13:37:00.133Z","updated":"2026-08-13T15:29:04.079Z","title":"WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThimPress","product":"RealPress","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66456","published":"2026-08-13T13:36:59.479Z","updated":"2026-08-13T15:28:34.023Z","title":"WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bestwebsoft","product":"Profile Extra Fields by BestWebSoft","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66455","published":"2026-08-13T13:36:58.835Z","updated":"2026-08-13T15:47:46.427Z","title":"WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6,"vendor":"rockiger","product":"ReactPress","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-66454","published":"2026-08-13T13:36:58.195Z","updated":"2026-08-13T15:28:17.516Z","title":"WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Maruti Mohanty","product":"WP Social Avatar","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-66453","published":"2026-08-13T13:36:57.556Z","updated":"2026-08-13T15:28:01.477Z","title":"WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-66450","published":"2026-08-13T13:36:56.917Z","updated":"2026-08-13T15:27:45.822Z","title":"WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66449","published":"2026-08-13T13:36:56.276Z","updated":"2026-08-13T15:47:51.925Z","title":"WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66446","published":"2026-08-13T13:36:55.631Z","updated":"2026-08-13T15:27:30.653Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66444","published":"2026-08-13T13:36:54.994Z","updated":"2026-08-13T15:27:15.486Z","title":"WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kendysond","product":"Payment Forms for Paystack","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-66443","published":"2026-08-13T13:36:54.357Z","updated":"2026-08-13T15:26:46.847Z","title":"WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Pete Nelson","product":"REST API Log","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-66441","published":"2026-08-13T13:36:53.716Z","updated":"2026-08-13T15:47:56.330Z","title":"WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-66436","published":"2026-08-13T13:36:53.079Z","updated":"2026-08-13T15:27:01.129Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66432","published":"2026-08-13T13:36:52.427Z","updated":"2026-08-13T15:19:23.383Z","title":"WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-66431","published":"2026-08-13T13:36:51.787Z","updated":"2026-08-13T15:16:42.357Z","title":"WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WoompaLoompa","product":"Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66430","published":"2026-08-13T13:36:51.135Z","updated":"2026-08-13T15:48:00.930Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CODEPRESS","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-66429","published":"2026-08-13T13:36:50.491Z","updated":"2026-08-13T15:16:13.812Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CODEPRESS","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66426","published":"2026-08-13T13:36:49.849Z","updated":"2026-08-13T15:16:27.605Z","title":"WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lester Chan","product":"WP-Stats","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66424","published":"2026-08-13T13:36:49.196Z","updated":"2026-08-13T15:15:43.691Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-65582","published":"2026-08-13T13:36:48.550Z","updated":"2026-08-13T15:48:05.979Z","title":"WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.7,"vendor":"LiquidThemes","product":"AI Hub","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-65580","published":"2026-08-13T13:36:47.921Z","updated":"2026-08-13T15:15:58.501Z","title":"WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bracketweb","product":"Agrion","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61984","published":"2026-08-13T13:36:47.269Z","updated":"2026-08-13T15:14:58.173Z","title":"WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Amauri","product":"WPMobile.App","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-61980","published":"2026-08-13T13:36:46.624Z","updated":"2026-08-13T15:15:28.274Z","title":"WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Daan.dev","product":"OMGF Pro","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-61979","published":"2026-08-13T13:36:45.984Z","updated":"2026-08-13T15:48:09.599Z","title":"WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2026-61978","published":"2026-08-13T13:36:45.342Z","updated":"2026-08-13T15:15:14.927Z","title":"WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webhosting4ugr","product":"Secure Card Gateway for ePay Paycenter (Piraeus Bank)","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-61974","published":"2026-08-13T13:36:44.693Z","updated":"2026-08-13T15:14:41.657Z","title":"WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61969","published":"2026-08-13T13:36:44.056Z","updated":"2026-08-13T15:18:53.854Z","title":"WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-61967","published":"2026-08-13T13:36:43.416Z","updated":"2026-08-13T15:26:31.351Z","title":"WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-61966","published":"2026-08-13T13:36:42.774Z","updated":"2026-08-13T15:26:17.531Z","title":"WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-61965","published":"2026-08-13T13:36:42.137Z","updated":"2026-08-13T15:25:50.432Z","title":"WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ahmadgb","product":"GeekyBot","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61962","published":"2026-08-13T13:36:41.487Z","updated":"2026-08-13T15:26:03.760Z","title":"WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":10,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2026-61960","published":"2026-08-13T13:36:40.839Z","updated":"2026-08-13T15:48:12.794Z","title":"WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28189","published":"2026-08-13T13:36:40.207Z","updated":"2026-08-13T15:25:23.043Z","title":"WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"Roland Barker","product":"Participants Database","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-28188","published":"2026-08-13T13:36:39.551Z","updated":"2026-08-13T15:25:36.506Z","title":"WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"themefic","product":"Hydra Booking","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-28187","published":"2026-08-13T13:36:38.921Z","updated":"2026-08-13T15:25:09.378Z","title":"WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"echoplugins","product":"Knowledge Base for Documentation, FAQs with AI Assistance","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28186","published":"2026-08-13T13:36:38.282Z","updated":"2026-08-13T15:48:16.393Z","title":"WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"themefic","product":"Travelfic Toolkit","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-28185","published":"2026-08-13T13:36:37.635Z","updated":"2026-08-13T15:24:39.735Z","title":"WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rtCamp","product":"Log in with Google","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-28182","published":"2026-08-13T13:36:36.350Z","updated":"2026-08-13T15:22:55.730Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-28181","published":"2026-08-13T13:36:35.708Z","updated":"2026-08-13T15:48:20.320Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-28176","published":"2026-08-13T13:36:35.072Z","updated":"2026-08-13T15:19:08.760Z","title":"WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-28175","published":"2026-08-13T13:36:34.433Z","updated":"2026-08-13T15:18:23.966Z","title":"WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wp-buy","product":"Visitors Traffic Real Time Statistics","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28174","published":"2026-08-13T13:36:33.789Z","updated":"2026-08-13T15:18:37.853Z","title":"WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-28173","published":"2026-08-13T13:36:33.153Z","updated":"2026-08-13T15:48:23.293Z","title":"WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-28170","published":"2026-08-13T13:36:32.516Z","updated":"2026-08-13T15:18:10.484Z","title":"WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"1meril","product":"Blog Floating Button","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28168","published":"2026-08-13T13:36:31.879Z","updated":"2026-08-13T15:17:55.990Z","title":"WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-28161","published":"2026-08-13T13:36:31.238Z","updated":"2026-08-13T15:17:25.499Z","title":"WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Aonetheme","product":"Service Finder Booking","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-28159","published":"2026-08-13T13:36:30.596Z","updated":"2026-08-13T15:48:27.905Z","title":"WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aonetheme","product":"Service Finder Booking","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-28158","published":"2026-08-13T13:36:29.953Z","updated":"2026-08-13T15:17:41.003Z","title":"WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28157","published":"2026-08-13T13:36:29.313Z","updated":"2026-08-13T15:23:10.611Z","title":"WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-28156","published":"2026-08-13T13:36:28.665Z","updated":"2026-08-13T15:23:59.092Z","title":"WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-28155","published":"2026-08-13T13:36:28.021Z","updated":"2026-08-13T15:48:34.121Z","title":"WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-28149","published":"2026-08-13T13:36:27.374Z","updated":"2026-08-13T15:23:45.729Z","title":"WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-28148","published":"2026-08-13T13:36:26.722Z","updated":"2026-08-13T15:24:12.774Z","title":"WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-28142","published":"2026-08-13T13:36:26.081Z","updated":"2026-08-13T15:23:29.723Z","title":"WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shamalli","product":"Web Directory Free","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-28008","published":"2026-08-13T13:36:25.434Z","updated":"2026-08-13T15:24:26.180Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-28004","published":"2026-08-13T13:36:24.786Z","updated":"2026-08-13T15:22:41.117Z","title":"WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28003","published":"2026-08-13T13:36:24.132Z","updated":"2026-08-13T15:22:11.649Z","title":"WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"yonifre","product":"Maspik – Spam blacklist","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28001","published":"2026-08-13T13:36:22.881Z","updated":"2026-08-13T15:48:37.247Z","title":"WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPDirectoryKit","product":"WP Directory Kit","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-27999","published":"2026-08-13T13:36:22.230Z","updated":"2026-08-13T15:21:55.751Z","title":"WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themefic","product":"Tourfic","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-27544","published":"2026-08-13T13:36:21.589Z","updated":"2026-08-13T15:22:25.666Z","title":"WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-27543","published":"2026-08-13T13:36:20.946Z","updated":"2026-08-13T15:16:56.080Z","title":"WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"FluxBuilder","product":"MStore API","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-27539","published":"2026-08-13T13:36:20.297Z","updated":"2026-08-13T15:48:40.879Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27538","published":"2026-08-13T13:36:19.648Z","updated":"2026-08-13T15:17:11.006Z","title":"WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"WPDirectoryKit","product":"WP Directory Kit","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-27537","published":"2026-08-13T13:36:19.014Z","updated":"2026-08-13T15:14:28.269Z","title":"WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-27536","published":"2026-08-13T13:36:18.376Z","updated":"2026-08-13T15:14:14.614Z","title":"WordPress MailChimp Subscribe Forms  plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginOps","product":"MailChimp Subscribe Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27535","published":"2026-08-13T13:36:17.727Z","updated":"2026-08-13T15:48:48.703Z","title":"WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"solacewp","product":"Solace Extra","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-27380","published":"2026-08-13T13:36:17.082Z","updated":"2026-08-13T15:13:43.676Z","title":"WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"magepeopleteam","product":"Car Rental Manager","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-27345","published":"2026-08-13T13:36:16.436Z","updated":"2026-08-13T15:13:59.416Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"magepeopleteam","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66659","published":"2026-08-12T06:01:41.295Z","updated":"2026-08-12T16:57:13.035Z","title":"WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Essekia","product":"Tablesome Table","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66642","published":"2026-08-10T10:07:24.916Z","updated":"2026-08-10T11:30:44.610Z","title":"WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Umbrella","product":"WP Umbrella","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-66711","published":"2026-08-06T14:28:11.634Z","updated":"2026-08-06T19:06:24.985Z","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Amir Helzer","product":"WooCommerce Multilingual & Multicurrency","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66710","published":"2026-08-06T14:28:10.941Z","updated":"2026-08-06T15:03:38.106Z","title":"WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"E2Pdf","product":"e2pdf","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-66709","published":"2026-08-06T14:28:10.259Z","updated":"2026-08-06T15:35:08.494Z","title":"WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"WebAppick","product":"CTX Feed","kev":false,"epss":0.00822,"kevAdded":null},{"id":"CVE-2026-66708","published":"2026-08-06T14:28:09.586Z","updated":"2026-08-06T16:08:39.359Z","title":"WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"BoldGrid","product":"Total Upkeep","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-66707","published":"2026-08-06T14:28:08.911Z","updated":"2026-08-08T02:01:19.860Z","title":"WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Facebook","product":"Facebook for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66706","published":"2026-08-06T14:28:08.229Z","updated":"2026-08-06T19:20:27.333Z","title":"WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Mark Jaquith","product":"Subscribe to Comments","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-66705","published":"2026-08-06T14:28:07.562Z","updated":"2026-08-06T15:04:00.807Z","title":"WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Facebook","product":"Facebook for WordPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66703","published":"2026-08-06T14:28:06.899Z","updated":"2026-08-06T15:35:14.346Z","title":"WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"properfraction","product":"MailOptin","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66702","published":"2026-08-06T14:28:06.213Z","updated":"2026-08-06T16:14:24.231Z","title":"WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66701","published":"2026-08-06T14:28:05.539Z","updated":"2026-08-08T02:00:36.690Z","title":"WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-66699","published":"2026-08-06T14:28:04.864Z","updated":"2026-08-06T19:04:20.368Z","title":"WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Dokan, Inc.","product":"Dokan","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-66696","published":"2026-08-06T14:28:04.176Z","updated":"2026-08-06T15:05:54.728Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nexcess","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-66695","published":"2026-08-06T14:28:03.503Z","updated":"2026-08-06T15:35:19.950Z","title":"WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BoldGrid","product":"W3 Total Cache","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-66694","published":"2026-08-06T14:28:02.810Z","updated":"2026-08-06T16:42:53.704Z","title":"WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Thrive Themes Coupon","product":"Thrive Architect","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66692","published":"2026-08-06T14:28:02.131Z","updated":"2026-08-08T01:59:25.368Z","title":"WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Colissimo","product":"Colissimo Officiel : Méthodes de livraison pour WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-66690","published":"2026-08-06T14:28:01.461Z","updated":"2026-08-06T19:08:04.318Z","title":"WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66688","published":"2026-08-06T14:28:00.763Z","updated":"2026-08-06T15:06:14.270Z","title":"WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Ultimate Addons for Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66686","published":"2026-08-06T14:28:00.076Z","updated":"2026-08-06T15:35:25.811Z","title":"WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vladimir Garagulya","product":"Plugins Garbage Collector (Database Cleanup)","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-66685","published":"2026-08-06T14:27:59.410Z","updated":"2026-08-06T16:43:23.120Z","title":"WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Alex","product":"Featured Video Plus","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-66684","published":"2026-08-06T14:27:58.735Z","updated":"2026-08-08T01:58:43.931Z","title":"WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Akshay Menariya","product":"Export Import Menus","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-66683","published":"2026-08-06T14:27:58.068Z","updated":"2026-08-06T19:05:30.983Z","title":"WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Zone","product":"Custom CSS and JavaScript","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-66681","published":"2026-08-06T14:27:57.395Z","updated":"2026-08-06T15:03:00.632Z","title":"WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeff Farthing","product":"Theme My Login","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-66678","published":"2026-08-06T14:27:56.721Z","updated":"2026-08-06T15:35:31.352Z","title":"WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Justin Kruit","product":"Advanced Custom Fields: Font Awesome Field","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-66665","published":"2026-08-06T14:27:56.047Z","updated":"2026-08-06T16:45:26.981Z","title":"WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Brandexponents","product":"Type Hub","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-66664","published":"2026-08-06T14:27:55.374Z","updated":"2026-08-08T01:56:50.890Z","title":"WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66663","published":"2026-08-06T14:27:54.699Z","updated":"2026-08-06T19:09:26.682Z","title":"WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66662","published":"2026-08-06T14:27:54.039Z","updated":"2026-08-06T14:57:28.613Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2026-66470","published":"2026-08-06T14:27:53.372Z","updated":"2026-08-06T15:35:36.809Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-66457","published":"2026-08-06T14:27:52.685Z","updated":"2026-09-22T07:29:18.154Z","title":"WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66452","published":"2026-08-06T14:27:52.016Z","updated":"2026-08-08T01:55:42.450Z","title":"WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IT-Recht Kanzlei","product":"Legal Text Connector of the IT-Recht Kanzlei","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-66451","published":"2026-08-06T14:27:51.339Z","updated":"2026-08-06T19:22:10.763Z","title":"WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-66447","published":"2026-08-06T14:27:50.656Z","updated":"2026-08-06T14:56:20.392Z","title":"WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"nickboss","product":"WordPress File Upload","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-66440","published":"2026-08-06T14:27:49.979Z","updated":"2026-08-06T15:35:42.311Z","title":"WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"XplodedThemes","product":"WPIDE – File Manager & Code Editor","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66439","published":"2026-08-06T14:27:49.297Z","updated":"2026-08-06T16:52:46.075Z","title":"WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BeRocket","product":"Advanced AJAX Product Filters","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-66425","published":"2026-08-06T14:27:48.597Z","updated":"2026-08-08T01:54:59.851Z","title":"WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-65581","published":"2026-08-06T14:27:47.687Z","updated":"2026-08-06T19:17:28.670Z","title":"WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"AI ANN","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65579","published":"2026-08-06T14:27:46.987Z","updated":"2026-08-06T14:55:50.597Z","title":"WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Agricola","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65578","published":"2026-08-06T14:27:46.238Z","updated":"2026-08-06T15:35:48.232Z","title":"WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Agora","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65577","published":"2026-08-06T14:27:45.567Z","updated":"2026-08-06T16:53:37.665Z","title":"WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Advice","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65576","published":"2026-08-06T14:27:44.888Z","updated":"2026-08-06T15:24:09.551Z","title":"WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Adrena","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65575","published":"2026-08-06T14:27:44.212Z","updated":"2026-08-06T19:30:36.220Z","title":"WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Accalia","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65574","published":"2026-08-06T14:27:43.541Z","updated":"2026-08-06T14:55:34.632Z","title":"WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Abogado","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65573","published":"2026-08-06T14:27:42.873Z","updated":"2026-08-06T15:35:53.948Z","title":"WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Abelle","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65572","published":"2026-08-06T14:27:42.194Z","updated":"2026-08-06T16:54:10.664Z","title":"WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"A.Williams","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65571","published":"2026-08-06T14:27:41.521Z","updated":"2026-08-06T15:23:11.895Z","title":"WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"69 Clothing","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65570","published":"2026-08-06T14:27:40.850Z","updated":"2026-08-06T19:19:36.286Z","title":"WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability","severity":"HIGH","score":8.1,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-65569","published":"2026-08-06T14:27:40.175Z","updated":"2026-08-06T14:55:15.749Z","title":"WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-65565","published":"2026-08-06T14:27:39.514Z","updated":"2026-08-06T15:35:59.622Z","title":"WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65560","published":"2026-08-06T14:27:38.844Z","updated":"2026-08-06T16:54:41.919Z","title":"WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Property Hive","product":"Houzez Property Feed","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65559","published":"2026-08-06T14:27:38.172Z","updated":"2026-08-06T15:22:19.456Z","title":"WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"tychesoftwares","product":"Order Delivery Date for WooCommerce","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-65556","published":"2026-08-06T14:27:37.499Z","updated":"2026-08-06T19:18:37.275Z","title":"WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"MihChe","product":"WPBruiser {no- Captcha anti-Spam}","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65554","published":"2026-08-06T14:27:36.828Z","updated":"2026-08-06T14:54:23.826Z","title":"WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"lattepress","product":"AnsPress – Question and answer","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-65553","published":"2026-08-06T14:27:36.157Z","updated":"2026-08-06T15:36:06.805Z","title":"WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"wbolt.com","product":"Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-65552","published":"2026-08-06T14:27:35.488Z","updated":"2026-08-06T16:55:12.524Z","title":"WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"qstudio","product":"Export User Data","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-65549","published":"2026-08-06T14:27:34.818Z","updated":"2026-08-06T15:20:51.521Z","title":"WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"jegtheme","product":"Jeg Kit for Elementor","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-65548","published":"2026-08-06T14:27:34.160Z","updated":"2026-08-06T19:29:29.017Z","title":"WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Muffingroup","product":"Betheme","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-65546","published":"2026-08-06T14:27:32.822Z","updated":"2026-08-06T15:36:12.760Z","title":"WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"QODE","product":"Qode Tours","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-65545","published":"2026-08-06T14:27:32.142Z","updated":"2026-08-06T16:56:11.733Z","title":"WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jordy Meow","product":"AI Engine","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65544","published":"2026-08-06T14:27:31.431Z","updated":"2026-08-06T15:20:11.607Z","title":"WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rajat Varlani","product":"Super Socializer","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65543","published":"2026-08-06T14:27:30.751Z","updated":"2026-08-06T19:26:32.249Z","title":"WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"vimeodev","product":"Vimeo","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-65542","published":"2026-08-06T14:27:30.067Z","updated":"2026-08-06T14:53:27.777Z","title":"WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Rajat Varlani","product":"Super Socializer","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2026-65541","published":"2026-08-06T14:27:29.397Z","updated":"2026-08-06T15:36:21.962Z","title":"WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"solutioned","product":"Staff Training","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-65523","published":"2026-08-06T14:27:28.722Z","updated":"2026-08-06T17:38:33.584Z","title":"WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"approveme","product":"Formidable Forms Signature Online Contract Automation","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-65520","published":"2026-08-06T14:27:28.052Z","updated":"2026-08-06T15:19:31.742Z","title":"WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"miniOrange","product":"WP OAuth Server","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-65517","published":"2026-08-06T14:27:27.362Z","updated":"2026-08-06T19:39:40.922Z","title":"WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Scott Paterson","product":"Easy PayPal Buy Now Button","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65515","published":"2026-08-06T14:27:26.690Z","updated":"2026-08-06T14:50:39.327Z","title":"WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AffiliateWP","product":"AffiliateWP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65513","published":"2026-08-06T14:27:26.018Z","updated":"2026-08-06T15:36:29.199Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65509","published":"2026-08-06T14:27:25.343Z","updated":"2026-08-06T17:07:01.189Z","title":"WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpDataTables","product":"wpDataTables","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65508","published":"2026-08-06T14:27:24.665Z","updated":"2026-08-06T15:18:11.844Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-65507","published":"2026-08-06T14:27:24.010Z","updated":"2026-08-06T19:28:13.396Z","title":"WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-65504","published":"2026-08-06T14:27:23.326Z","updated":"2026-08-06T14:47:53.648Z","title":"WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ivanbebek","product":"BOX NOW Delivery Croatia","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-65502","published":"2026-08-06T14:27:22.645Z","updated":"2026-08-06T15:36:38.490Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bdthemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-61982","published":"2026-08-06T14:27:21.973Z","updated":"2026-08-06T17:12:23.064Z","title":"WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jp-secure","product":"SiteGuard WP Plugin","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61964","published":"2026-08-06T14:27:21.297Z","updated":"2026-08-06T15:17:11.212Z","title":"WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Ninja Tables","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61963","published":"2026-08-06T14:27:20.602Z","updated":"2026-08-06T19:25:41.746Z","title":"WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61961","published":"2026-08-06T14:27:19.936Z","updated":"2026-08-06T14:48:10.314Z","title":"WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDeveloper","product":"EmbedPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61959","published":"2026-08-06T14:27:19.262Z","updated":"2026-08-06T15:36:43.993Z","title":"WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-32548","published":"2026-08-06T14:27:18.592Z","updated":"2026-08-06T17:14:24.874Z","title":"WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-32469","published":"2026-08-06T14:27:17.919Z","updated":"2026-08-06T15:16:25.423Z","title":"WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPKube","product":"CAPTCHA 4WP","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-28183","published":"2026-08-06T14:27:17.244Z","updated":"2026-09-23T18:30:56.512Z","title":"WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-28180","published":"2026-08-06T14:27:16.564Z","updated":"2026-08-06T14:47:32.514Z","title":"WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mercado Pago","product":"Mercado Pago payments for WooCommerce","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-28179","published":"2026-08-06T14:27:15.897Z","updated":"2026-08-06T15:36:51.336Z","title":"WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Damian Góra","product":"FiboSearch","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-28178","published":"2026-08-06T14:27:15.236Z","updated":"2026-08-06T17:16:17.460Z","title":"WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codesupplyco","product":"Powerkit","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-28177","published":"2026-08-06T14:27:14.561Z","updated":"2026-10-26T07:10:43.913Z","title":"WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Code Atlantic LLC","product":"Popup Maker","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28172","published":"2026-08-06T14:27:13.899Z","updated":"2026-08-06T19:34:10.038Z","title":"WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Data443 Risk Mitigation, Inc.","product":"Tracking Code Manager","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-28169","published":"2026-08-06T14:27:13.221Z","updated":"2026-08-06T14:47:12.530Z","title":"WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITHEMES","product":"YITH WooCommerce Zoom Magnifier","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-28146","published":"2026-08-06T14:27:12.542Z","updated":"2026-08-06T15:36:57.672Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-28143","published":"2026-08-06T14:27:11.872Z","updated":"2026-08-06T17:20:23.235Z","title":"WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28141","published":"2026-08-06T14:27:11.185Z","updated":"2026-08-06T15:11:39.396Z","title":"WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Syed Balkhi","product":"NextGEN Gallery","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-28140","published":"2026-08-06T14:27:10.517Z","updated":"2026-08-06T19:36:56.820Z","title":"WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-28139","published":"2026-08-06T14:27:09.843Z","updated":"2026-08-06T14:46:49.022Z","title":"WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpdreams","product":"Ajax Search Lite","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-28111","published":"2026-08-06T14:27:09.176Z","updated":"2026-08-06T15:37:04.794Z","title":"WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-28082","published":"2026-08-06T14:27:08.502Z","updated":"2026-08-06T17:22:39.810Z","title":"WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-28005","published":"2026-08-06T14:27:07.833Z","updated":"2026-08-06T15:10:51.516Z","title":"WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Nexcess","product":"Kadence WooCommerce Email Designer","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-25403","published":"2026-08-06T14:27:07.153Z","updated":"2026-08-06T19:38:05.826Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-66712","published":"2026-08-06T14:27:06.467Z","updated":"2026-08-06T15:08:41.559Z","title":"WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-65551","published":"2026-08-06T12:47:56.288Z","updated":"2026-08-06T13:49:42.133Z","title":"WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Soflyy","product":"Breakdance","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-28147","published":"2026-08-03T07:09:38.328Z","updated":"2026-08-03T15:37:10.864Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-28144","published":"2026-07-31T13:41:33.450Z","updated":"2026-07-31T14:00:46.523Z","title":"WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Flipper Code","product":"WP Maps","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-28145","published":"2026-07-31T13:19:39.683Z","updated":"2026-07-31T14:01:07.485Z","title":"WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-65448","published":"2026-07-27T22:44:07.710Z","updated":"2026-07-28T16:07:25.050Z","title":"WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AcyMailing Newsletter Team","product":"Anti Spam and list cleaner &#8211; AcyChecker","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65447","published":"2026-07-27T22:44:07.069Z","updated":"2026-07-28T13:31:41.593Z","title":"WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65446","published":"2026-07-27T22:44:06.432Z","updated":"2026-07-28T14:54:09.482Z","title":"WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Chill","product":"Kali Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65445","published":"2026-07-27T22:44:05.796Z","updated":"2026-07-28T13:33:21.768Z","title":"WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iSaumya","product":"Ad Invalid Click Protector (AICP)","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-65443","published":"2026-07-27T22:44:05.155Z","updated":"2026-07-28T13:52:36.711Z","title":"WordPress BackWPup  plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Media","product":"BackWPup","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65442","published":"2026-07-27T22:44:04.517Z","updated":"2026-07-28T13:54:28.356Z","title":"WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Subtle Web Inc","product":"FormCraft","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-65441","published":"2026-07-27T22:44:03.877Z","updated":"2026-07-28T16:07:09.463Z","title":"WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65440","published":"2026-07-27T22:44:03.223Z","updated":"2026-07-28T13:32:17.246Z","title":"WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Roxnor","product":"GetGenie","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65439","published":"2026-07-27T22:44:02.584Z","updated":"2026-07-28T14:54:16.153Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65438","published":"2026-07-27T22:44:01.949Z","updated":"2026-07-28T13:35:00.094Z","title":"WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kofi Mokome","product":"Message Filter for Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65437","published":"2026-07-27T22:44:00.867Z","updated":"2026-07-28T13:52:02.436Z","title":"WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CleanTalk Inc","product":"Spam protection, AntiSpam, FireWall by CleanTalk","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61957","published":"2026-07-27T22:43:59.716Z","updated":"2026-07-28T13:52:46.643Z","title":"WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61953","published":"2026-07-27T22:43:59.066Z","updated":"2026-07-28T16:06:50.705Z","title":"WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"QuantumCloud","product":"Simple Link Directory Pro","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-66473","published":"2026-07-27T22:43:58.434Z","updated":"2026-07-28T13:55:36.659Z","title":"WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Xendit","product":"Xendit Payment","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-66477","published":"2026-07-27T13:59:32.265Z","updated":"2026-07-27T16:06:08.418Z","title":"WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shufflehound","product":"Gillion","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-66476","published":"2026-07-27T13:59:31.622Z","updated":"2026-07-27T16:17:23.498Z","title":"WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Syed Balkhi","product":"Easy Digital Downloads","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-66475","published":"2026-07-27T13:59:30.985Z","updated":"2026-07-27T16:22:36.892Z","title":"WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"acowebs","product":"Checkout Field Editor for WooCommerce &#8211; Checkout Manager","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-66474","published":"2026-07-27T13:59:30.332Z","updated":"2026-07-27T18:16:25.406Z","title":"WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HT Plugins","product":"Insert Headers and Footers Code – HT Script","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-66448","published":"2026-07-27T13:59:29.665Z","updated":"2026-07-27T15:00:25.170Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66445","published":"2026-07-27T13:59:29.014Z","updated":"2026-07-27T14:59:13.003Z","title":"WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"100plugins","product":"Open User Map","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66442","published":"2026-07-27T13:59:28.368Z","updated":"2026-07-27T16:06:36.751Z","title":"WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"YayCommerce","product":"YayPricing","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-66438","published":"2026-07-27T13:59:27.715Z","updated":"2026-07-27T16:17:29.817Z","title":"WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tim Strifler","product":"Exclusive Addons Elementor","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-66437","published":"2026-07-27T13:59:27.073Z","updated":"2026-07-27T16:24:34.394Z","title":"WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Themeisle","product":"Feedzy","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-66434","published":"2026-07-27T13:59:26.453Z","updated":"2026-07-27T18:15:48.787Z","title":"WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sayontan Sinha","product":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66433","published":"2026-07-27T13:59:25.811Z","updated":"2026-07-27T15:07:40.751Z","title":"WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShapedPlugin LLC","product":"Location Weather","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-66428","published":"2026-07-27T13:59:25.165Z","updated":"2026-07-27T14:59:35.991Z","title":"WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"jgwhite33","product":"WP Google Review Slider","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-66427","published":"2026-07-27T13:59:24.521Z","updated":"2026-07-27T16:07:16.533Z","title":"WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"jgwhite33","product":"WP Google Review Slider","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-65568","published":"2026-07-27T13:59:23.873Z","updated":"2026-07-27T16:17:37.177Z","title":"WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-65567","published":"2026-07-27T13:59:23.233Z","updated":"2026-07-27T16:29:36.731Z","title":"WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65564","published":"2026-07-27T13:59:22.589Z","updated":"2026-07-27T18:15:15.556Z","title":"WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"chrisvrichardson","product":"MapPress Maps for WordPress","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65563","published":"2026-07-27T13:59:21.954Z","updated":"2026-07-27T15:01:58.458Z","title":"WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themeisle","product":"Orbit Fox by ThemeIsle","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65562","published":"2026-07-27T13:59:21.316Z","updated":"2026-07-27T14:59:56.545Z","title":"WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"BetterDocs","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65561","published":"2026-07-27T13:59:20.665Z","updated":"2026-07-27T16:07:44.552Z","title":"WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65558","published":"2026-07-27T13:59:20.025Z","updated":"2026-07-27T16:17:44.977Z","title":"WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPCenter","product":"AffiliateX","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-65557","published":"2026-07-27T13:59:19.377Z","updated":"2026-07-27T16:30:02.069Z","title":"WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tychesoftwares","product":"Abandoned Cart Lite for WooCommerce","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65436","published":"2026-07-27T13:59:18.729Z","updated":"2026-07-27T18:14:29.455Z","title":"WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-65435","published":"2026-07-27T13:59:18.082Z","updated":"2026-07-27T14:59:07.324Z","title":"WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Thrive Themes Coupon","product":"Thrive Leads Version","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-65434","published":"2026-07-27T13:59:17.436Z","updated":"2026-07-27T14:58:43.451Z","title":"WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"yoomoney","product":"ЮKassa для WooCommerce","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-65433","published":"2026-07-27T13:59:16.794Z","updated":"2026-07-27T16:08:28.023Z","title":"WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themewant","product":"RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-59560","published":"2026-07-27T13:59:16.161Z","updated":"2026-07-27T16:17:54.008Z","title":"WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-59559","published":"2026-07-27T13:59:15.530Z","updated":"2026-07-27T16:30:45.174Z","title":"WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themewant","product":"RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-59558","published":"2026-07-27T13:59:14.892Z","updated":"2026-07-27T18:12:48.121Z","title":"WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-59557","published":"2026-07-27T13:59:14.237Z","updated":"2026-07-27T14:56:59.308Z","title":"WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Franky","product":"Events Made Easy","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-59556","published":"2026-07-27T13:59:13.565Z","updated":"2026-07-27T14:58:18.183Z","title":"WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"acowebs","product":"Dynamic Pricing With Discount Rules for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-59553","published":"2026-07-27T13:59:12.758Z","updated":"2026-07-27T16:08:49.896Z","title":"WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-59552","published":"2026-07-27T13:59:12.131Z","updated":"2026-07-27T16:18:02.783Z","title":"WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Shahadat Hossain","product":"3D Flipbook PDF Viewer &amp; Embedder","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-59551","published":"2026-07-27T13:59:11.486Z","updated":"2026-07-27T16:33:38.797Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"rtCamp","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-59550","published":"2026-07-27T13:59:10.839Z","updated":"2026-07-27T18:11:52.196Z","title":"WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Strategy11 Team","product":"AWP Classifieds","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59549","published":"2026-07-27T13:59:10.192Z","updated":"2026-07-27T15:09:35.438Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"rtCamp","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59548","published":"2026-07-27T13:59:09.542Z","updated":"2026-07-27T14:57:50.345Z","title":"WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Byteflows","product":"Byteflows Travel &amp; Hotel Booking","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-59546","published":"2026-07-27T13:59:08.900Z","updated":"2026-07-27T16:09:14.102Z","title":"WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability","severity":"HIGH","score":7.4,"vendor":"John Darrel","product":"Hide My WP Ghost","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-59539","published":"2026-07-27T13:59:08.257Z","updated":"2026-07-27T16:18:13.296Z","title":"WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-59538","published":"2026-07-27T13:59:07.615Z","updated":"2026-07-27T16:36:29.284Z","title":"WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59537","published":"2026-07-27T13:59:06.968Z","updated":"2026-07-27T18:11:10.853Z","title":"WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Sender","product":"Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-59536","published":"2026-07-27T13:59:06.324Z","updated":"2026-07-27T15:06:23.333Z","title":"WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"CoCart Headless","product":"CoCart – Headless ecommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-59535","published":"2026-07-27T13:59:05.678Z","updated":"2026-07-27T14:54:48.414Z","title":"WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Thrive Themes Coupon","product":"Thrive Product Manager","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-59534","published":"2026-07-27T13:59:05.037Z","updated":"2026-07-27T16:09:44.216Z","title":"WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Aurovrata Venet","product":"Post My CF7 Form","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-59533","published":"2026-07-27T13:59:04.398Z","updated":"2026-07-27T16:18:21.075Z","title":"WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Christoph Vielgrader","product":"Relevanssi Light","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59532","published":"2026-07-27T13:59:03.746Z","updated":"2026-07-27T16:38:02.934Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability","severity":"HIGH","score":7.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-59531","published":"2026-07-27T13:59:03.100Z","updated":"2026-07-27T18:10:17.414Z","title":"WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability","severity":"HIGH","score":7.5,"vendor":"Anh Tran","product":"Falcon – WordPress Optimizations & Tweaks","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-59530","published":"2026-07-27T13:59:02.453Z","updated":"2026-07-27T15:08:50.487Z","title":"WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Payment Plugins","product":"Stripe For WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-59529","published":"2026-07-27T13:59:01.811Z","updated":"2026-07-27T14:54:15.014Z","title":"WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-59528","published":"2026-07-27T13:59:01.165Z","updated":"2026-07-27T16:10:08.411Z","title":"WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"shiptime","product":"ShipTime: Discounted Shipping Rates","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-59527","published":"2026-07-27T13:59:00.507Z","updated":"2026-07-27T16:18:29.631Z","title":"WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-65475","published":"2026-07-23T11:53:14.158Z","updated":"2026-07-23T15:47:33.645Z","title":"WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-61945","published":"2026-07-23T11:50:37.837Z","updated":"2026-07-23T15:26:43.238Z","title":"WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"WooCommerce Product Stock Alert","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-57626","published":"2026-07-23T11:46:34.433Z","updated":"2026-07-23T14:36:37.579Z","title":"WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MailPoet","product":"MailPoet","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-65550","published":"2026-07-23T11:19:24.434Z","updated":"2026-07-23T13:35:46.597Z","title":"WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpshopmart","product":"Tabs","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65540","published":"2026-07-23T11:19:23.800Z","updated":"2026-07-23T13:24:19.102Z","title":"WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Metin Saraç","product":"Popup for CF7 with Sweet Alert","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-65539","published":"2026-07-23T11:19:23.165Z","updated":"2026-07-23T14:49:58.989Z","title":"WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Bimal Rekhadiya","product":"Kwayy HTML Sitemap","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-65538","published":"2026-07-23T11:19:22.531Z","updated":"2026-07-23T15:48:44.017Z","title":"WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Nilo Velez","product":"Machete","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65537","published":"2026-07-23T11:19:21.892Z","updated":"2026-07-23T15:22:08.465Z","title":"WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeisle","product":"Cyr to Lat reloaded – transliteration of links and file names","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-65536","published":"2026-07-23T11:19:21.247Z","updated":"2026-07-23T14:03:30.708Z","title":"WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mahdi Yousefi","product":"افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-65535","published":"2026-07-23T11:19:20.599Z","updated":"2026-07-23T13:37:26.146Z","title":"WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Takayuki Miyauchi","product":"TinyMCE Templates","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-65534","published":"2026-07-23T11:19:19.964Z","updated":"2026-07-23T13:25:45.530Z","title":"WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Charlie Etienne","product":"Custom links in Elementor Image Carousel","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65533","published":"2026-07-23T11:19:19.336Z","updated":"2026-07-23T14:50:11.064Z","title":"WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wbolt.com","product":"Smart SEO Tool","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65532","published":"2026-07-23T11:19:18.696Z","updated":"2026-07-23T15:53:28.095Z","title":"WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PersianScript","product":"Persian Woocommerce SMS","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-65531","published":"2026-07-23T11:19:18.064Z","updated":"2026-07-23T15:12:18.787Z","title":"WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Themeum","product":"Qubely","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-65530","published":"2026-07-23T11:19:17.398Z","updated":"2026-07-23T14:08:47.141Z","title":"WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Templatespare","product":"TemplateSpare","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-65529","published":"2026-07-23T11:19:16.755Z","updated":"2026-10-23T08:42:28.015Z","title":"WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Iqonic Designs","product":"Graphina – Charts and Graphs For Elementor","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65528","published":"2026-07-23T11:19:16.111Z","updated":"2026-07-23T13:26:07.357Z","title":"WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bannersky","product":"BSK PDF Manager","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65527","published":"2026-07-23T11:19:15.479Z","updated":"2026-07-23T14:50:24.030Z","title":"WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"lqd","product":"LIQUID SPEECH BALLOON","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65526","published":"2026-07-23T11:19:14.846Z","updated":"2026-08-03T09:14:14.010Z","title":"WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Themeisle","product":"Visualizer","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-65525","published":"2026-07-23T11:19:14.202Z","updated":"2026-07-23T15:11:16.484Z","title":"WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"uxper","product":"Civi Framework","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65524","published":"2026-07-23T11:19:13.568Z","updated":"2026-07-23T14:07:15.288Z","title":"WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeFusion","product":"Avada Custom Branding","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-65522","published":"2026-07-23T11:19:12.937Z","updated":"2026-07-23T13:40:24.896Z","title":"WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pixelacehq","product":"Manual - Documentation, Knowledge Base & Education WordPress Theme","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65521","published":"2026-07-23T11:19:12.301Z","updated":"2026-07-23T13:26:33.284Z","title":"WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mahmudul Hasan Arif","product":"WP Social Ninja","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65519","published":"2026-07-23T11:19:11.667Z","updated":"2026-07-23T14:50:33.382Z","title":"WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gt3themes","product":"Photo Gallery","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65518","published":"2026-07-23T11:19:11.027Z","updated":"2026-07-23T15:55:23.460Z","title":"WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Scott Paterson","product":"Accept Donations with PayPal & Stripe","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65516","published":"2026-07-23T11:19:10.392Z","updated":"2026-07-23T15:09:52.250Z","title":"WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Pepro Dev. Group","product":"PeproDev Ultimate Invoice","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-65514","published":"2026-07-23T11:19:09.754Z","updated":"2026-07-23T14:04:49.364Z","title":"WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Appointment Hour Booking","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65512","published":"2026-07-23T11:19:09.110Z","updated":"2026-08-05T08:36:51.179Z","title":"WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-65511","published":"2026-07-23T11:19:08.475Z","updated":"2026-07-23T13:26:54.308Z","title":"WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pixelacehq","product":"Manual - Documentation, Knowledge Base & Education WordPress Theme","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65510","published":"2026-07-23T11:19:07.828Z","updated":"2026-07-23T14:50:44.301Z","title":"WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pepro Dev. Group","product":"PeproDev Ultimate Invoice","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65506","published":"2026-07-23T11:19:07.185Z","updated":"2026-07-23T16:05:10.926Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65505","published":"2026-07-23T11:19:06.553Z","updated":"2026-07-23T15:08:47.236Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65503","published":"2026-07-23T11:19:05.898Z","updated":"2026-07-23T14:06:22.698Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65501","published":"2026-07-23T11:19:05.175Z","updated":"2026-07-23T13:35:22.051Z","title":"WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vendidero","product":"Shiptastic for WooCommerce","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65500","published":"2026-07-23T11:19:04.485Z","updated":"2026-07-23T13:27:48.081Z","title":"WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"pixelacehq","product":"Manual - Documentation, Knowledge Base & Education WordPress Theme","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-65499","published":"2026-07-23T11:19:03.852Z","updated":"2026-07-23T14:50:56.515Z","title":"WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pepro Dev. Group","product":"PeproDev Ultimate Invoice","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-65498","published":"2026-07-23T11:19:03.170Z","updated":"2026-08-12T18:57:28.433Z","title":"WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Complianz","product":"Complianz","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65497","published":"2026-07-23T11:19:02.535Z","updated":"2026-07-23T15:08:01.311Z","title":"WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Complianz","product":"Complianz","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-65496","published":"2026-07-23T11:19:01.901Z","updated":"2026-07-23T14:52:46.291Z","title":"WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Complianz","product":"Complianz","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-65495","published":"2026-07-23T11:19:01.262Z","updated":"2026-07-23T13:41:55.388Z","title":"WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Dokan Multivendor Plugin","product":"Dokan Pro","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-65494","published":"2026-07-23T11:19:00.620Z","updated":"2026-07-23T13:28:09.284Z","title":"WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"Dokan","product":"Dokan Pro","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-65493","published":"2026-07-23T11:18:59.986Z","updated":"2026-07-23T14:51:07.788Z","title":"WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"Dokan","product":"Dokan Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-65492","published":"2026-07-23T11:18:59.356Z","updated":"2026-09-21T14:25:27.607Z","title":"WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"Dokan Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-65491","published":"2026-07-23T11:18:58.714Z","updated":"2026-07-23T15:07:19.770Z","title":"WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jonathan Daggerhart","product":"Query Wrangler","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-65490","published":"2026-07-23T11:18:58.080Z","updated":"2026-09-18T16:15:24.802Z","title":"WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John-Michael L'Allier","product":"Create","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65489","published":"2026-07-23T11:18:57.444Z","updated":"2026-09-30T14:46:36.885Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65488","published":"2026-07-23T11:18:56.816Z","updated":"2026-09-30T14:46:55.531Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-65487","published":"2026-07-23T11:18:56.183Z","updated":"2026-07-23T14:51:19.862Z","title":"WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65486","published":"2026-07-23T11:18:55.544Z","updated":"2026-07-23T15:57:06.027Z","title":"WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Bastien Ho","product":"Event post","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65485","published":"2026-07-23T11:18:54.913Z","updated":"2026-07-23T15:06:40.370Z","title":"WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Daniel Iser","product":"Content Control","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65484","published":"2026-07-23T11:18:54.280Z","updated":"2026-07-23T14:42:47.774Z","title":"WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"AnalogWP","product":"Style Kits","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-65483","published":"2026-07-23T11:18:53.649Z","updated":"2026-07-23T13:42:43.335Z","title":"WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"hashthemes","product":"HashThemes Demo Importer","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-65482","published":"2026-07-23T11:18:53.013Z","updated":"2026-10-01T07:13:44.164Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65481","published":"2026-07-23T11:18:52.377Z","updated":"2026-07-23T14:51:28.879Z","title":"WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Elated-Themes","product":"Vino","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-65480","published":"2026-07-23T11:18:51.737Z","updated":"2026-08-14T10:53:46.908Z","title":"WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65479","published":"2026-07-23T11:18:51.090Z","updated":"2026-07-23T15:04:51.859Z","title":"WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"MVP Themes","product":"Reviewer","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-65478","published":"2026-07-23T11:18:50.446Z","updated":"2026-07-23T14:32:40.795Z","title":"WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-65477","published":"2026-07-23T11:18:49.794Z","updated":"2026-07-23T13:43:06.979Z","title":"WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Tonda Core","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-65476","published":"2026-07-23T11:18:49.155Z","updated":"2026-07-23T13:40:00.430Z","title":"WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"uxper","product":"Civi","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65474","published":"2026-07-23T11:18:48.491Z","updated":"2026-07-23T14:51:38.883Z","title":"WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPManageNinja","product":"Ninja Tables","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-65473","published":"2026-07-23T11:18:47.853Z","updated":"2026-07-23T15:57:44.103Z","title":"WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"Virtue/Ascend/Pinnacle Toolkit","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65472","published":"2026-07-23T11:18:47.217Z","updated":"2026-07-23T14:40:21.477Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65471","published":"2026-07-23T11:18:46.575Z","updated":"2026-07-23T14:33:46.791Z","title":"WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Avada Studio","product":"Avada Core","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-65470","published":"2026-07-23T11:18:45.941Z","updated":"2026-07-23T13:43:37.316Z","title":"WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPManageNinja","product":"Fluent Support","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65469","published":"2026-07-23T11:18:45.293Z","updated":"2026-07-23T13:29:09.929Z","title":"WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Strategy11 Team","product":"AWP Classifieds","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65468","published":"2026-07-23T11:18:44.638Z","updated":"2026-07-23T14:51:48.962Z","title":"WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBooking","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65467","published":"2026-07-23T11:18:44.003Z","updated":"2026-07-23T15:57:57.723Z","title":"WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-65466","published":"2026-07-23T11:18:43.365Z","updated":"2026-07-23T14:39:49.472Z","title":"WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBooking","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-65465","published":"2026-07-23T11:18:42.738Z","updated":"2026-07-23T14:45:22.492Z","title":"WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetElements For Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-65464","published":"2026-07-23T11:18:42.106Z","updated":"2026-07-23T13:41:23.004Z","title":"WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-65463","published":"2026-07-23T11:18:41.468Z","updated":"2026-07-23T13:29:30.902Z","title":"WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-65462","published":"2026-07-23T11:18:40.815Z","updated":"2026-07-23T14:51:57.770Z","title":"WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-65461","published":"2026-07-23T11:18:40.167Z","updated":"2026-07-23T15:58:22.142Z","title":"WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Webの相談所","product":"Really Simple CSV Importer","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-65460","published":"2026-07-23T11:18:39.523Z","updated":"2026-07-23T14:35:52.112Z","title":"WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"zarinpal","product":"Zarinpal Gateway","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-65458","published":"2026-07-23T11:18:38.882Z","updated":"2026-08-06T09:51:46.458Z","title":"WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Chouby","product":"Polylang","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-65457","published":"2026-07-23T11:18:38.242Z","updated":"2026-07-23T13:45:53.390Z","title":"WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"yoomoney","product":"ЮKassa для WooCommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-65456","published":"2026-07-23T11:18:37.593Z","updated":"2026-07-23T13:30:15.810Z","title":"WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PickPlugins","product":"Product Slider for WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-65455","published":"2026-07-23T11:18:36.950Z","updated":"2026-07-23T14:52:08.214Z","title":"WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"MapSVG","product":"MapSVG","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-65454","published":"2026-07-23T11:18:36.289Z","updated":"2026-07-23T15:58:40.224Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-65453","published":"2026-07-23T11:18:35.652Z","updated":"2026-07-23T14:35:12.530Z","title":"WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-65452","published":"2026-07-23T11:18:35.032Z","updated":"2026-07-23T14:48:39.833Z","title":"WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-65451","published":"2026-07-23T11:18:34.387Z","updated":"2026-07-23T13:46:15.520Z","title":"WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-65450","published":"2026-07-23T11:18:33.759Z","updated":"2026-07-23T13:29:51.219Z","title":"WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-65449","published":"2026-07-23T11:18:33.123Z","updated":"2026-07-23T14:52:16.480Z","title":"WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-61981","published":"2026-07-23T11:18:32.486Z","updated":"2026-07-23T15:58:55.127Z","title":"WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"QuantumCloud","product":"Simple Link Directory Pro","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-61973","published":"2026-07-23T11:18:31.839Z","updated":"2026-07-23T14:34:37.091Z","title":"WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WooLentor","product":"ShopLentor Pro","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-61972","published":"2026-07-23T11:18:31.192Z","updated":"2026-07-23T14:46:17.148Z","title":"WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WooLentor","product":"ShopLentor Pro","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-61954","published":"2026-07-23T11:18:30.542Z","updated":"2026-07-23T13:58:59.403Z","title":"WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"PayU India","product":"PayU India","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-61951","published":"2026-07-23T11:18:29.900Z","updated":"2026-07-23T13:30:42.286Z","title":"WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-61950","published":"2026-07-23T11:18:29.256Z","updated":"2026-07-23T14:52:23.970Z","title":"WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-61949","published":"2026-07-23T11:18:28.614Z","updated":"2026-07-23T15:59:35.105Z","title":"WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-61948","published":"2026-07-23T11:18:27.968Z","updated":"2026-07-23T14:27:46.400Z","title":"WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shahjada","product":"WPDM – Premium Packages","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-61947","published":"2026-07-23T11:18:27.322Z","updated":"2026-07-23T14:54:39.122Z","title":"WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPVibes","product":"Form Vibes – Database Manager for Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61946","published":"2026-07-23T11:18:26.659Z","updated":"2026-07-23T13:46:40.876Z","title":"WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Easy Appointments","product":"Easy Appointments","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-61944","published":"2026-07-23T11:18:26.009Z","updated":"2026-07-23T13:31:29.688Z","title":"WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-61943","published":"2026-07-23T11:18:25.373Z","updated":"2026-07-23T14:52:34.324Z","title":"WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Shahjada","product":"WPDM – Premium Packages","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-59555","published":"2026-07-23T11:18:24.720Z","updated":"2026-07-23T16:05:31.206Z","title":"WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":10,"vendor":"Roland Barker","product":"Participants Database","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2026-59554","published":"2026-07-23T11:18:24.085Z","updated":"2026-07-23T14:26:03.408Z","title":"WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Ziina","product":"Ziina","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-59547","published":"2026-07-23T11:18:23.445Z","updated":"2026-07-23T14:55:59.346Z","title":"WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Easy Payment","product":"Payment Gateway for PayPal on WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-59545","published":"2026-07-23T11:18:22.825Z","updated":"2026-07-23T13:50:43.295Z","title":"WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"miniOrange","product":"miniOrange Discord Integration","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2026-59544","published":"2026-07-23T11:18:22.172Z","updated":"2026-07-23T13:31:49.098Z","title":"WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Thrive Themes Coupon","product":"Thrive Quiz Builder","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-59543","published":"2026-07-23T11:18:21.530Z","updated":"2026-07-23T14:52:46.087Z","title":"WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPLake","product":"Advanced Views","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-59542","published":"2026-07-23T11:18:20.877Z","updated":"2026-07-23T15:59:52.700Z","title":"WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"WP Chill","product":"Kali Forms","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-59541","published":"2026-07-23T11:18:20.227Z","updated":"2026-07-23T14:25:27.109Z","title":"WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-59540","published":"2026-07-23T11:18:19.570Z","updated":"2026-07-23T14:53:46.102Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-59526","published":"2026-07-23T11:18:18.903Z","updated":"2026-07-23T13:51:11.045Z","title":"WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59525","published":"2026-07-23T11:18:18.247Z","updated":"2026-07-23T13:32:09.728Z","title":"WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Roland Barker","product":"Participants Database","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59524","published":"2026-07-23T11:18:17.600Z","updated":"2026-07-23T14:52:58.253Z","title":"WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sandhills Development, LLC","product":"Easy Digital Downloads","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-59522","published":"2026-07-23T11:18:16.958Z","updated":"2026-07-23T16:00:09.956Z","title":"WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-59517","published":"2026-07-23T11:18:16.315Z","updated":"2026-07-23T14:24:48.990Z","title":"WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hassantafreshi","product":"Easy Form Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-59514","published":"2026-07-23T11:18:15.675Z","updated":"2026-07-23T14:57:17.658Z","title":"WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"MightyNetworks vs BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-59513","published":"2026-07-23T11:18:15.028Z","updated":"2026-07-23T13:44:09.148Z","title":"WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-59512","published":"2026-07-23T11:18:14.369Z","updated":"2026-07-23T13:32:28.902Z","title":"WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PI Web Solution","product":"Product Enquiry for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57809","published":"2026-07-23T11:18:13.725Z","updated":"2026-07-23T14:53:09.458Z","title":"WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AffiliateWP","product":"AffiliateWP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57808","published":"2026-07-23T11:18:13.077Z","updated":"2026-07-23T16:00:36.785Z","title":"WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57785","published":"2026-07-23T11:18:12.442Z","updated":"2026-07-23T14:23:47.952Z","title":"WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"ApusTheme","product":"ApusListing","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57784","published":"2026-07-23T11:18:11.801Z","updated":"2026-07-23T15:11:48.466Z","title":"WordPress  Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Ninja Forms","product":"Ninja Forms File Uploads Extension","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57769","published":"2026-07-23T11:18:11.165Z","updated":"2026-07-23T13:51:37.275Z","title":"WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Photography","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57767","published":"2026-07-23T11:18:10.525Z","updated":"2026-07-23T13:32:56.022Z","title":"WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CodeCabin.io","product":"WP Google Maps Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57735","published":"2026-07-23T11:18:09.887Z","updated":"2026-07-23T14:53:20.105Z","title":"WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Soflyy","product":"Breakdance","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57717","published":"2026-07-23T11:18:09.253Z","updated":"2026-07-23T16:01:18.585Z","title":"WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"knitpay","product":"Knit Pay","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57716","published":"2026-07-23T11:18:08.617Z","updated":"2026-07-23T14:23:10.923Z","title":"WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":5.3,"vendor":"videowhisper","product":"Broadcast Live Video","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-57704","published":"2026-07-23T11:18:07.981Z","updated":"2026-07-23T15:04:01.599Z","title":"WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"StoreApps","product":"Smart Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57703","published":"2026-07-23T11:18:07.347Z","updated":"2026-07-23T13:52:33.205Z","title":"WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-57701","published":"2026-07-23T11:18:06.713Z","updated":"2026-07-23T13:40:27.605Z","title":"WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WebCodingPlace","product":"Real Estate Manager Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57699","published":"2026-07-23T11:18:06.070Z","updated":"2026-07-23T14:53:29.699Z","title":"WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bqworks","product":"Slider Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57696","published":"2026-07-23T11:18:05.427Z","updated":"2026-07-23T16:01:48.198Z","title":"WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.1,"vendor":"videowhisper","product":"Picture Gallery","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-57428","published":"2026-07-23T11:18:04.778Z","updated":"2026-07-23T14:21:10.792Z","title":"WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BoldGrid","product":"Sprout Clients","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57427","published":"2026-07-23T11:18:04.135Z","updated":"2026-07-23T15:05:13.737Z","title":"WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Download Monitor","product":"Download Monitor - WPForms Lock","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57425","published":"2026-07-23T11:18:03.490Z","updated":"2026-07-23T13:52:54.256Z","title":"WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdesk","product":"Autopay dla WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57397","published":"2026-07-23T11:18:02.865Z","updated":"2026-07-23T13:33:15.586Z","title":"WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress.","product":"Coaching","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57384","published":"2026-07-23T11:18:02.227Z","updated":"2026-07-23T14:53:41.475Z","title":"WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Membership Software","product":"WishList Member X","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57374","published":"2026-07-23T11:18:01.586Z","updated":"2026-07-23T16:02:07.464Z","title":"WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Wisetr INC.","product":"Funnel Kit Funnel Builder PRO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57373","published":"2026-07-23T11:18:00.952Z","updated":"2026-07-23T14:19:54.737Z","title":"WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wisetr INC.","product":"Funnel Kit Funnel Builder PRO","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57370","published":"2026-07-23T11:18:00.301Z","updated":"2026-07-23T15:06:43.803Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CODEPRESS IT Solutions LLC","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57367","published":"2026-07-23T11:17:59.644Z","updated":"2026-07-23T13:53:12.938Z","title":"WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Booking System .","product":"WP Booking System","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-27423","published":"2026-07-23T11:17:59.004Z","updated":"2026-07-23T13:33:41.163Z","title":"WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Roland Barker","product":"Participants Database","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-27422","published":"2026-07-23T11:17:58.367Z","updated":"2026-09-23T08:48:56.815Z","title":"WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"YT Player","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-27418","published":"2026-07-23T11:17:57.727Z","updated":"2026-07-23T16:02:24.492Z","title":"WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Epsiloncool","product":"WP Fast Total Search","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-27403","published":"2026-07-23T11:17:56.966Z","updated":"2026-07-23T19:32:40.652Z","title":"WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NerdPress","product":"Hubbub Lite","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-27399","published":"2026-07-23T11:17:56.328Z","updated":"2026-07-23T15:03:01.131Z","title":"WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebWizards","product":"MarketKing","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-27392","published":"2026-07-23T11:17:55.685Z","updated":"2026-07-23T13:34:50.359Z","title":"WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-27391","published":"2026-07-23T11:17:55.023Z","updated":"2026-07-23T13:34:05.961Z","title":"WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-27377","published":"2026-07-23T11:17:54.366Z","updated":"2026-07-23T14:54:03.075Z","title":"WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.7,"vendor":"axiomthemes","product":"QuickCal - Appointment Booking Calendar for WordPress","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-27372","published":"2026-07-23T11:17:53.712Z","updated":"2026-07-23T16:03:06.902Z","title":"WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pepro Dev. Group","product":"PeproDev Ultimate Invoice","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-27355","published":"2026-07-23T11:17:53.078Z","updated":"2026-07-23T14:18:16.707Z","title":"WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-27064","published":"2026-07-23T11:17:52.448Z","updated":"2026-07-23T15:02:08.355Z","title":"WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"EverPress","product":"Mailster","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-25466","published":"2026-07-23T11:17:51.814Z","updated":"2026-07-23T13:34:26.978Z","title":"WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGMaps","product":"WP Go Maps","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-25427","published":"2026-07-23T11:17:51.168Z","updated":"2026-07-23T13:34:28.653Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-25424","published":"2026-07-23T11:17:50.517Z","updated":"2026-07-23T14:54:12.497Z","title":"WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"mediavine","product":"Mediavine Control Panel","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-25405","published":"2026-07-23T11:17:49.885Z","updated":"2026-07-23T16:03:57.753Z","title":"WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24639","published":"2026-07-23T11:17:49.227Z","updated":"2026-07-23T14:16:46.391Z","title":"WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Ronald Huereca","product":"Photo Block","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-24628","published":"2026-07-23T11:17:48.587Z","updated":"2026-07-23T15:12:34.828Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-24552","published":"2026-07-23T11:17:47.929Z","updated":"2026-09-21T17:02:09.908Z","title":"WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"John-Michael L'Allier","product":"Create","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24537","published":"2026-07-23T11:17:47.280Z","updated":"2026-07-23T13:35:15.992Z","title":"WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Alex Volkov","product":"WP Accessibility Helper (WAH)","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68081","published":"2026-07-23T11:17:46.637Z","updated":"2026-07-23T14:54:19.963Z","title":"WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Lester Chan","product":"WP-Polls","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-61985","published":"2026-07-13T08:41:25.902Z","updated":"2026-07-13T10:07:35.856Z","title":"WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Car Rental Manager","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-61983","published":"2026-07-13T08:41:25.897Z","updated":"2026-07-13T14:19:36.054Z","title":"WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-61977","published":"2026-07-13T08:41:25.897Z","updated":"2026-07-13T14:30:13.175Z","title":"WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetSearch","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-61976","published":"2026-07-13T08:41:25.892Z","updated":"2026-07-13T13:46:29.399Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-61975","published":"2026-07-13T08:41:25.863Z","updated":"2026-07-13T13:13:44.946Z","title":"WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-61971","published":"2026-07-13T08:41:25.805Z","updated":"2026-07-13T14:38:02.877Z","title":"WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"LOW","score":2.7,"vendor":"Cozmoslabs","product":"User Profile Picture","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-61970","published":"2026-07-13T08:41:25.801Z","updated":"2026-07-13T10:08:07.875Z","title":"WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Themeisle","product":"Auto Featured Image (Auto Post Thumbnail)","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-61968","published":"2026-07-13T08:41:25.772Z","updated":"2026-07-13T14:19:50.158Z","title":"WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-61958","published":"2026-07-13T08:41:25.760Z","updated":"2026-07-13T14:12:13.745Z","title":"WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Saad Iqbal","product":"License Manager for WooCommerce","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-61956","published":"2026-07-13T08:41:25.755Z","updated":"2026-07-13T13:46:55.384Z","title":"WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"hamsalam","product":"ووسلام &#8211; همگام سازی ووکامرس و باسلام","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-61955","published":"2026-07-13T08:41:25.753Z","updated":"2026-07-13T13:14:55.632Z","title":"WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Hannan","product":"گرویتی فرم فارسی","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-59523","published":"2026-07-13T08:41:25.749Z","updated":"2026-10-09T16:53:46.759Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-61952","published":"2026-07-13T08:41:25.747Z","updated":"2026-07-13T14:38:06.766Z","title":"WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Jose Vega","product":"WooCommerce Bulk Edit Products – WP Sheet Editor","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-59521","published":"2026-07-13T08:41:25.743Z","updated":"2026-07-13T14:20:03.736Z","title":"WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ShapedPlugin LLC","product":"Real Testimonials","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-59518","published":"2026-07-13T08:41:25.715Z","updated":"2026-07-13T14:28:56.172Z","title":"WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-59516","published":"2026-07-13T08:41:25.661Z","updated":"2026-07-13T13:58:51.072Z","title":"WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Room 34 Creative Services, LLC","product":"ICS Calendar","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-59515","published":"2026-07-13T08:41:25.653Z","updated":"2026-07-13T13:15:13.545Z","title":"WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57816","published":"2026-07-13T08:41:25.624Z","updated":"2026-07-13T14:38:09.832Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FunnelKit","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57815","published":"2026-07-13T08:41:25.609Z","updated":"2026-07-13T10:25:20.611Z","title":"WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Forminator","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-57814","published":"2026-07-13T08:41:25.605Z","updated":"2026-07-13T14:20:16.879Z","title":"WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Forminator","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57813","published":"2026-07-13T08:41:25.602Z","updated":"2026-07-13T13:58:18.279Z","title":"WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"properfraction","product":"MailOptin","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-57812","published":"2026-07-13T08:41:25.598Z","updated":"2026-07-13T13:58:26.493Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57811","published":"2026-07-13T08:41:25.597Z","updated":"2026-07-13T13:15:28.359Z","title":"WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Realtyna","product":"Realtyna Organic IDX plugin","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57810","published":"2026-07-13T08:41:25.595Z","updated":"2026-07-13T14:38:12.921Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Saad Iqbal","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57805","published":"2026-07-13T08:41:25.570Z","updated":"2026-07-13T10:25:52.142Z","title":"WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Tonda","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57804","published":"2026-07-13T08:41:25.514Z","updated":"2026-08-14T10:41:08.147Z","title":"WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57803","published":"2026-07-13T08:41:25.507Z","updated":"2026-08-11T17:04:08.756Z","title":"WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Struktur Core","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57802","published":"2026-07-13T08:41:25.474Z","updated":"2026-08-11T17:19:21.885Z","title":"WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Struktur","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57801","published":"2026-07-13T08:41:25.460Z","updated":"2026-07-13T13:15:53.331Z","title":"WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"SetSail","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57800","published":"2026-07-13T08:41:25.455Z","updated":"2026-07-13T14:38:16.254Z","title":"WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Edge-Themes","product":"Overworld","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57799","published":"2026-07-13T08:41:25.453Z","updated":"2026-07-13T12:26:22.696Z","title":"WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"uxper","product":"Nuss","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57798","published":"2026-07-13T08:41:25.447Z","updated":"2026-07-13T16:07:49.469Z","title":"WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"SaurabhSharma","product":"NewsPlus Shortcodes","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57797","published":"2026-07-13T08:41:25.447Z","updated":"2026-07-13T14:01:36.352Z","title":"WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeMove","product":"EduMall","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-57796","published":"2026-07-13T08:41:25.446Z","updated":"2026-07-13T13:54:34.800Z","title":"WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"VLThemes","product":"Leedo","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57795","published":"2026-07-13T08:41:25.421Z","updated":"2026-07-13T13:18:09.257Z","title":"WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"themelexus","product":"Kitchor","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57794","published":"2026-07-13T08:41:25.368Z","updated":"2026-07-13T14:38:20.157Z","title":"WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"uxper","product":"Golo Framework","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57793","published":"2026-07-13T08:41:25.360Z","updated":"2026-07-13T12:27:00.497Z","title":"WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Elated-Themes","product":"Flow","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57792","published":"2026-07-13T08:41:25.324Z","updated":"2026-07-13T16:07:49.607Z","title":"WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Mikado-Themes","product":"Dør","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57791","published":"2026-07-13T08:41:25.316Z","updated":"2026-07-13T14:56:36.466Z","title":"WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeMove","product":"Brook","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57789","published":"2026-07-13T08:41:25.306Z","updated":"2026-07-13T13:19:25.793Z","title":"WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"jwsthemes","product":"Aqua","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57790","published":"2026-07-13T08:41:25.305Z","updated":"2026-07-13T13:54:12.104Z","title":"WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeMove","product":"Billey","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57788","published":"2026-07-13T08:41:25.301Z","updated":"2026-07-13T14:38:24.370Z","title":"WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Edge-Themes","product":"Aalto","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-57787","published":"2026-07-13T08:41:25.295Z","updated":"2026-07-13T13:31:32.655Z","title":"WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CreativeWS","product":"CWS SVGicons","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57786","published":"2026-07-13T08:41:25.295Z","updated":"2026-07-13T16:07:49.745Z","title":"WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"purethemes","product":"WorkScout-Core","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-57783","published":"2026-07-13T08:41:25.276Z","updated":"2026-07-13T14:55:25.034Z","title":"WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"merkulove","product":"Speaker","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57782","published":"2026-07-13T08:41:25.219Z","updated":"2026-07-13T13:52:10.603Z","title":"WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PressTigers","product":"Universal Clocks","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57781","published":"2026-07-13T08:41:25.215Z","updated":"2026-07-13T13:23:09.459Z","title":"WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Sovlix","product":"MeetingHub","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57780","published":"2026-07-13T08:41:25.176Z","updated":"2026-07-13T14:38:28.696Z","title":"WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugin Envision","product":"Envision Page Builder","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57779","published":"2026-07-13T08:41:25.168Z","updated":"2026-07-13T13:32:54.093Z","title":"WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Fascinate","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57778","published":"2026-07-13T08:41:25.158Z","updated":"2026-07-13T16:07:49.879Z","title":"WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdevart","product":"Booking calendar, Appointment Booking System","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57776","published":"2026-07-13T08:41:25.154Z","updated":"2026-07-13T14:27:26.750Z","title":"WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Wedding","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-57774","published":"2026-07-13T08:41:25.150Z","updated":"2026-07-13T13:53:45.683Z","title":"WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Food Corner","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-57773","published":"2026-07-13T08:41:25.149Z","updated":"2026-07-13T13:23:28.120Z","title":"WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Zorem","product":"Advanced Shipment Tracking for WooCommerce","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-57772","published":"2026-07-13T08:41:25.144Z","updated":"2026-07-13T14:38:31.763Z","title":"WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WP Inventory","product":"WP Inventory Manager","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57771","published":"2026-07-13T08:41:25.125Z","updated":"2026-07-13T13:34:08.233Z","title":"WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Milan Petrovic","product":"GD Rating System","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57770","published":"2026-07-13T08:41:25.073Z","updated":"2026-07-13T16:07:50.018Z","title":"WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Photography","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57768","published":"2026-07-13T08:41:25.067Z","updated":"2026-07-13T14:07:21.069Z","title":"WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.2,"vendor":"favethemes","product":"Houzez Login Register","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-57745","published":"2026-07-13T08:41:25.029Z","updated":"2026-07-13T13:53:26.976Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57744","published":"2026-07-13T08:41:25.019Z","updated":"2026-07-13T13:27:11.053Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57743","published":"2026-07-13T08:41:25.010Z","updated":"2026-07-13T14:38:35.637Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2026-57741","published":"2026-07-13T08:41:25.005Z","updated":"2026-07-13T13:37:41.971Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57739","published":"2026-07-13T08:41:24.999Z","updated":"2026-07-13T14:23:53.401Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57738","published":"2026-07-13T08:41:24.999Z","updated":"2026-07-13T13:53:01.682Z","title":"WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"777","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57740","published":"2026-07-13T08:41:24.997Z","updated":"2026-07-13T16:07:50.199Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-57734","published":"2026-07-13T08:41:24.978Z","updated":"2026-07-13T13:30:17.161Z","title":"WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57733","published":"2026-07-13T08:41:24.927Z","updated":"2026-07-13T14:38:38.728Z","title":"WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Cloud Library","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57732","published":"2026-07-13T08:41:24.922Z","updated":"2026-07-13T13:38:11.765Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57729","published":"2026-07-13T08:41:24.881Z","updated":"2026-07-13T16:07:50.341Z","title":"WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-57724","published":"2026-07-13T08:41:24.871Z","updated":"2026-07-13T13:38:35.873Z","title":"WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57725","published":"2026-07-13T08:41:24.863Z","updated":"2026-07-13T14:38:41.795Z","title":"WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57726","published":"2026-07-13T08:41:24.853Z","updated":"2026-07-13T13:30:34.515Z","title":"WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57728","published":"2026-07-13T08:41:24.852Z","updated":"2026-07-13T16:07:50.476Z","title":"WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57727","published":"2026-07-13T08:41:24.850Z","updated":"2026-10-19T06:43:16.157Z","title":"WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-57719","published":"2026-07-13T08:41:24.849Z","updated":"2026-07-13T16:07:50.613Z","title":"WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"CodeRevolution","product":"Aimogen Pro","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-57718","published":"2026-07-13T08:41:24.818Z","updated":"2026-07-13T16:07:50.756Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57715","published":"2026-07-13T08:41:24.777Z","updated":"2026-07-13T13:50:14.251Z","title":"WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Fluent CRM","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57714","published":"2026-07-13T08:41:24.759Z","updated":"2026-07-13T13:30:52.769Z","title":"WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"LatePoint","product":"LatePoint","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57713","published":"2026-07-13T08:41:24.693Z","updated":"2026-07-13T14:38:45.658Z","title":"WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Marcus (aka @msykes)","product":"Events Manager","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-57712","published":"2026-07-13T08:41:24.689Z","updated":"2026-07-13T13:39:32.425Z","title":"WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPZOOM","product":"WPZOOM Portfolio","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57711","published":"2026-07-13T08:41:24.688Z","updated":"2026-07-13T16:07:50.905Z","title":"WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57710","published":"2026-07-13T08:41:24.688Z","updated":"2026-07-13T16:07:51.047Z","title":"WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"quantumcloud","product":"WoowBot Pro Max","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-57709","published":"2026-07-13T08:41:24.686Z","updated":"2026-07-13T13:51:42.927Z","title":"WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"WP Swings","product":"Membership For WooCommerce","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-57707","published":"2026-07-13T08:41:24.686Z","updated":"2026-07-13T14:38:50.094Z","title":"WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"quantumcloud","product":"Simple Business Directory Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57708","published":"2026-07-13T08:41:24.683Z","updated":"2026-07-13T13:31:13.641Z","title":"WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CRM Perks","product":"Contact Form Entries","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57706","published":"2026-07-13T08:41:24.672Z","updated":"2026-07-13T13:40:24.015Z","title":"WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dokan, Inc.","product":"Dokan","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57705","published":"2026-07-13T08:41:24.629Z","updated":"2026-07-13T16:07:51.185Z","title":"WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-57702","published":"2026-07-13T08:41:24.612Z","updated":"2026-07-13T16:07:51.325Z","title":"WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Melograno Venture Studio","product":"Amelia","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-57698","published":"2026-07-13T08:41:24.541Z","updated":"2026-07-13T13:51:17.490Z","title":"WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Abandoned Cart Recovery for WooCommerce","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-57697","published":"2026-07-13T08:41:24.539Z","updated":"2026-07-13T13:31:33.330Z","title":"WordPress ProfileGrid  plugin <= 5.9.9.6 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-57695","published":"2026-07-13T08:41:24.538Z","updated":"2026-07-13T14:38:54.274Z","title":"WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dan Rossiter","product":"Document Gallery","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57693","published":"2026-07-13T08:41:24.533Z","updated":"2026-07-13T16:07:51.470Z","title":"WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57691","published":"2026-07-13T08:41:24.532Z","updated":"2026-07-13T16:07:51.627Z","title":"WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Eli","product":"Anti-Malware Security and Brute-Force Firewall","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57668","published":"2026-07-13T08:41:24.532Z","updated":"2026-07-13T13:50:56.456Z","title":"WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57694","published":"2026-07-13T08:41:24.530Z","updated":"2026-07-13T13:41:02.541Z","title":"WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-57424","published":"2026-07-13T08:41:24.518Z","updated":"2026-07-13T13:32:13.317Z","title":"WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"knitpay","product":"Razorpay Payment Links for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57423","published":"2026-07-13T08:41:24.483Z","updated":"2026-07-13T14:38:58.533Z","title":"WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kofi Mokome","product":"Message Filter for Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57422","published":"2026-07-13T08:41:24.464Z","updated":"2026-07-13T13:43:11.695Z","title":"WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"Bopo – WooCommerce Product Bundle Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57421","published":"2026-07-13T08:41:24.392Z","updated":"2026-07-13T16:07:51.774Z","title":"WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CRM Perks","product":"CRM Perks Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57420","published":"2026-07-13T08:41:24.389Z","updated":"2026-07-13T16:07:51.929Z","title":"WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Netrr","product":"Author Box WP Lens","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57418","published":"2026-07-13T08:41:24.384Z","updated":"2026-07-13T13:34:37.297Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-57417","published":"2026-07-13T08:41:24.382Z","updated":"2026-07-13T14:39:03.953Z","title":"WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RexTheme","product":"Cart Lift","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57419","published":"2026-07-13T08:41:24.381Z","updated":"2026-07-13T13:50:37.405Z","title":"WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fahad Mahmood","product":"Stock Locations for WooCommerce","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57416","published":"2026-07-13T08:41:24.380Z","updated":"2026-07-13T13:43:57.427Z","title":"WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SiteGround","product":"SiteGround Email Marketing","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57415","published":"2026-07-13T08:41:24.376Z","updated":"2026-07-13T16:07:52.073Z","title":"WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Codemenschen","product":"Gift Vouchers","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57414","published":"2026-07-13T08:41:24.371Z","updated":"2026-07-13T16:07:52.220Z","title":"WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"QuantumCloud","product":"ChatBot for eCommerce &#8211; WoowBot","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57413","published":"2026-07-13T08:41:24.334Z","updated":"2026-07-13T13:49:41.734Z","title":"WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"bdthemes","product":"Instant Image Generator","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-57412","published":"2026-07-13T08:41:24.318Z","updated":"2026-07-13T13:39:42.998Z","title":"WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Codemenschen","product":"Gift Vouchers","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57411","published":"2026-07-13T08:41:24.239Z","updated":"2026-07-13T14:39:08.470Z","title":"WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57410","published":"2026-07-13T08:41:24.238Z","updated":"2026-07-13T13:45:11.127Z","title":"WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"MailerPress Team","product":"MailerPress","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-57409","published":"2026-07-13T08:41:24.229Z","updated":"2026-07-13T16:07:52.367Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57408","published":"2026-07-13T08:41:24.226Z","updated":"2026-07-13T16:07:52.507Z","title":"WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"peachpayments","product":"Peach Payments Gateway","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57406","published":"2026-07-13T08:41:24.225Z","updated":"2026-07-13T13:41:42.672Z","title":"WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57407","published":"2026-07-13T08:41:24.224Z","updated":"2026-07-13T13:59:35.290Z","title":"WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Swings","product":"PDF Generator for WordPress","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-57404","published":"2026-07-13T08:41:24.223Z","updated":"2026-07-13T16:07:52.647Z","title":"WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57405","published":"2026-07-13T08:41:24.222Z","updated":"2026-07-13T14:39:11.681Z","title":"WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"themehunk","product":"Open Shop","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-57403","published":"2026-07-13T08:41:24.184Z","updated":"2026-07-13T16:07:52.788Z","title":"WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Milan Petrovic","product":"GD Security Headers","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57402","published":"2026-07-13T08:41:24.172Z","updated":"2026-07-13T16:07:52.935Z","title":"WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdesk","product":"Flexible Refund and Return Order for WooCommerce","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57401","published":"2026-07-13T08:41:24.092Z","updated":"2026-07-13T13:47:52.263Z","title":"WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2026-57400","published":"2026-07-13T08:41:24.089Z","updated":"2026-07-13T13:42:38.175Z","title":"WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Swings","product":"Event Tickets Manager for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57398","published":"2026-07-13T08:41:24.076Z","updated":"2026-07-13T13:46:49.710Z","title":"WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WebCodingPlace","product":"Real Estate Manager Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57399","published":"2026-07-13T08:41:24.074Z","updated":"2026-07-13T14:39:14.729Z","title":"WordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Proxy &amp; VPN Blocker","product":"Proxy &amp; VPN Blocker","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57396","published":"2026-07-13T08:41:24.073Z","updated":"2026-07-13T16:07:53.083Z","title":"WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Flintop","product":"Free Gifts for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57395","published":"2026-07-13T08:41:24.073Z","updated":"2026-07-13T16:07:53.244Z","title":"WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Tourfic","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-57393","published":"2026-07-13T08:41:24.069Z","updated":"2026-07-21T16:56:54.582Z","title":"WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"EDGARROJAS","product":"WooCommerce PDF Invoice Builder","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-57394","published":"2026-07-13T08:41:24.067Z","updated":"2026-07-13T13:49:18.549Z","title":"WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57392","published":"2026-07-13T08:41:24.035Z","updated":"2026-07-13T14:39:17.897Z","title":"WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Tourfic","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57391","published":"2026-07-13T08:41:24.025Z","updated":"2026-07-13T13:51:40.490Z","title":"WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tangible","product":"Loops & Logic","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-57390","published":"2026-07-13T08:41:23.947Z","updated":"2026-07-13T16:07:53.389Z","title":"WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"EDGARROJAS","product":"Extra Product Options Builder for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57389","published":"2026-07-13T08:41:23.939Z","updated":"2026-07-13T16:07:53.542Z","title":"WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-57388","published":"2026-07-13T08:41:23.926Z","updated":"2026-07-13T13:48:59.240Z","title":"WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57387","published":"2026-07-13T08:41:23.922Z","updated":"2026-07-13T13:42:56.072Z","title":"WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"picu","product":"picu","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57385","published":"2026-07-13T08:41:23.918Z","updated":"2026-07-13T13:52:49.955Z","title":"WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"appsbd","product":"Vitepos","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57383","published":"2026-07-13T08:41:23.918Z","updated":"2026-07-13T16:07:53.704Z","title":"WordPress JobSearch plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57382","published":"2026-07-13T08:41:23.918Z","updated":"2026-07-13T16:07:53.859Z","title":"WordPress Simple File List plugin <= 6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57386","published":"2026-07-13T08:41:23.914Z","updated":"2026-10-26T07:44:40.130Z","title":"WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Kodezen LLC","product":"aBlocks","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-57381","published":"2026-07-13T08:41:23.886Z","updated":"2026-07-13T13:48:41.243Z","title":"WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57379","published":"2026-07-13T08:41:23.800Z","updated":"2026-07-13T14:39:24.727Z","title":"WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPPOOL","product":"FormyChat","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57380","published":"2026-07-13T08:41:23.798Z","updated":"2026-07-13T13:44:19.714Z","title":"WordPress Extensions for Leaflet Map plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hupe13","product":"Extensions for Leaflet Map","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57378","published":"2026-07-13T08:41:23.794Z","updated":"2026-07-13T13:54:42.973Z","title":"WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Phil Kurth","product":"Advanced Forms","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-57364","published":"2026-07-13T08:41:23.764Z","updated":"2026-07-13T13:48:17.465Z","title":"WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-57368","published":"2026-07-13T08:41:23.763Z","updated":"2026-07-13T16:07:54.002Z","title":"WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57375","published":"2026-07-13T08:41:23.762Z","updated":"2026-07-13T13:47:23.506Z","title":"WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FluxBuilder","product":"MStore API","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-57372","published":"2026-07-13T08:41:23.761Z","updated":"2026-07-13T13:52:19.596Z","title":"WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-57371","published":"2026-07-13T08:41:23.759Z","updated":"2026-07-13T14:39:27.857Z","title":"WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-57363","published":"2026-07-13T08:41:23.759Z","updated":"2026-07-13T13:52:47.958Z","title":"WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57365","published":"2026-07-13T08:41:23.646Z","updated":"2026-07-13T16:07:54.165Z","title":"WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hitesh Chandwani","product":"reCAPTCHA (v2 &amp; v3) for Asgaros Forum","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57376","published":"2026-07-13T08:41:23.645Z","updated":"2026-07-13T16:07:54.325Z","title":"WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Element Invader","product":"ElementInvader Addons for Elementor","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57369","published":"2026-07-13T08:41:23.644Z","updated":"2026-07-13T13:58:15.685Z","title":"WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themifyme","product":"Themify Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57377","published":"2026-07-13T08:41:23.643Z","updated":"2026-07-13T16:07:54.478Z","title":"WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPXPO","product":"WowAddons","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57807","published":"2026-07-10T20:35:07.181Z","updated":"2026-07-21T14:11:27.317Z","title":"WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange Security Software Pvt Ltd.","product":"OAuth Single Sign On - SSO (OAuth Client)","kev":false,"epss":0.0073,"kevAdded":null},{"id":"CVE-2026-59520","published":"2026-07-05T21:44:29.015Z","updated":"2026-07-06T15:14:38.329Z","title":"WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"properfraction","product":"CrawlWP SEO","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-59519","published":"2026-07-05T21:42:33.988Z","updated":"2026-07-07T02:53:38.126Z","title":"WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Softaculous","product":"FormLayer","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-59511","published":"2026-07-05T21:36:39.476Z","updated":"2026-07-06T13:48:03.312Z","title":"WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tim Strifler","product":"Exclusive Addons Elementor","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-57760","published":"2026-07-02T11:33:08.861Z","updated":"2026-07-02T12:40:30.782Z","title":"WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Sendcloud","product":"Sendcloud Shipping","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57678","published":"2026-07-02T11:32:06.900Z","updated":"2026-07-02T12:21:24.825Z","title":"WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemePunch","product":"Slider Revolution","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56037","published":"2026-07-02T11:30:12.515Z","updated":"2026-07-02T15:52:31.034Z","title":"WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Themify","product":"Themify Popup","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-57766","published":"2026-07-02T11:16:07.503Z","updated":"2026-07-02T19:46:43.276Z","title":"WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"XplodedThemes","product":"WPIDE – File Manager & Code Editor","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57765","published":"2026-07-02T11:16:06.637Z","updated":"2026-07-02T19:41:12.121Z","title":"WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Levelfourdevelopment","product":"WP EasyCart","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57764","published":"2026-07-02T11:16:05.895Z","updated":"2026-07-02T13:58:17.905Z","title":"WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Surbma","product":"Surbma | Yoast SEO Breadcrumb Shortcode","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57763","published":"2026-07-02T11:16:05.094Z","updated":"2026-07-02T12:40:47.096Z","title":"WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gordon Böhme","product":"Structured Content","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57762","published":"2026-07-02T11:16:04.073Z","updated":"2026-07-02T11:58:18.447Z","title":"WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Andrew Fiebert","product":"Simple URLs","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-57761","published":"2026-07-02T11:16:02.973Z","updated":"2026-07-02T15:52:36.393Z","title":"WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"BlueAstralThemes","product":"SEOWP","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-57759","published":"2026-07-02T11:16:02.057Z","updated":"2026-09-30T07:18:30.876Z","title":"WordPress ProfileGrid  plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57758","published":"2026-07-02T11:16:00.814Z","updated":"2026-07-02T19:40:41.935Z","title":"WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"BeRocket","product":"Permalink Manager for WooCommerce","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-57757","published":"2026-07-02T11:15:59.819Z","updated":"2026-07-02T13:54:01.273Z","title":"WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"ploudapp","product":"pCloud WP Backup","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-57756","published":"2026-07-02T11:15:58.829Z","updated":"2026-07-02T12:40:12.344Z","title":"WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"友人a丶","product":"nicen-localize-image","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57755","published":"2026-07-02T11:15:57.949Z","updated":"2026-07-02T12:01:36.871Z","title":"WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Misbah WP","product":"Mosaic Gallery &#8211; Advanced Gallery","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57754","published":"2026-07-02T11:15:57.039Z","updated":"2026-07-02T15:52:41.535Z","title":"WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Livemesh","product":"Livemesh Addons for WPBakery Page Builder","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57753","published":"2026-07-02T11:15:56.022Z","updated":"2026-07-02T19:46:08.227Z","title":"WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nathanbarry","product":"Kit (formerly ConvertKit) for WooCommerce","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-57752","published":"2026-07-02T11:15:55.041Z","updated":"2026-07-02T19:40:26.895Z","title":"WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"iNET","product":"iNET Webkit","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57751","published":"2026-07-02T11:15:54.093Z","updated":"2026-07-02T13:48:48.500Z","title":"WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"Heateor Support","product":"Heateor Social Login","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-57750","published":"2026-07-02T11:15:53.121Z","updated":"2026-07-02T12:41:08.990Z","title":"WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Keksdieb","product":"ez Form Calculator Premium","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57749","published":"2026-07-02T11:15:51.971Z","updated":"2026-07-02T12:08:23.080Z","title":"WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeBoy","product":"SportsPress Pro","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-57748","published":"2026-07-02T11:15:51.064Z","updated":"2026-07-02T15:52:46.775Z","title":"WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Shopify Help Center","product":"Shopify","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-57747","published":"2026-07-02T11:15:49.986Z","updated":"2026-07-02T19:45:54.787Z","title":"WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeREX","product":"Booked","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-57746","published":"2026-07-02T11:15:49.159Z","updated":"2026-07-02T19:40:12.149Z","title":"WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX","product":"Booked","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-57731","published":"2026-07-02T11:15:48.309Z","updated":"2026-07-02T13:41:12.831Z","title":"WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-57730","published":"2026-07-02T11:15:47.270Z","updated":"2026-07-02T12:41:30.001Z","title":"WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-57690","published":"2026-07-02T11:15:46.156Z","updated":"2026-07-02T12:08:49.762Z","title":"WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-57689","published":"2026-07-02T11:15:45.096Z","updated":"2026-07-02T15:52:52.711Z","title":"WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-57688","published":"2026-07-02T11:15:44.112Z","updated":"2026-07-02T19:45:40.946Z","title":"WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Gurmehub","product":"POS Entegratör","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-57687","published":"2026-07-02T11:15:43.062Z","updated":"2026-07-02T19:39:57.078Z","title":"WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Hiroaki Miyashita","product":"Custom Field Template","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57686","published":"2026-07-02T11:15:42.213Z","updated":"2026-07-02T13:55:19.542Z","title":"WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPXPO","product":"WowAddons","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57685","published":"2026-07-02T11:15:41.410Z","updated":"2026-07-02T12:41:48.874Z","title":"WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"drfuri","product":"Martfury - WooCommerce Marketplace WordPress Theme","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-57684","published":"2026-07-02T11:15:40.513Z","updated":"2026-07-02T12:09:10.659Z","title":"WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tranmautritam","product":"TheFox","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57683","published":"2026-07-02T11:15:39.645Z","updated":"2026-07-02T15:52:58.310Z","title":"WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Epsiloncool","product":"WP Fast Total Search","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57682","published":"2026-07-02T11:15:38.688Z","updated":"2026-07-02T19:45:25.905Z","title":"WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuantumCloud","product":"Simple Link Directory","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57681","published":"2026-07-02T11:15:37.858Z","updated":"2026-07-02T19:39:43.639Z","title":"WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-57680","published":"2026-07-02T11:15:36.880Z","updated":"2026-07-02T13:46:34.079Z","title":"WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57679","published":"2026-07-02T11:15:36.020Z","updated":"2026-07-02T12:42:12.099Z","title":"WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ahmadgb","product":"GeekyBot","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-57677","published":"2026-07-02T11:15:35.175Z","updated":"2026-07-02T12:09:37.862Z","title":"WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Novalnet","product":"Novalnet Payment Gateway for WooCommerce","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57675","published":"2026-07-02T11:15:34.376Z","updated":"2026-07-02T15:53:05.993Z","title":"WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57674","published":"2026-07-02T11:15:33.276Z","updated":"2026-07-02T19:45:09.915Z","title":"WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57673","published":"2026-07-02T11:15:32.255Z","updated":"2026-07-02T19:39:29.404Z","title":"WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Optimole","product":"Optimole","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57672","published":"2026-07-02T11:15:31.433Z","updated":"2026-07-02T14:34:19.764Z","title":"WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Melograno Venture Studio","product":"wpDataTables","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57671","published":"2026-07-02T11:15:30.540Z","updated":"2026-07-02T12:39:50.501Z","title":"WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Perfmatters","product":"perfmatters","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57670","published":"2026-07-02T11:15:29.530Z","updated":"2026-07-02T12:10:00.416Z","title":"WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Codepeople","product":"Google Maps CP","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57669","published":"2026-07-02T11:15:28.678Z","updated":"2026-07-02T15:53:11.900Z","title":"WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vsourz Digital","product":"Advanced Contact form 7 DB","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-57625","published":"2026-07-02T11:15:27.684Z","updated":"2026-07-02T19:44:52.133Z","title":"WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"ASE","product":"Admin and Site Enhancements (ASE) Pro","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-57624","published":"2026-07-02T11:15:26.664Z","updated":"2026-07-02T19:39:14.229Z","title":"WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Creative Themes","product":"Blocksy Companion Pro","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-57623","published":"2026-07-02T11:15:25.775Z","updated":"2026-07-02T14:37:19.947Z","title":"WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9,"vendor":"BoldGrid","product":"W3 Total Cache","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-57621","published":"2026-07-02T11:15:24.897Z","updated":"2026-07-02T12:42:35.622Z","title":"WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-57426","published":"2026-07-02T11:15:23.860Z","updated":"2026-07-02T12:10:28.862Z","title":"WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Chill Media Labs S.R.L.","product":"Modula - PRO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57366","published":"2026-07-02T11:15:22.825Z","updated":"2026-07-02T15:53:17.236Z","title":"WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57362","published":"2026-07-02T11:15:21.960Z","updated":"2026-07-02T19:44:09.312Z","title":"WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57361","published":"2026-07-02T11:15:21.096Z","updated":"2026-07-02T19:45:39.467Z","title":"WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57360","published":"2026-07-02T11:15:20.147Z","updated":"2026-07-02T14:32:52.699Z","title":"WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57359","published":"2026-07-02T11:15:19.229Z","updated":"2026-07-02T12:42:52.044Z","title":"WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ReviewX","product":"ReviewX","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57358","published":"2026-07-02T11:15:18.297Z","updated":"2026-07-02T12:10:49.926Z","title":"WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SysBasics","product":"Customize My Account for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57357","published":"2026-07-02T11:15:17.451Z","updated":"2026-07-02T15:53:22.538Z","title":"WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Search Atlas Group","product":"Search Atlas SEO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57356","published":"2026-07-02T11:15:16.231Z","updated":"2026-07-02T19:43:55.556Z","title":"WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Moreconvert Team","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57355","published":"2026-07-02T11:15:15.123Z","updated":"2026-07-02T14:58:13.199Z","title":"WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57354","published":"2026-07-02T11:15:14.184Z","updated":"2026-07-02T14:35:43.161Z","title":"WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetReviews","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57353","published":"2026-07-02T11:15:13.364Z","updated":"2026-07-02T12:43:08.999Z","title":"WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LinkWhisper","product":"Link Whisper Premium","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57352","published":"2026-07-02T11:15:12.503Z","updated":"2026-07-02T12:11:14.988Z","title":"WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":4.8,"vendor":"VillaTheme","product":"ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-57351","published":"2026-07-02T11:15:11.655Z","updated":"2026-07-02T15:53:27.892Z","title":"WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Haktan Suren","product":"HandL UTM Grabber","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57350","published":"2026-07-02T11:15:10.800Z","updated":"2026-07-02T19:43:42.128Z","title":"WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Andy Fragen","product":"WP Debugging","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57349","published":"2026-07-02T11:15:09.990Z","updated":"2026-07-02T14:57:14.205Z","title":"WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"etruel","product":"WPeMatico RSS Feed Fetcher","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57348","published":"2026-07-02T11:15:09.176Z","updated":"2026-07-02T14:08:50.836Z","title":"WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-57347","published":"2026-07-02T11:15:08.324Z","updated":"2026-07-02T12:43:26.221Z","title":"WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jetmonsters","product":"Hotel Booking Lite","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-57345","published":"2026-07-02T11:15:07.465Z","updated":"2026-07-02T12:14:00.631Z","title":"WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Webraketen","product":"Internal Links Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57344","published":"2026-07-02T11:15:06.634Z","updated":"2026-07-02T15:53:33.162Z","title":"WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57343","published":"2026-07-02T11:15:05.510Z","updated":"2026-07-02T19:43:28.706Z","title":"WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Contempoinc","product":"Real Estate 7","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57342","published":"2026-07-02T11:15:04.435Z","updated":"2026-07-02T14:56:19.868Z","title":"WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShortPixel","product":"ShortPixel Adaptive Images","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-49779","published":"2026-07-02T11:15:03.479Z","updated":"2026-07-28T14:20:33.630Z","title":"WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Addify","product":"Tax Exempt for WooCommerce","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-42382","published":"2026-07-02T11:15:02.678Z","updated":"2026-07-02T12:39:29.644Z","title":"WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Audrey","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-39448","published":"2026-07-02T11:15:01.778Z","updated":"2026-07-02T12:11:44.427Z","title":"WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"CoderPress","product":"NOWPayments for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-27436","published":"2026-07-02T11:15:00.887Z","updated":"2026-07-02T15:53:38.941Z","title":"WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Rustaurius","product":"Five Star Business Profile and Schema","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-27433","published":"2026-07-02T11:14:59.997Z","updated":"2026-10-16T11:21:43.949Z","title":"WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-27430","published":"2026-07-02T11:14:59.114Z","updated":"2026-07-02T14:55:50.891Z","title":"WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tranmautritam","product":"TheFox","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27426","published":"2026-07-02T11:14:58.150Z","updated":"2026-07-02T14:46:13.248Z","title":"WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themesuite","product":"Automotive Car Dealership Business","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27425","published":"2026-07-02T11:14:57.235Z","updated":"2026-07-02T12:47:35.285Z","title":"WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themesuite","product":"Automotive Listings","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27419","published":"2026-07-02T11:14:56.371Z","updated":"2026-07-02T12:12:11.625Z","title":"WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Zozothemes","product":"Zegen","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-27414","published":"2026-07-02T11:14:55.517Z","updated":"2026-07-02T15:53:44.804Z","title":"WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-27412","published":"2026-07-02T11:14:54.552Z","updated":"2026-07-02T19:43:01.771Z","title":"WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"StylemixThemes","product":"Pearl - Corporate Business","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-27408","published":"2026-07-02T11:14:53.444Z","updated":"2026-10-12T12:28:17.107Z","title":"WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"imithemes","product":"NativeChurch","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27404","published":"2026-07-02T11:14:52.554Z","updated":"2026-07-02T14:51:33.339Z","title":"WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"LMS","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27402","published":"2026-07-02T11:14:51.643Z","updated":"2026-07-02T12:48:15.305Z","title":"WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"Kids Life | Children School WordPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27060","published":"2026-07-02T11:14:50.700Z","updated":"2026-08-03T09:55:06.664Z","title":"WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Repute Infosystems","product":"ARMember Premium","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2025-69156","published":"2026-07-02T11:14:49.805Z","updated":"2026-07-02T15:53:51.784Z","title":"WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Design themes","product":"Kids Zone - Children WordPress Theme","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-69155","published":"2026-07-02T11:14:48.838Z","updated":"2026-07-02T19:42:48.313Z","title":"WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"Fitness Zone WordPress Theme","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-69154","published":"2026-07-02T11:14:47.632Z","updated":"2026-07-02T14:54:49.155Z","title":"WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"SpaLab | Beauty Salon WordPress Theme","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-69153","published":"2026-07-02T11:14:46.468Z","updated":"2026-07-02T14:44:40.367Z","title":"WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"Trendy Travel","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-69152","published":"2026-07-02T11:14:45.464Z","updated":"2026-07-02T12:50:09.625Z","title":"WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Artale | Wedding Photography WordPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-69134","published":"2026-07-02T11:14:44.457Z","updated":"2026-07-02T12:13:33.033Z","title":"WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Merkulove","product":"OpenAI Chatbot for WordPress – Helper","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-69133","published":"2026-07-02T11:14:43.488Z","updated":"2026-07-02T15:53:57.062Z","title":"WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"GoodLayers","product":"Tourmaster","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-69132","published":"2026-07-02T11:14:42.311Z","updated":"2026-07-02T19:42:34.931Z","title":"WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Zozothemes","product":"Corpkit","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-69094","published":"2026-07-02T11:14:41.285Z","updated":"2026-07-02T14:54:16.860Z","title":"WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ThemeMove","product":"Unicamp","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2025-66076","published":"2026-07-02T11:14:40.329Z","updated":"2026-07-02T14:52:09.760Z","title":"WordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"dylan ngo","product":"Woostify Sites Library","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-58902","published":"2026-07-02T11:14:39.340Z","updated":"2026-07-02T12:51:06.576Z","title":"WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Lighthouse","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-57737","published":"2026-07-01T17:42:27.536Z","updated":"2026-10-07T14:58:20.405Z","title":"WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Averta LTD","product":"Shortcodes and extra features for Phlox theme","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57736","published":"2026-07-01T17:40:57.023Z","updated":"2026-07-01T17:59:06.101Z","title":"WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.4,"vendor":"HubSpot","product":"HubSpot","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-57723","published":"2026-07-01T17:08:43.612Z","updated":"2026-07-01T17:57:59.550Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-57722","published":"2026-07-01T17:07:22.030Z","updated":"2026-07-02T14:33:30.032Z","title":"WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ShortPixel","product":"Enable Media Replace","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-57721","published":"2026-07-01T16:56:43.766Z","updated":"2026-07-01T18:04:55.782Z","title":"WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Reloaded","product":"ApplyOnline","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57720","published":"2026-07-01T16:55:14.495Z","updated":"2026-07-01T18:09:44.678Z","title":"WordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codexpert Inc","product":"ThumbPress","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-27409","published":"2026-07-01T16:07:56.891Z","updated":"2026-07-01T17:34:50.305Z","title":"WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-57692","published":"2026-07-01T13:34:09.184Z","updated":"2026-07-01T14:25:49.078Z","title":"WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"LCweb","product":"PrivateContent","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-27435","published":"2026-07-01T08:50:05.943Z","updated":"2026-07-01T10:22:34.470Z","title":"WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WofficeIO","product":"Woffice","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57341","published":"2026-06-29T13:36:42.438Z","updated":"2026-07-01T10:22:54.867Z","title":"WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Colissimo","product":"Colissimo Officiel : Méthodes de livraison pour WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57340","published":"2026-06-29T13:36:41.764Z","updated":"2026-06-29T15:56:14.173Z","title":"WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"shohei.tanaka","product":"Japanized For WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57339","published":"2026-06-29T13:36:41.106Z","updated":"2026-06-29T15:51:01.110Z","title":"WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57338","published":"2026-06-29T13:36:40.447Z","updated":"2026-06-29T15:07:22.720Z","title":"WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Repute InfoSystems","product":"ARForms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57337","published":"2026-06-29T13:36:39.730Z","updated":"2026-06-29T15:19:29.798Z","title":"WordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginOps","product":"Landing Page Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57336","published":"2026-06-29T13:36:39.074Z","updated":"2026-06-29T15:15:44.694Z","title":"WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Astoundify","product":"Jobify","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57335","published":"2026-06-29T13:36:38.421Z","updated":"2026-07-01T10:23:13.738Z","title":"WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ads WPQuads","product":"Ads by WPQuads","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57334","published":"2026-06-29T13:36:37.761Z","updated":"2026-06-29T15:53:10.432Z","title":"WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57333","published":"2026-06-29T13:36:37.099Z","updated":"2026-06-29T15:50:41.328Z","title":"WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spencer Haws","product":"Link Whisper Free","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57332","published":"2026-06-29T13:36:36.449Z","updated":"2026-06-29T15:07:09.783Z","title":"WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Wallet System for WooCommerce","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-57331","published":"2026-06-29T13:36:35.784Z","updated":"2026-06-29T15:19:37.044Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.9,"vendor":"videowhisper","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2026-57330","published":"2026-06-29T13:36:35.137Z","updated":"2026-06-29T15:09:02.472Z","title":"WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57329","published":"2026-06-29T13:36:34.473Z","updated":"2026-07-01T10:23:31.309Z","title":"WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WOOCOMMERCE DESIGNER PRO","product":"WooCommerce Designer Pro","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57328","published":"2026-06-29T13:36:33.818Z","updated":"2026-06-29T15:51:34.682Z","title":"WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57327","published":"2026-06-29T13:36:33.156Z","updated":"2026-06-29T15:50:20.991Z","title":"WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"mainwp","product":"MainWP","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-57326","published":"2026-06-29T13:36:32.484Z","updated":"2026-06-29T15:06:51.848Z","title":"WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-57320","published":"2026-06-29T13:36:31.832Z","updated":"2026-06-29T15:19:43.806Z","title":"WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"BEAR","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57346","published":"2026-06-29T09:50:51.952Z","updated":"2026-06-29T10:30:38.112Z","title":"WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.1,"vendor":"Epiphyt","product":"Embed Privacy","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-57676","published":"2026-06-29T08:19:51.896Z","updated":"2026-07-08T19:42:22.691Z","title":"WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Matteo Manna","product":"Simple User Avatar","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-57667","published":"2026-06-26T14:53:32.075Z","updated":"2026-06-29T13:36:16.523Z","title":"WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57665","published":"2026-06-26T14:53:31.426Z","updated":"2026-06-26T15:36:30.894Z","title":"WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"GravityKit","product":"GravityView","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-57664","published":"2026-06-26T14:53:30.734Z","updated":"2026-06-26T15:31:21.319Z","title":"WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"Bopo – WooCommerce Product Bundle Builder","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-57663","published":"2026-06-26T14:53:30.089Z","updated":"2026-06-26T17:42:07.495Z","title":"WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Igor Benic","product":"Recipe Maker For Your Food Blog from Zip Recipes","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57662","published":"2026-06-26T14:53:29.428Z","updated":"2026-06-26T16:35:43.127Z","title":"WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57661","published":"2026-06-26T14:53:28.777Z","updated":"2026-06-26T20:15:19.229Z","title":"WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nexcess","product":"WPComplete","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-57660","published":"2026-06-26T14:53:28.130Z","updated":"2026-06-29T13:44:33.339Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-57659","published":"2026-06-26T14:53:27.478Z","updated":"2026-06-26T15:37:05.157Z","title":"WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Stranger Studios","product":"Paid Memberships Pro - Add Member From Admin","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-57658","published":"2026-06-26T14:53:26.838Z","updated":"2026-06-26T15:31:34.376Z","title":"WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Templatespare","product":"TemplateSpare","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-57657","published":"2026-06-26T14:53:26.192Z","updated":"2026-06-26T17:42:14.355Z","title":"WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Noor Alam","product":"Gmail SMTP","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-57656","published":"2026-06-26T14:53:25.541Z","updated":"2026-06-26T16:36:27.608Z","title":"WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"peregrinethemes","product":"Hester Core","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-57655","published":"2026-06-26T14:53:24.884Z","updated":"2026-06-26T20:15:32.578Z","title":"WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.2,"vendor":"Jay Versluis","product":"Child Theme Wizard","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-57654","published":"2026-06-26T14:53:24.234Z","updated":"2026-06-29T13:34:01.282Z","title":"WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-57653","published":"2026-06-26T14:53:23.586Z","updated":"2026-06-26T15:38:45.346Z","title":"WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57652","published":"2026-06-26T14:53:22.937Z","updated":"2026-06-26T15:31:47.191Z","title":"WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-57651","published":"2026-06-26T14:53:22.279Z","updated":"2026-06-26T17:42:21.035Z","title":"WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nK","product":"Ghost Kit","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57650","published":"2026-06-26T14:53:21.629Z","updated":"2026-06-26T16:36:56.163Z","title":"WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BlockArt","product":"Magazine Blocks","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57649","published":"2026-06-26T14:53:20.966Z","updated":"2026-06-26T20:15:46.693Z","title":"WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"studiowombat","product":"Shoppable Images Lite","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-57648","published":"2026-06-26T14:53:20.322Z","updated":"2026-06-29T14:40:27.508Z","title":"WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nelio Software","product":"Nelio Content","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-57647","published":"2026-06-26T14:53:19.663Z","updated":"2026-06-26T15:39:08.759Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-57646","published":"2026-06-26T14:53:19.003Z","updated":"2026-06-26T15:32:00.111Z","title":"WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-57645","published":"2026-06-26T14:53:18.354Z","updated":"2026-06-26T17:42:27.162Z","title":"WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-57644","published":"2026-06-26T14:53:17.701Z","updated":"2026-06-26T16:37:20.308Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57643","published":"2026-06-26T14:53:17.058Z","updated":"2026-06-26T20:16:00.217Z","title":"WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AF themes","product":"WP Post Author","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57642","published":"2026-06-26T14:53:16.363Z","updated":"2026-06-29T15:54:11.802Z","title":"WordPress Gallery  plugin <= 4.7.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"bestwebsoft","product":"Gallery","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57641","published":"2026-06-26T14:53:15.722Z","updated":"2026-06-26T15:36:01.540Z","title":"WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Contempoinc","product":"Real Estate 7","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-57640","published":"2026-06-26T14:53:15.063Z","updated":"2026-06-26T15:32:14.383Z","title":"WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-57638","published":"2026-06-26T14:53:14.405Z","updated":"2026-06-26T17:42:33.907Z","title":"WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPManageNinja LLC","product":"Fluent Booking","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57637","published":"2026-06-26T14:53:13.741Z","updated":"2026-06-26T16:37:47.268Z","title":"WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tychesoftwares","product":"Abandoned Cart Lite for WooCommerce","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-57636","published":"2026-06-26T14:53:13.087Z","updated":"2026-06-26T20:16:14.624Z","title":"WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-57635","published":"2026-06-26T14:53:12.453Z","updated":"2026-06-29T13:31:31.986Z","title":"WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FunnelKit","product":"FunnelKit Payment Gateway for Stripe WooCommerce","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-57634","published":"2026-06-26T14:53:11.795Z","updated":"2026-06-26T15:40:08.022Z","title":"WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Folio Team","product":"PPWP","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-57633","published":"2026-06-26T14:53:11.150Z","updated":"2026-06-26T15:32:27.692Z","title":"WordPress WCBoost &#8211; Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WCBoost","product":"WCBoost &#8211; Products Compare","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-57632","published":"2026-06-26T14:53:10.487Z","updated":"2026-06-26T17:42:40.478Z","title":"WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Omnisend","product":"Email Marketing for WooCommerce by Omnisend","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-57631","published":"2026-06-26T14:53:09.825Z","updated":"2026-06-26T16:39:06.326Z","title":"WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ays Pro","product":"Popup box","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-57630","published":"2026-06-26T14:53:09.171Z","updated":"2026-06-26T20:16:28.803Z","title":"WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Creative Themes","product":"Blocksy Companion Pro","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-57629","published":"2026-06-26T14:53:08.526Z","updated":"2026-06-29T14:50:30.346Z","title":"WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StatCounter","product":"StatCounter","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57628","published":"2026-06-26T14:53:07.860Z","updated":"2026-06-26T15:40:28.628Z","title":"WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WP All Import","product":"WP All Import","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-57627","published":"2026-06-26T14:53:07.203Z","updated":"2026-06-26T15:32:40.338Z","title":"WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-57622","published":"2026-06-26T14:53:06.559Z","updated":"2026-06-26T17:42:46.942Z","title":"WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"WPCafe","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-57618","published":"2026-06-26T14:53:05.913Z","updated":"2026-06-26T16:42:20.403Z","title":"WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeisle","product":"Neve PRO","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57617","published":"2026-06-26T14:53:05.256Z","updated":"2026-06-26T20:16:42.414Z","title":"WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SeedProd LLC.","product":"SeedProd Pro","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57431","published":"2026-06-26T14:53:04.596Z","updated":"2026-06-29T14:43:54.189Z","title":"WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mervin Praison","product":"Featured Image","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57430","published":"2026-06-26T14:53:03.932Z","updated":"2026-06-26T15:40:55.902Z","title":"WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SEOPress Free","product":"SEOPress PRO","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-57325","published":"2026-06-26T14:53:03.286Z","updated":"2026-06-26T15:32:55.876Z","title":"WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jellywp","product":"NanoMag","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57324","published":"2026-06-26T14:53:02.628Z","updated":"2026-06-26T17:42:53.173Z","title":"WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"GIFT4U","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-57323","published":"2026-06-26T14:53:01.979Z","updated":"2026-06-26T16:45:33.682Z","title":"WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.8,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-57322","published":"2026-06-26T14:53:01.332Z","updated":"2026-09-18T16:17:23.546Z","title":"WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"weMail","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57321","published":"2026-06-26T14:53:00.676Z","updated":"2026-06-29T15:01:00.541Z","title":"WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.1,"vendor":"icc0rz","product":"H5P","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-57319","published":"2026-06-26T14:53:00.002Z","updated":"2026-06-26T15:41:17.083Z","title":"WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"FOX","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57318","published":"2026-06-26T14:52:59.345Z","updated":"2026-06-26T15:33:11.570Z","title":"WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-57317","published":"2026-06-26T14:52:58.704Z","updated":"2026-06-26T17:42:59.223Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-57316","published":"2026-06-26T14:52:58.050Z","updated":"2026-06-26T16:47:04.370Z","title":"WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"GetGenie","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-57315","published":"2026-06-26T14:52:57.384Z","updated":"2026-06-26T20:17:10.083Z","title":"WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.5,"vendor":"Creative Themes","product":"Blocksy Companion Pro","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-57314","published":"2026-06-26T14:52:56.741Z","updated":"2026-06-29T15:05:58.836Z","title":"WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-57313","published":"2026-06-26T14:52:56.086Z","updated":"2026-06-26T15:39:38.472Z","title":"WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57312","published":"2026-06-26T14:52:55.425Z","updated":"2026-06-26T15:33:29.091Z","title":"WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpeverest","product":"Everest Forms","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56072","published":"2026-06-26T14:52:54.753Z","updated":"2026-06-26T17:43:06.782Z","title":"WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Xtemos","product":"WoodMart","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56070","published":"2026-06-26T14:52:54.109Z","updated":"2026-06-26T16:47:47.692Z","title":"WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThemeHunk","product":"Advance Product Search","kev":false,"epss":0.01438,"kevAdded":null},{"id":"CVE-2026-56069","published":"2026-06-26T14:52:53.450Z","updated":"2026-06-26T20:17:24.275Z","title":"WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Site Building with Toolset","product":"Toolset Forms","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-56068","published":"2026-06-26T14:52:52.646Z","updated":"2026-06-29T14:48:13.999Z","title":"WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-56067","published":"2026-06-26T14:52:51.998Z","updated":"2026-06-26T15:42:23.568Z","title":"WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetSmartFilters","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-56066","published":"2026-06-26T14:52:51.326Z","updated":"2026-06-26T15:35:20.631Z","title":"WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":5.8,"vendor":"ShortPixel","product":"ShortPixel Adaptive Images","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-56064","published":"2026-06-26T14:52:50.668Z","updated":"2026-06-26T17:43:12.723Z","title":"WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Themefic","product":"Tourfic","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-56063","published":"2026-06-26T14:52:50.015Z","updated":"2026-06-26T16:55:45.464Z","title":"WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability","severity":"HIGH","score":8.3,"vendor":"bPlugins","product":"MailChimp Block","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-56062","published":"2026-06-26T14:52:49.362Z","updated":"2026-06-26T20:17:38.123Z","title":"WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"oooorgle","product":"Quotes llama","kev":false,"epss":0.01438,"kevAdded":null},{"id":"CVE-2026-56061","published":"2026-06-26T14:52:48.708Z","updated":"2026-06-29T15:07:11.346Z","title":"WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Subscriptions for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-56060","published":"2026-06-26T14:52:48.043Z","updated":"2026-06-26T15:46:37.853Z","title":"WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"tychesoftwares","product":"Print Invoice & Delivery Notes for WooCommerce","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-56059","published":"2026-06-26T14:52:47.378Z","updated":"2026-06-26T15:33:48.737Z","title":"WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"PhysCode","product":"Travel Booking","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-56058","published":"2026-06-26T14:52:46.731Z","updated":"2026-06-26T17:43:18.868Z","title":"WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"ThemeCatcher","product":"Quform","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-56057","published":"2026-06-26T14:52:46.096Z","updated":"2026-06-26T16:48:56.403Z","title":"WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Uncanny Owl","product":"Uncanny Automator Pro","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-56055","published":"2026-06-26T14:52:45.439Z","updated":"2026-06-26T20:17:51.689Z","title":"WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"InspiryThemes","product":"RealHomes","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-56048","published":"2026-06-26T14:52:44.766Z","updated":"2026-06-29T15:44:35.286Z","title":"WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tychesoftwares","product":"Payment Gateway Based Fees and Discounts for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-56047","published":"2026-06-26T14:52:44.114Z","updated":"2026-06-26T15:47:05.480Z","title":"WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Perfmatters, Powered Kinsta + GeneratePress Docs Changelog Feature requests Legal Affiliate Contact","product":"perfmatters","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56046","published":"2026-06-26T14:52:43.470Z","updated":"2026-06-26T15:34:08.453Z","title":"WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-56045","published":"2026-06-26T14:52:42.816Z","updated":"2026-06-26T17:43:25.021Z","title":"WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ValvePress","product":"Automatic","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56044","published":"2026-06-26T14:52:42.147Z","updated":"2026-06-26T16:57:19.755Z","title":"WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Adenion","product":"Blog2Social","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56043","published":"2026-06-26T14:52:41.497Z","updated":"2026-06-26T20:18:06.738Z","title":"WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CusRev","product":"Customer Reviews for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56041","published":"2026-06-26T14:52:40.838Z","updated":"2026-06-29T15:15:17.684Z","title":"WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dFactory","product":"Responsive Lightbox","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56040","published":"2026-06-26T14:52:40.192Z","updated":"2026-06-26T15:47:42.331Z","title":"WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WordPress.com","product":"Gutenverse Form","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56039","published":"2026-06-26T14:52:39.543Z","updated":"2026-06-26T15:34:24.953Z","title":"WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WordPress.com","product":"Quick Interest Slider","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56038","published":"2026-06-26T14:52:38.838Z","updated":"2026-06-26T17:43:31.563Z","title":"WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Frisbii","product":"Frisbii Pay","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-56036","published":"2026-06-26T14:52:38.185Z","updated":"2026-06-26T16:58:28.485Z","title":"WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"codemstory","product":"워드프레스 결제 심플페이","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-56035","published":"2026-06-26T14:52:37.531Z","updated":"2026-06-26T20:18:20.295Z","title":"WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability","severity":"HIGH","score":8.6,"vendor":"Cory Marsh","product":"BitFire Security","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-56034","published":"2026-06-26T14:52:36.866Z","updated":"2026-06-29T15:18:50.836Z","title":"WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Online Web Tutor","product":"Library Management System","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-56033","published":"2026-06-26T14:52:36.222Z","updated":"2026-06-26T15:41:50.366Z","title":"WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Dokan Multivendor Plugin","product":"Dokan Pro","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-56032","published":"2026-06-26T14:52:35.578Z","updated":"2026-06-26T15:34:59.413Z","title":"WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-56031","published":"2026-06-26T14:52:34.930Z","updated":"2026-06-26T17:43:37.733Z","title":"WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-56030","published":"2026-06-26T14:52:34.282Z","updated":"2026-06-26T17:01:36.044Z","title":"WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"paytiumsupport","product":"Paytium","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-56029","published":"2026-06-26T14:52:33.630Z","updated":"2026-06-26T20:18:33.762Z","title":"WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"corvuspay","product":"CorvusPay WooCommerce Payment Gateway","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-56028","published":"2026-06-26T14:52:32.977Z","updated":"2026-06-29T17:45:21.694Z","title":"WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themewant","product":"Easy Elements for Elementor &#8211; Addons &amp; Website Templates","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-56027","published":"2026-06-26T14:52:32.329Z","updated":"2026-06-26T15:49:48.450Z","title":"WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-56026","published":"2026-06-26T14:52:31.651Z","updated":"2026-06-26T15:35:36.189Z","title":"WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Chris Carlevato","product":"utm.codes","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-56025","published":"2026-06-26T14:52:31.002Z","updated":"2026-06-26T17:43:44.162Z","title":"WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Paymob","product":"Paymob for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-56011","published":"2026-06-26T14:52:30.259Z","updated":"2026-06-26T17:04:26.616Z","title":"WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"chrisvrichardson","product":"MapPress Maps for WordPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56010","published":"2026-06-26T14:52:29.594Z","updated":"2026-06-26T20:18:47.172Z","title":"WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Tyche Softwares.","product":"Abandoned Cart Pro for WooCommerce","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-56008","published":"2026-06-26T14:52:28.955Z","updated":"2026-06-29T16:04:31.030Z","title":"WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-54847","published":"2026-06-26T14:52:28.304Z","updated":"2026-06-26T15:50:27.598Z","title":"WordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Design","product":"Stylish Cost Calculator","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-54846","published":"2026-06-26T14:52:27.655Z","updated":"2026-06-26T15:37:59.960Z","title":"WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"akosglys","product":"Syncee Premium Dropshipping &amp; Wholesale","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-54840","published":"2026-06-26T14:52:27.015Z","updated":"2026-06-26T17:43:51.460Z","title":"WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-54839","published":"2026-06-26T14:52:26.359Z","updated":"2026-06-26T17:06:57.487Z","title":"WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"kingaddons","product":"Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-54837","published":"2026-06-26T14:52:25.702Z","updated":"2026-06-26T20:19:01.084Z","title":"WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"Intranet &amp; Private Site &#8211; All-In-One Intranet","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-54835","published":"2026-06-26T14:52:25.039Z","updated":"2026-06-29T17:41:00.373Z","title":"WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Rustaurius","product":"Five Star Restaurant Menu","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-54834","published":"2026-06-26T14:52:24.388Z","updated":"2026-06-26T15:50:56.407Z","title":"WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"fpuenteonline","product":"Object Cache 4 everyone","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-54833","published":"2026-06-26T14:52:23.740Z","updated":"2026-06-26T15:38:38.561Z","title":"WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability","severity":"HIGH","score":7.4,"vendor":"Dev Kabir","product":"Enable CORS","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-54832","published":"2026-06-26T14:52:23.080Z","updated":"2026-06-26T17:43:57.418Z","title":"WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Jegstudio","product":"Gutenverse Companion","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-54831","published":"2026-06-26T14:52:22.424Z","updated":"2026-06-26T17:08:29.524Z","title":"WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-54827","published":"2026-06-26T14:52:21.779Z","updated":"2026-06-26T20:19:14.295Z","title":"WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"contempoinc","product":"Real Estate 7","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-54826","published":"2026-06-26T14:52:21.124Z","updated":"2026-06-29T17:38:21.245Z","title":"WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.6,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-54825","published":"2026-06-26T14:52:20.469Z","updated":"2026-06-26T15:51:26.440Z","title":"WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpDataTables","product":"wpDataTables","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-54824","published":"2026-06-26T14:52:19.805Z","updated":"2026-06-26T15:39:00.437Z","title":"WordPress Ads by WPQuads plugin <= 3.0.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Ads WPQuads","product":"Ads by WPQuads","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-54820","published":"2026-06-26T14:52:19.148Z","updated":"2026-06-26T17:44:04.338Z","title":"WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBooking","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-52701","published":"2026-06-26T14:52:18.447Z","updated":"2026-06-26T17:09:36.833Z","title":"WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themegrill","product":"User Registration","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-24547","published":"2026-06-26T14:52:17.799Z","updated":"2026-06-26T20:19:27.737Z","title":"WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SiteGround","product":"SiteGround Email Marketing","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-68075","published":"2026-06-26T14:52:17.144Z","updated":"2026-06-29T16:02:42.090Z","title":"WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kerry","product":"BNE Testimonials","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68074","published":"2026-06-26T14:52:16.493Z","updated":"2026-06-26T15:48:49.567Z","title":"WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GhozyLab","product":"Image Carousel","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68064","published":"2026-06-26T14:52:15.833Z","updated":"2026-06-26T15:39:21.992Z","title":"WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Everthemess","product":"Goya Core","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-68063","published":"2026-06-26T14:52:15.176Z","updated":"2026-06-26T17:44:10.073Z","title":"WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Splash - Sport Club WordPress Theme for Basketball, Football, Hockey","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-68052","published":"2026-06-26T14:52:14.528Z","updated":"2026-06-26T17:10:17.461Z","title":"WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Eagle-Themes","product":"Eagle Booking","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-66123","published":"2026-06-26T14:52:13.859Z","updated":"2026-06-26T20:19:41.689Z","title":"WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"About Envato","product":"BookPro","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-64637","published":"2026-06-26T14:52:13.210Z","updated":"2026-06-29T16:07:29.531Z","title":"WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Opal_WP","product":"Auros Core","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-64636","published":"2026-06-26T14:52:12.568Z","updated":"2026-06-26T15:49:24.497Z","title":"WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"rhewlif","product":"Donation Thermometer","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-63079","published":"2026-06-26T14:52:11.918Z","updated":"2026-06-26T15:39:39.696Z","title":"WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bdthemes","product":"Live Copy Paste for Elementor","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-63078","published":"2026-06-26T14:52:11.277Z","updated":"2026-06-26T17:44:15.903Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-63041","published":"2026-06-26T14:52:10.011Z","updated":"2026-06-26T17:10:40.998Z","title":"WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Code Amp","product":"Forget About Shortcode Buttons","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-57620","published":"2026-06-26T11:41:36.957Z","updated":"2026-06-26T20:19:55.180Z","title":"WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tim Strifler","product":"Exclusive Addons Elementor","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-57700","published":"2026-06-25T17:29:31.795Z","updated":"2026-06-29T17:43:48.914Z","title":"WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Daan.dev","product":"OMGF Pro","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-56050","published":"2026-06-25T13:34:41.354Z","updated":"2026-06-25T14:03:06.564Z","title":"WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeisle","product":"PPOM for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-54848","published":"2026-06-25T13:26:43.038Z","updated":"2026-06-25T14:24:59.143Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":8.3,"vendor":"Saad Iqbal","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-54829","published":"2026-06-25T13:25:31.337Z","updated":"2026-06-25T13:57:55.095Z","title":"WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-54836","published":"2026-06-25T13:17:25.186Z","updated":"2026-06-25T23:23:53.973Z","title":"WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"YMC","product":"YMC Filter","kev":false,"epss":0.01343,"kevAdded":null},{"id":"CVE-2026-54842","published":"2026-06-25T13:16:15.533Z","updated":"2026-06-25T14:09:32.720Z","title":"WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Royal Plugins","product":"Royal MCP","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-57429","published":"2026-06-25T13:12:44.822Z","updated":"2026-06-25T14:15:39.604Z","title":"WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Slim SEO","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-56071","published":"2026-06-25T13:12:44.160Z","updated":"2026-06-25T14:52:38.046Z","title":"WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56054","published":"2026-06-25T13:12:43.513Z","updated":"2026-06-25T14:35:04.703Z","title":"WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-56053","published":"2026-06-25T13:12:42.844Z","updated":"2026-06-25T23:23:16.436Z","title":"WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-56051","published":"2026-06-25T13:12:42.167Z","updated":"2026-06-29T17:42:11.380Z","title":"WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TablePress","product":"TablePress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56049","published":"2026-06-25T13:12:41.524Z","updated":"2026-06-25T14:16:50.487Z","title":"WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.5,"vendor":"Post Snippets","product":"Post Snippets","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-56042","published":"2026-06-25T13:12:40.870Z","updated":"2026-06-25T14:52:17.808Z","title":"WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Algolplus","product":"Advanced Order Export For WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56023","published":"2026-06-25T13:12:40.218Z","updated":"2026-06-25T14:54:13.682Z","title":"WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Knit Pay","product":"UPI QR Code Payment Gateway for WooCommerce","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-56014","published":"2026-06-25T13:12:39.551Z","updated":"2026-10-08T12:41:35.287Z","title":"WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Averta","product":"Master Slider","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56013","published":"2026-06-25T13:12:38.894Z","updated":"2026-06-29T18:00:49.489Z","title":"WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"myCred","product":"License Manager for WooCommerce","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-56006","published":"2026-06-25T13:12:38.207Z","updated":"2026-06-25T14:00:44.523Z","title":"WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"H5P","product":"H5P","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-56005","published":"2026-06-25T13:12:37.530Z","updated":"2026-10-02T06:17:30.075Z","title":"WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-54849","published":"2026-06-25T13:12:36.841Z","updated":"2026-06-25T14:52:00.964Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-54845","published":"2026-06-25T13:12:36.187Z","updated":"2026-06-25T23:21:07.580Z","title":"WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-54844","published":"2026-06-25T13:12:35.546Z","updated":"2026-06-29T17:55:34.539Z","title":"WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"CheckView","product":"CheckView Automated Testing","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-54843","published":"2026-06-25T13:12:34.893Z","updated":"2026-06-25T14:02:43.995Z","title":"WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-54841","published":"2026-06-25T13:12:34.241Z","updated":"2026-06-25T14:51:25.429Z","title":"WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Appsbd","product":"Vitepos","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-54838","published":"2026-06-25T13:12:33.589Z","updated":"2026-06-25T14:54:41.669Z","title":"WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Rymera Web Co","product":"WC Vendors Marketplace","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-54830","published":"2026-06-25T13:12:32.943Z","updated":"2026-06-29T17:57:08.060Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Etoile Web Design Incorporated","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-54828","published":"2026-06-25T13:12:32.298Z","updated":"2026-06-25T14:20:47.598Z","title":"WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-54823","published":"2026-06-25T13:12:31.631Z","updated":"2026-06-25T14:51:05.107Z","title":"WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"MarketingFire","product":"Widget Options","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-54822","published":"2026-06-25T13:12:30.969Z","updated":"2026-06-25T15:07:16.240Z","title":"WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"SALESmanago","product":"SALESmanago & Leadoo","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-54821","published":"2026-06-25T13:12:30.317Z","updated":"2026-06-25T23:20:16.128Z","title":"WordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.4,"vendor":"Bootstrapped Ventures","product":"Visual Link Preview","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-27366","published":"2026-06-25T13:12:29.656Z","updated":"2026-06-29T17:59:01.166Z","title":"WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"MainWP","product":"MainWP Child","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-57619","published":"2026-06-25T13:12:28.989Z","updated":"2026-06-25T14:02:14.879Z","title":"WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-56052","published":"2026-06-24T07:23:45.781Z","updated":"2026-06-24T12:22:06.373Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"FunnelKit","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-56024","published":"2026-06-18T15:27:28.777Z","updated":"2026-07-01T09:24:04.141Z","title":"WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-56012","published":"2026-06-18T14:02:38.042Z","updated":"2026-06-18T16:10:48.523Z","title":"WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-56009","published":"2026-06-18T10:43:11.021Z","updated":"2026-06-18T12:57:19.745Z","title":"WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Bricksable","product":"Bricksable for Bricks Builder","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-56007","published":"2026-06-18T09:44:29.352Z","updated":"2026-06-18T15:54:19.334Z","title":"WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"OceanWP","product":"Ocean Product Sharing","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-54812","published":"2026-06-17T14:24:22.894Z","updated":"2026-09-30T05:22:14.967Z","title":"WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-54810","published":"2026-06-17T14:21:19.701Z","updated":"2026-06-17T15:39:00.242Z","title":"WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Nexi Payments","product":"Nexi XPay","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-54809","published":"2026-06-17T13:51:59.597Z","updated":"2026-06-17T15:27:51.550Z","title":"WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"VillaTheme","product":"GIFT4U","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-54808","published":"2026-06-17T13:51:10.164Z","updated":"2026-06-17T14:03:53.315Z","title":"WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WP Travel","product":"WP Travel Gutenberg Blocks","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-69189","published":"2026-06-17T13:49:33.886Z","updated":"2026-06-17T15:36:54.455Z","title":"WordPress JobBank plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"EMV","product":"JobBank","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-69128","published":"2026-06-17T13:48:43.239Z","updated":"2026-06-17T14:10:54.535Z","title":"WordPress JobCareer theme <= 7.3 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"EMV","product":"JobCareer","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2025-60236","published":"2026-06-17T13:47:38.937Z","updated":"2026-06-17T14:41:28.070Z","title":"WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"EMV","product":"Creatify","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-60231","published":"2026-06-17T13:46:18.067Z","updated":"2026-06-17T13:59:29.056Z","title":"WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"EMV","product":"The Hospital","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-54813","published":"2026-06-17T13:44:40.713Z","updated":"2026-06-17T13:59:49.475Z","title":"WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-54814","published":"2026-06-17T13:41:12.426Z","updated":"2026-06-17T14:41:50.427Z","title":"WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-54815","published":"2026-06-17T13:40:03.283Z","updated":"2026-06-17T14:52:13.496Z","title":"WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Cargo RD","product":"Cargo Shipping Location for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-54816","published":"2026-06-17T13:37:37.465Z","updated":"2026-06-17T15:38:43.012Z","title":"WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.5,"vendor":"Monetizemore","product":"Advanced Ads","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-54817","published":"2026-06-17T13:36:04.122Z","updated":"2026-06-17T14:15:18.655Z","title":"WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FluxBuilder","product":"MStore API","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-54818","published":"2026-06-17T13:35:00.854Z","updated":"2026-06-17T15:28:06.250Z","title":"WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VeronaLabs","product":"Slimstat Analytics","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-54819","published":"2026-06-17T13:16:37.762Z","updated":"2026-06-17T14:00:19.857Z","title":"WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-60230","published":"2026-06-17T13:15:33.424Z","updated":"2026-06-17T15:28:16.254Z","title":"WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeton","product":"The Barber Shop","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-60229","published":"2026-06-17T13:12:10.480Z","updated":"2026-06-17T14:23:12.499Z","title":"WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeton","product":"Lagom","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-52716","published":"2026-06-17T12:47:41.218Z","updated":"2026-06-17T15:37:54.276Z","title":"WordPress WorkScout-Core plugin <= 1.7.11 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"purethemes","product":"WorkScout-Core","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-52707","published":"2026-06-17T12:47:40.591Z","updated":"2026-06-17T14:43:54.324Z","title":"WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Kastell","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2026-49108","published":"2026-06-17T12:47:39.936Z","updated":"2026-06-17T14:02:00.304Z","title":"WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"park_of_ideas","product":"Moderno","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-40757","published":"2026-06-17T12:47:39.301Z","updated":"2026-06-17T15:28:24.231Z","title":"WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Château","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40756","published":"2026-06-17T12:47:38.675Z","updated":"2026-06-17T14:24:13.676Z","title":"WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Zoya","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40752","published":"2026-06-17T12:47:38.055Z","updated":"2026-06-17T15:38:11.201Z","title":"WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Manufaktur Solutions","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-40738","published":"2026-06-17T12:47:37.425Z","updated":"2026-06-17T15:37:23.551Z","title":"WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Eldon","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-40733","published":"2026-06-17T12:47:36.792Z","updated":"2026-06-17T14:45:23.630Z","title":"WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"ShiftUp","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-40720","published":"2026-06-17T12:47:36.158Z","updated":"2026-06-17T14:02:23.169Z","title":"WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Royal Elementor Addons","product":"Royal Elementor Addons Pro","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39590","published":"2026-06-17T12:47:35.526Z","updated":"2026-06-17T15:28:34.015Z","title":"WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Atomlab","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39576","published":"2026-06-17T12:47:34.905Z","updated":"2026-06-17T14:25:17.856Z","title":"WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"SingleMalt","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-39560","published":"2026-06-17T12:47:34.267Z","updated":"2026-06-17T15:37:38.642Z","title":"WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Hiroshi","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39559","published":"2026-06-17T12:47:33.629Z","updated":"2026-06-17T14:54:46.460Z","title":"WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"codesupplyco","product":"Uppercase","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39556","published":"2026-06-17T12:47:32.994Z","updated":"2026-06-17T14:41:01.979Z","title":"WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Konsept","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39523","published":"2026-06-17T12:47:32.355Z","updated":"2026-06-17T14:04:50.623Z","title":"WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Solene Core","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39445","published":"2026-06-17T12:47:31.723Z","updated":"2026-06-17T15:28:41.651Z","title":"WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"PressLayouts","product":"Alukas","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-39442","published":"2026-06-17T12:47:31.085Z","updated":"2026-06-17T14:28:22.538Z","title":"WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"PressLayouts","product":"PressMart","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-69175","published":"2026-06-17T12:47:30.441Z","updated":"2026-06-17T14:26:15.124Z","title":"WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Line Agency","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69174","published":"2026-06-17T12:47:29.805Z","updated":"2026-06-17T14:45:52.831Z","title":"WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Etude","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69170","published":"2026-06-17T12:47:29.164Z","updated":"2026-06-17T14:05:56.046Z","title":"WordPress Eventicity theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Eventicity","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69166","published":"2026-06-17T12:47:28.542Z","updated":"2026-06-17T15:28:51.382Z","title":"WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gunslinger","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69164","published":"2026-06-17T12:47:27.905Z","updated":"2026-06-17T14:30:57.055Z","title":"WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Skyward","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69158","published":"2026-06-17T12:47:27.274Z","updated":"2026-06-17T15:37:09.130Z","title":"WordPress Granola theme <= 1.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Granola","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69157","published":"2026-06-17T12:47:26.635Z","updated":"2026-06-17T14:29:41.070Z","title":"WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gamic","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69144","published":"2026-06-17T12:47:25.998Z","updated":"2026-06-17T14:46:35.630Z","title":"WordPress Preservation theme <= 1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Preservation","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69140","published":"2026-06-17T12:47:25.364Z","updated":"2026-06-17T14:07:32.771Z","title":"WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SeventhQueen","product":"SweetDate Core","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-69130","published":"2026-06-17T12:47:24.740Z","updated":"2026-09-14T10:20:52.516Z","title":"WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Pixel Makers Creative INC.","product":"Entrepreneur - Booking for Small Businesses WordPress Theme","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2025-69127","published":"2026-06-17T12:47:24.113Z","updated":"2026-06-17T15:31:24.308Z","title":"WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Plumbing","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-69126","published":"2026-06-17T12:47:23.477Z","updated":"2026-06-17T14:31:31.474Z","title":"WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Fortius","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69123","published":"2026-06-17T12:47:22.829Z","updated":"2026-06-17T14:47:05.363Z","title":"WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Snow Club","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69120","published":"2026-06-17T12:47:22.202Z","updated":"2026-06-17T14:08:24.497Z","title":"WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Dazzle","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69115","published":"2026-06-17T12:47:21.562Z","updated":"2026-06-17T15:29:11.494Z","title":"WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"LuxMed | Medicine & Healthcare Doctor WordPress Theme","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69111","published":"2026-06-17T12:47:20.925Z","updated":"2026-06-17T14:33:09.784Z","title":"WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Reisen","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-69106","published":"2026-06-17T12:47:20.287Z","updated":"2026-06-17T15:30:52.935Z","title":"WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Imba","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-68524","published":"2026-06-17T12:47:19.652Z","updated":"2026-06-17T14:34:36.259Z","title":"WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Avante","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-59554","published":"2026-06-17T12:47:18.988Z","updated":"2026-06-17T15:31:09.655Z","title":"WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Advanced Ads GmbH","product":"Advanced Ads – Tracking","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-15657","published":"2026-06-17T12:47:18.353Z","updated":"2026-06-17T14:37:47.983Z","title":"WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mojoomla","product":"School Management","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-54193","published":"2026-06-17T12:47:17.708Z","updated":"2026-06-17T15:38:27.177Z","title":"WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2024-37496","published":"2026-06-17T12:13:39.086Z","updated":"2026-06-17T12:47:02.860Z","title":"WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rara Themes","product":"Metro Magazine","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2024-37210","published":"2026-06-17T12:11:51.063Z","updated":"2026-06-17T15:29:25.937Z","title":"WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ali2woo","product":"AliNext","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2024-35690","published":"2026-06-17T12:05:25.870Z","updated":"2026-06-17T12:45:17.649Z","title":"WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MarketingFire","product":"Widget Options","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2024-35648","published":"2026-06-17T12:03:47.010Z","updated":"2026-06-17T15:30:36.673Z","title":"WordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Andy Moyle","product":"Emergency Password Reset","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2024-33909","published":"2026-06-17T12:02:14.450Z","updated":"2026-06-17T13:36:36.602Z","title":"WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Avirtum","product":"iPages Flipbook","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2024-32949","published":"2026-06-17T11:57:17.636Z","updated":"2026-06-17T12:47:27.735Z","title":"WordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerability","severity":"HIGH","score":8.3,"vendor":"Prince","product":"Integrate Google Drive","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2024-32729","published":"2026-06-17T11:53:02.442Z","updated":"2026-06-17T15:29:34.726Z","title":"WordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2024-24709","published":"2026-06-17T11:42:15.384Z","updated":"2026-06-17T15:36:23.994Z","title":"WordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shareaholic","product":"Shareaholic","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-31013","published":"2026-06-17T11:39:58.550Z","updated":"2026-06-17T14:47:35.636Z","title":"WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themify","product":"Themify Folo","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2024-31435","published":"2026-06-17T11:36:50.302Z","updated":"2026-06-17T12:45:38.989Z","title":"WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Inisev","product":"Social Media & Share Icons","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2024-33685","published":"2026-06-17T11:34:52.064Z","updated":"2026-06-17T14:39:06.785Z","title":"WordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jegstudio","product":"Startupzy","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2024-34810","published":"2026-06-17T10:25:31.666Z","updated":"2026-06-17T12:09:21.477Z","title":"WordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Extend Themes","product":"Skyline WP","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-54811","published":"2026-06-17T09:51:47.184Z","updated":"2026-06-17T14:39:28.084Z","title":"WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tips and Tricks HQ","product":"WP eMember","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-54807","published":"2026-06-17T09:51:46.082Z","updated":"2026-06-17T12:15:13.929Z","title":"WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGrill","product":"Registration Form for WooCommerce","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-54806","published":"2026-06-17T09:51:45.282Z","updated":"2026-06-17T15:29:41.962Z","title":"WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2026-54805","published":"2026-06-17T09:51:44.457Z","updated":"2026-06-17T12:11:22.289Z","title":"WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"sbouey","product":"Falang multilanguage","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-54804","published":"2026-06-17T09:51:43.493Z","updated":"2026-06-17T15:35:34.811Z","title":"WordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.6,"vendor":"melhorenvio","product":"Melhor Envio","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-54803","published":"2026-06-17T09:51:42.664Z","updated":"2026-06-17T14:48:45.148Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-54802","published":"2026-06-17T09:51:41.724Z","updated":"2026-06-17T14:40:15.151Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-54196","published":"2026-06-17T09:51:40.708Z","updated":"2026-09-16T11:29:51.378Z","title":"WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-54195","published":"2026-06-17T09:51:39.367Z","updated":"2026-06-17T15:29:52.435Z","title":"WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-54192","published":"2026-06-17T09:51:38.528Z","updated":"2026-06-17T12:12:50.807Z","title":"WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Popup box","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-54189","published":"2026-06-17T09:51:36.604Z","updated":"2026-06-17T15:35:50.140Z","title":"WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-54188","published":"2026-06-17T09:51:35.746Z","updated":"2026-06-17T15:36:07.987Z","title":"WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-54187","published":"2026-06-17T09:51:34.989Z","updated":"2026-06-17T14:40:34.679Z","title":"WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-54186","published":"2026-06-17T09:51:34.211Z","updated":"2026-06-17T12:17:12.515Z","title":"WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-54185","published":"2026-06-17T09:51:33.429Z","updated":"2026-06-17T15:29:59.133Z","title":"WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"THEMECO","product":"Cornerstone","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-54184","published":"2026-06-17T09:51:32.632Z","updated":"2026-06-17T12:18:36.587Z","title":"WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":8.2,"vendor":"Alberto Hornero","product":"Clean Login","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-52706","published":"2026-06-17T09:51:31.833Z","updated":"2026-06-17T15:35:20.135Z","title":"WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-52705","published":"2026-06-17T09:51:31.066Z","updated":"2026-06-17T15:34:30.929Z","title":"WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"BDthemes","product":"SigmaForms Pro – AI Generated Forms","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-52698","published":"2026-06-17T09:51:30.297Z","updated":"2026-06-17T14:39:45.079Z","title":"WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.4,"vendor":"Syed Balkhi","product":"PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-52696","published":"2026-06-17T09:51:29.506Z","updated":"2026-06-17T12:18:26.409Z","title":"WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Jetimpex Inc.","product":"JetBlog","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-49778","published":"2026-06-17T09:51:28.737Z","updated":"2026-06-17T15:30:12.313Z","title":"WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFunnels","product":"WPFunnels Pro","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-49767","published":"2026-06-17T09:51:27.980Z","updated":"2026-06-17T12:20:04.363Z","title":"WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2026-49107","published":"2026-06-17T09:51:27.168Z","updated":"2026-06-17T15:34:46.211Z","title":"WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Thrive Themes","product":"Thrive Apprentice","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-49084","published":"2026-06-17T09:51:26.388Z","updated":"2026-06-17T15:34:15.561Z","title":"WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-49081","published":"2026-06-17T09:51:25.629Z","updated":"2026-06-17T14:31:15.344Z","title":"WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"ThemeGrill","product":"User Registration Stripe","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-49079","published":"2026-06-17T09:51:24.827Z","updated":"2026-06-17T12:19:09.745Z","title":"WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jetimpex Inc.","product":"JetSearch","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-49076","published":"2026-06-17T09:51:24.031Z","updated":"2026-09-28T05:53:19.587Z","title":"WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-49075","published":"2026-06-17T09:51:22.886Z","updated":"2026-06-17T12:22:50.364Z","title":"WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-49074","published":"2026-06-17T09:51:21.767Z","updated":"2026-06-17T15:35:03.896Z","title":"WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-49072","published":"2026-06-17T09:51:20.490Z","updated":"2026-06-17T15:30:19.105Z","title":"WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OPMC","product":"WooCommerce Anti-Fraud","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-49071","published":"2026-06-17T09:51:19.361Z","updated":"2026-06-17T14:36:36.776Z","title":"WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OPMC","product":"WooCommerce Dropshipping","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-49058","published":"2026-06-17T09:51:18.531Z","updated":"2026-06-17T12:19:32.756Z","title":"WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"LoginPress","product":"LoginPress Pro","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-48967","published":"2026-06-17T09:51:17.576Z","updated":"2026-06-17T15:30:32.812Z","title":"WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-48875","published":"2026-06-17T09:51:16.607Z","updated":"2026-06-17T12:27:00.242Z","title":"WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jetimpex Inc.","product":"JetSmartFilters","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-45436","published":"2026-06-17T09:51:15.551Z","updated":"2026-06-17T15:30:03.591Z","title":"WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rain-Task Ltd.","product":"WPBakery Page Builder","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-42629","published":"2026-06-17T09:51:14.572Z","updated":"2026-06-17T15:29:48.105Z","title":"WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Powerpackelements","product":"PowerPack Pro for Elementor","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-42385","published":"2026-06-17T09:51:13.765Z","updated":"2026-06-17T14:36:15.659Z","title":"WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"Profile Builder Pro","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-42380","published":"2026-06-17T09:51:12.868Z","updated":"2026-06-17T12:20:04.529Z","title":"WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"jwsthemes","product":"AI Lab","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-41557","published":"2026-06-17T09:51:11.381Z","updated":"2026-06-17T15:30:45.750Z","title":"WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PressLayouts","product":"Kapee","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-40783","published":"2026-06-17T09:51:10.414Z","updated":"2026-06-17T12:31:43.137Z","title":"WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Creative Themes","product":"Blocksy Companion Pro","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-40768","published":"2026-06-17T09:51:09.612Z","updated":"2026-06-17T15:28:46.407Z","title":"WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.3,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-40765","published":"2026-06-17T09:51:08.665Z","updated":"2026-06-17T15:29:32.171Z","title":"WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"collectchat","product":"collectchat","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-40753","published":"2026-06-17T09:51:07.802Z","updated":"2026-06-17T14:35:37.952Z","title":"WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"EasyMeals","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-40749","published":"2026-06-17T09:51:06.573Z","updated":"2026-06-17T12:32:07.360Z","title":"WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Charity Zone","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-40748","published":"2026-06-17T09:51:05.625Z","updated":"2026-06-17T15:30:57.226Z","title":"WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Kids Gift Shop","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-40747","published":"2026-06-17T09:51:04.656Z","updated":"2026-06-17T12:33:26.049Z","title":"WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Ecommerce Zone","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-40746","published":"2026-06-17T09:51:03.724Z","updated":"2026-06-17T15:29:02.536Z","title":"WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Restaurant Zone","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-40735","published":"2026-06-17T09:51:02.858Z","updated":"2026-06-17T15:28:31.988Z","title":"WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Reina","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-40731","published":"2026-06-17T09:51:01.784Z","updated":"2026-06-17T14:32:05.473Z","title":"WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"ChapterOne","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-40726","published":"2026-06-17T09:51:00.869Z","updated":"2026-06-17T12:32:36.031Z","title":"WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"ThemeGrill","product":"User Registration Stripe","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-40725","published":"2026-06-17T09:50:59.691Z","updated":"2026-06-17T15:31:08.810Z","title":"WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Barn2 Media Ltd","product":"WooCommerce Product Filters","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-40724","published":"2026-06-17T09:50:58.794Z","updated":"2026-06-17T12:46:08.075Z","title":"WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Client Portal Ltd.","product":"Client Portal (Pro)","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-40723","published":"2026-06-17T09:50:57.929Z","updated":"2026-06-17T15:28:16.102Z","title":"WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bricks","product":"Bricks Builder","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-40721","published":"2026-06-17T09:50:56.955Z","updated":"2026-06-17T15:28:01.788Z","title":"WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"BdThemes","product":"Element Pack Pro","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-39597","published":"2026-06-17T09:50:55.944Z","updated":"2026-06-17T14:27:08.336Z","title":"WordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPZOOM","product":"WPZOOM Addons for Elementor","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39596","published":"2026-06-17T09:50:54.778Z","updated":"2026-06-17T12:32:58.186Z","title":"WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Creative Themes","product":"Blocksy Companion Pro","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-39595","published":"2026-06-17T09:50:53.712Z","updated":"2026-06-17T15:31:15.908Z","title":"WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.7,"vendor":"BoldGrid","product":"W3 Total Cache","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-39589","published":"2026-06-17T09:50:52.745Z","updated":"2026-06-17T12:35:13.069Z","title":"WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"A WP Life","product":"Webenvo","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-39582","published":"2026-06-17T09:50:51.906Z","updated":"2026-06-17T15:27:43.975Z","title":"WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"xtemos","product":"Hitek","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39573","published":"2026-06-17T09:50:51.006Z","updated":"2026-06-17T15:27:30.197Z","title":"WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Mildhill","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-39558","published":"2026-06-17T09:50:50.109Z","updated":"2026-06-17T14:29:20.114Z","title":"WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Malmö","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39546","published":"2026-06-17T09:50:49.168Z","updated":"2026-06-17T12:36:14.140Z","title":"WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability","severity":"HIGH","score":7.6,"vendor":"Techspawn","product":"MultiLoca","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-39545","published":"2026-06-17T09:50:48.200Z","updated":"2026-06-17T15:31:24.913Z","title":"WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Zermatt","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-39537","published":"2026-06-17T09:50:47.253Z","updated":"2026-06-17T12:36:44.694Z","title":"WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Mikado Core","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-34888","published":"2026-06-17T09:50:46.273Z","updated":"2026-06-17T15:33:58.646Z","title":"WordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Bricksforge","product":"Bricksforge","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-27410","published":"2026-06-17T09:50:45.404Z","updated":"2026-06-17T15:33:12.143Z","title":"WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VeronaLabs","product":"Slimstat Analytics","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-27400","published":"2026-06-17T09:50:44.468Z","updated":"2026-06-17T14:28:51.788Z","title":"WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Ovatheme","product":"BookPro","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2026-27041","published":"2026-06-17T09:50:43.592Z","updated":"2026-06-17T12:33:20.660Z","title":"WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Studio Keren Aga LTD.","product":"Unlimited Elements for Elementor (Premium)","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-25446","published":"2026-06-17T09:50:42.715Z","updated":"2026-06-17T15:31:33.658Z","title":"WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WishList Products, LLC.","product":"WishList Member X","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-25439","published":"2026-06-17T09:50:41.863Z","updated":"2026-10-29T11:36:02.240Z","title":"WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"Booknetic","product":"Booknetic","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-24611","published":"2026-06-17T09:50:41.016Z","updated":"2026-06-17T15:33:41.834Z","title":"WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.1,"vendor":"WPMet","product":"MetForm Pro","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-24610","published":"2026-06-17T09:50:40.137Z","updated":"2026-06-17T15:33:26.405Z","title":"WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMet","product":"MetForm Pro","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-24575","published":"2026-06-17T09:50:39.221Z","updated":"2026-06-17T14:28:22.293Z","title":"WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WishList Member","product":"WishList Member X","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-22343","published":"2026-06-17T09:50:38.344Z","updated":"2026-06-17T12:33:41.987Z","title":"WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.6,"vendor":"PremiumPress Limited.","product":"WordPress Dating Theme","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-22342","published":"2026-06-17T09:50:37.440Z","updated":"2026-06-17T15:31:42.849Z","title":"WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability","severity":"HIGH","score":8.8,"vendor":"PremiumPress Limited.","product":"WordPress Dating Theme","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-22340","published":"2026-06-17T09:50:36.577Z","updated":"2026-06-17T12:39:12.795Z","title":"WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jobster Marketplace","product":"WPJobster","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-22339","published":"2026-06-17T09:50:35.727Z","updated":"2026-06-17T15:32:57.668Z","title":"WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jobster Marketplace","product":"WPJobster","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-22338","published":"2026-06-17T09:50:34.844Z","updated":"2026-06-17T15:32:43.327Z","title":"WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"EcoBlue","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-22335","published":"2026-06-17T09:50:33.847Z","updated":"2026-06-17T14:27:49.840Z","title":"WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WC Lovers.","product":"WooCommerce Frontend Manager – Ultimate","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-22334","published":"2026-06-17T09:50:33.028Z","updated":"2026-06-17T12:34:16.636Z","title":"WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"WPos","product":"Woocommerce Book Price","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-22332","published":"2026-06-17T09:50:32.139Z","updated":"2026-06-17T15:31:50.291Z","title":"WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Themeum","product":"Tutor LMS Pro","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-22331","published":"2026-06-17T09:50:31.214Z","updated":"2026-06-17T12:40:34.305Z","title":"WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"AutoParts","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-22330","published":"2026-06-17T09:50:30.277Z","updated":"2026-06-17T15:31:54.333Z","title":"WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Themeum","product":"Right Way","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-22329","published":"2026-06-17T09:50:29.401Z","updated":"2026-06-17T15:32:27.549Z","title":"WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Skillate","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-22328","published":"2026-06-17T09:50:28.449Z","updated":"2026-06-17T14:24:20.365Z","title":"WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VamTam","product":"Auto Repair","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-22327","published":"2026-06-17T09:50:27.357Z","updated":"2026-06-17T12:36:49.436Z","title":"WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Zozothemes","product":"Restaurt","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-22326","published":"2026-06-17T09:50:26.407Z","updated":"2026-06-17T15:32:01.463Z","title":"WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AxiomThemes","product":"Reprizo","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-22325","published":"2026-06-17T09:50:25.529Z","updated":"2026-06-17T12:41:12.855Z","title":"WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AxiomThemes","product":"Promo","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-9690","published":"2026-06-17T09:50:24.650Z","updated":"2026-06-17T15:36:39.634Z","title":"WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Joomunited","product":"WP Media folder Addon","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-69179","published":"2026-06-17T09:50:23.664Z","updated":"2026-06-17T15:32:10.518Z","title":"WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Theme passion","product":"Support Ticket Management System","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2025-69173","published":"2026-06-17T09:50:22.568Z","updated":"2026-06-17T13:38:24.811Z","title":"WordPress Tipsy theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Tipsy","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69172","published":"2026-06-17T09:50:21.645Z","updated":"2026-06-17T14:26:27.532Z","title":"WordPress Resurs theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Resurs","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69171","published":"2026-06-17T09:50:20.774Z","updated":"2026-06-17T12:37:28.873Z","title":"WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Orpheus","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69161","published":"2026-06-17T09:50:19.854Z","updated":"2026-06-17T15:32:17.326Z","title":"WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Snowy","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69148","published":"2026-06-17T09:50:18.826Z","updated":"2026-06-17T12:42:13.912Z","title":"WordPress Quirky theme <= 1.23 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Quirky","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69145","published":"2026-06-17T09:50:17.929Z","updated":"2026-06-17T15:31:39.617Z","title":"WordPress Gat theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gat","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69138","published":"2026-06-17T09:50:17.142Z","updated":"2026-06-17T13:40:02.187Z","title":"WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Jthemes","product":"Genemy","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2025-69135","published":"2026-06-17T09:50:16.222Z","updated":"2026-06-17T14:26:01.918Z","title":"WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CurlyThemes","product":"Events Schedule - WordPress Events Calendar Plugin","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-69129","published":"2026-06-17T09:50:15.190Z","updated":"2026-06-17T12:39:36.371Z","title":"WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Extendons","product":"WordPress & WooCommerce Scraper Plugin, Import Data from Any Site","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-69117","published":"2026-06-17T09:50:14.393Z","updated":"2026-06-17T15:32:27.937Z","title":"WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Ingenioso","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69110","published":"2026-06-17T09:50:13.569Z","updated":"2026-06-17T12:43:09.486Z","title":"WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"AirSupply","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-60223","published":"2026-06-17T09:50:12.562Z","updated":"2026-06-17T15:26:24.670Z","title":"WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"QuantumCloud","product":"WPBot Pro Wordpress Chatbot","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2025-60218","published":"2026-06-17T09:50:11.614Z","updated":"2026-06-17T13:42:11.006Z","title":"WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPLocker","product":"PT Luxa Addons","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-60205","published":"2026-06-17T09:50:10.405Z","updated":"2026-10-15T06:01:55.826Z","title":"WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"ThemeREX Addons","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2025-59563","published":"2026-06-17T09:50:09.614Z","updated":"2026-06-17T12:40:28.119Z","title":"WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"SONAAR MUSIC","product":"Sonaar","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-59560","published":"2026-06-17T09:50:08.827Z","updated":"2026-06-17T15:32:34.855Z","title":"WordPress Sonaar theme <= 4.27.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SONAAR MUSIC","product":"Sonaar","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-58954","published":"2026-06-17T09:50:08.018Z","updated":"2026-06-17T12:43:47.921Z","title":"WordPress HomeRoofer theme <= 2.11.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"HomeRoofer","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-58953","published":"2026-06-17T09:50:07.194Z","updated":"2026-06-17T15:29:17.920Z","title":"WordPress Joly theme <= 1.22.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Joly","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-58952","published":"2026-06-17T09:50:06.384Z","updated":"2026-06-17T13:43:51.314Z","title":"WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Neuronet","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-49403","published":"2026-06-17T09:50:05.372Z","updated":"2026-06-17T14:24:50.601Z","title":"WordPress Premium Age Verification / Restriction for WordPress Plugin <= 3.0.2 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"AA-Team","product":"Premium Age Verification / Restriction for WordPress","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2024-52488","published":"2026-06-17T09:50:04.562Z","updated":"2026-06-17T12:41:59.517Z","title":"WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Zidithemes","product":"Grip","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2024-49269","published":"2026-06-17T09:50:03.718Z","updated":"2026-06-17T15:32:43.357Z","title":"WordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mythemes","product":"my flatonica","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-40722","published":"2026-06-17T08:40:37.888Z","updated":"2026-06-17T10:35:26.509Z","title":"WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Yoast BV","product":"Yoast SEO Premium","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-25470","published":"2026-06-16T21:25:55.702Z","updated":"2026-09-14T14:57:14.993Z","title":"WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"ACPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-39598","published":"2026-06-16T21:24:27.789Z","updated":"2026-06-17T10:35:55.123Z","title":"WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability","severity":"HIGH","score":8,"vendor":"Kodezen LLC","product":"Academy LMS Pro","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-49073","published":"2026-06-16T21:23:19.120Z","updated":"2026-06-17T10:36:08.850Z","title":"WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"wpWax","product":"Directorist Booking","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-49113","published":"2026-06-16T20:57:43.950Z","updated":"2026-06-17T10:36:22.323Z","title":"WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":8.5,"vendor":"THEMECO","product":"Cornerstone","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-49080","published":"2026-06-16T20:57:43.284Z","updated":"2026-06-17T10:36:36.277Z","title":"WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"wpDataTables","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-49057","published":"2026-06-16T20:57:42.634Z","updated":"2026-06-17T10:36:50.072Z","title":"WordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"EyeCix Technologies","product":"JobSearch","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-48869","published":"2026-06-16T20:57:41.971Z","updated":"2026-06-17T10:37:04.944Z","title":"WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kriesi","product":"Enfold","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-40761","published":"2026-06-16T20:57:41.321Z","updated":"2026-06-17T10:37:18.941Z","title":"WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Valeska","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40760","published":"2026-06-16T20:57:40.670Z","updated":"2026-06-17T10:37:33.148Z","title":"WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Behold","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40759","published":"2026-06-16T20:57:40.025Z","updated":"2026-06-17T10:37:46.720Z","title":"WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Esmée","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-40758","published":"2026-06-16T20:57:39.375Z","updated":"2026-06-17T10:38:00.200Z","title":"WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Léonie","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-40755","published":"2026-06-16T20:57:38.728Z","updated":"2026-06-17T10:38:16.090Z","title":"WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TechLink","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40754","published":"2026-06-16T20:57:38.080Z","updated":"2026-06-17T10:38:30.642Z","title":"WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Roisin","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-40751","published":"2026-06-16T20:57:37.421Z","updated":"2026-06-17T10:38:45.728Z","title":"WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Ashtanga","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-40739","published":"2026-06-16T20:57:36.767Z","updated":"2026-06-17T10:38:59.221Z","title":"WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"LuxeDrive","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-40736","published":"2026-06-16T20:57:36.124Z","updated":"2026-06-17T10:39:12.697Z","title":"WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Laurits","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-39580","published":"2026-06-16T20:57:35.479Z","updated":"2026-06-17T10:39:26.132Z","title":"WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Micdrop","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-39578","published":"2026-06-16T20:57:34.827Z","updated":"2026-06-17T10:39:39.567Z","title":"WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Valiance","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-39577","published":"2026-06-16T20:57:34.166Z","updated":"2026-06-17T10:39:53.478Z","title":"WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Playroom","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-39568","published":"2026-06-16T20:57:33.514Z","updated":"2026-06-17T10:40:09.776Z","title":"WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Mr. SEO","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-39567","published":"2026-06-16T20:57:32.852Z","updated":"2026-06-17T10:40:23.967Z","title":"WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Santé","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39557","published":"2026-06-16T20:57:32.203Z","updated":"2026-06-17T10:40:37.891Z","title":"WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"NeoBeat","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-39554","published":"2026-06-16T20:57:31.553Z","updated":"2026-06-17T10:40:54.376Z","title":"WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Fidalgo","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39549","published":"2026-06-16T20:57:30.903Z","updated":"2026-06-17T10:41:08.160Z","title":"WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Aperitif","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-39548","published":"2026-06-16T20:57:30.254Z","updated":"2026-06-17T10:41:21.646Z","title":"WordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sneeit","product":"MagOne","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39547","published":"2026-06-16T20:57:29.562Z","updated":"2026-06-17T10:41:35.788Z","title":"WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Getaway","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-39539","published":"2026-06-16T20:57:28.909Z","updated":"2026-06-17T10:41:49.390Z","title":"WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Alloggio - Hotel Booking","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39529","published":"2026-06-16T20:57:28.249Z","updated":"2026-06-17T10:42:02.825Z","title":"WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Elementra","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-39522","published":"2026-06-16T20:57:27.595Z","updated":"2026-06-17T10:42:16.808Z","title":"WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Solene","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-39446","published":"2026-06-16T20:57:26.934Z","updated":"2026-06-17T10:42:30.709Z","title":"WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"PressLayouts","product":"Kapee","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39443","published":"2026-06-16T20:57:26.260Z","updated":"2026-06-17T10:42:45.232Z","title":"WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"PressLayouts","product":"EmallShop","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39438","published":"2026-06-16T20:57:25.611Z","updated":"2026-06-17T10:42:59.336Z","title":"WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Emraan Cheema","product":"ListingPro","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-39433","published":"2026-06-16T20:57:24.962Z","updated":"2026-06-17T10:43:13.208Z","title":"WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-34895","published":"2026-06-16T20:57:24.317Z","updated":"2026-06-17T10:43:27.188Z","title":"WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"Softlab Core","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-34894","published":"2026-06-16T20:57:23.666Z","updated":"2026-06-17T10:43:40.711Z","title":"WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"Integrio Core","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-34893","published":"2026-06-16T20:57:23.010Z","updated":"2026-06-17T10:43:54.687Z","title":"WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"Thegov Core","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-27429","published":"2026-06-16T20:57:22.363Z","updated":"2026-06-17T10:44:10.061Z","title":"WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Nifty","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-27395","published":"2026-06-16T20:57:21.720Z","updated":"2026-06-17T10:44:23.548Z","title":"WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Schiocco","product":"Support Board","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-12256","published":"2026-06-16T20:57:21.069Z","updated":"2026-10-01T16:57:06.846Z","title":"WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2025-69178","published":"2026-06-16T20:57:20.412Z","updated":"2026-06-17T10:44:51.416Z","title":"WordPress Truemag theme <= 4.3.14.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CactusThemes","product":"Truemag","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69177","published":"2026-06-16T20:57:19.758Z","updated":"2026-06-17T10:45:07.291Z","title":"WordPress Roneous theme <= 2.1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"THEMELOGI","product":"Roneous","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2025-69176","published":"2026-06-16T20:57:19.107Z","updated":"2026-06-17T10:45:21.280Z","title":"WordPress ITactics theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"ITactics","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69168","published":"2026-06-16T20:57:18.457Z","updated":"2026-06-17T10:45:35.419Z","title":"WordPress Spike theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Spike","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69167","published":"2026-06-16T20:57:17.801Z","updated":"2026-06-17T10:45:50.943Z","title":"WordPress Eros theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Eros","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69165","published":"2026-06-16T20:57:17.146Z","updated":"2026-06-17T10:46:04.334Z","title":"WordPress Choreo theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Choreo","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69163","published":"2026-06-16T20:57:16.496Z","updated":"2026-06-17T10:46:17.779Z","title":"WordPress WineShop theme <= 3.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"WineShop","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69162","published":"2026-06-16T20:57:15.838Z","updated":"2026-06-17T10:46:31.679Z","title":"WordPress Grecko theme <= 5.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Grecko","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69160","published":"2026-06-16T20:57:15.175Z","updated":"2026-06-17T10:46:46.139Z","title":"WordPress Gita theme <= 1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gita","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69159","published":"2026-06-16T20:57:14.519Z","updated":"2026-06-17T10:47:00.800Z","title":"WordPress Printo theme <= 1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Printo","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69151","published":"2026-06-16T20:57:13.881Z","updated":"2026-06-17T10:47:15.226Z","title":"WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Car Rental","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-69150","published":"2026-06-16T20:57:13.232Z","updated":"2026-06-17T10:47:29.778Z","title":"WordPress Medeus theme <= 1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Medeus","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69149","published":"2026-06-16T20:57:12.584Z","updated":"2026-06-17T10:47:43.833Z","title":"WordPress Top Dog theme <= 1.0.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Top Dog","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69147","published":"2026-06-16T20:57:11.921Z","updated":"2026-06-17T10:47:58.370Z","title":"WordPress Putter theme <= 1.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Putter","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69146","published":"2026-06-16T20:57:11.269Z","updated":"2026-06-17T10:48:11.881Z","title":"WordPress Dom theme <= 1.24 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Dom","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69143","published":"2026-06-16T20:57:10.620Z","updated":"2026-06-17T10:48:25.428Z","title":"WordPress Mission theme <= 1.22 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Mission","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69142","published":"2026-06-16T20:57:09.974Z","updated":"2026-06-17T10:48:38.879Z","title":"WordPress Abelle theme <= 1.22 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Abelle","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69141","published":"2026-06-16T20:57:09.318Z","updated":"2026-06-17T10:48:52.475Z","title":"WordPress Kelly Young theme <= 1.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Kelly Young","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69139","published":"2026-06-16T20:57:08.663Z","updated":"2026-06-17T10:49:09.391Z","title":"WordPress Car Zone theme <= 3.7 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"AivahThemes","product":"Car Zone","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-69137","published":"2026-06-16T20:57:08.018Z","updated":"2026-06-17T10:49:24.579Z","title":"WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jthemes","product":"Genemy","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-69136","published":"2026-06-16T20:57:07.359Z","updated":"2026-06-17T10:49:39.124Z","title":"WordPress Wanium theme <= 1.9.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"THEMELOGI","product":"Wanium","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69131","published":"2026-06-16T20:57:06.714Z","updated":"2026-06-17T10:49:54.051Z","title":"WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"extendons","product":"WordPress & WooCommerce Scraper Plugin, Import Data from Any Site","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-69125","published":"2026-06-16T20:57:06.077Z","updated":"2026-06-17T10:50:09.339Z","title":"WordPress Food Drop theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Food Drop","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69124","published":"2026-06-16T20:57:05.414Z","updated":"2026-06-17T10:50:24.382Z","title":"WordPress Especio theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Especio","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69122","published":"2026-06-16T20:57:04.779Z","updated":"2026-06-17T10:50:38.590Z","title":"WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"SeaFood Company","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2025-69121","published":"2026-06-16T20:57:04.130Z","updated":"2026-06-17T10:50:53.186Z","title":"WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Deliciosa","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69119","published":"2026-06-16T20:57:03.487Z","updated":"2026-06-17T10:51:08.212Z","title":"WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Corbesier","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69118","published":"2026-06-16T20:57:02.828Z","updated":"2026-06-17T10:51:22.333Z","title":"WordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"CopyPress","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-69116","published":"2026-06-16T20:57:02.185Z","updated":"2026-06-17T10:51:37.283Z","title":"WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Iona","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69114","published":"2026-06-16T20:57:01.537Z","updated":"2026-06-17T10:51:51.364Z","title":"WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"MaxiNet","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69113","published":"2026-06-16T20:57:00.886Z","updated":"2026-06-17T10:52:07.669Z","title":"WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Nexio","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69112","published":"2026-06-16T20:57:00.235Z","updated":"2026-06-17T10:52:22.649Z","title":"WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Planty","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69109","published":"2026-06-16T20:56:59.584Z","updated":"2026-06-17T10:52:37.421Z","title":"WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Raider Spirit","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69108","published":"2026-06-16T20:56:58.928Z","updated":"2026-06-17T10:52:54.392Z","title":"WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Hot Coffee","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2025-69107","published":"2026-06-16T20:56:58.271Z","updated":"2026-06-17T10:53:09.851Z","title":"WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Rosaleen","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69105","published":"2026-06-16T20:56:57.633Z","updated":"2026-06-17T10:53:24.008Z","title":"WordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Modernee","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-69104","published":"2026-06-16T20:56:56.983Z","updated":"2026-06-17T10:53:40.408Z","title":"WordPress Qreatix theme <= 1.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jkdevstudio","product":"Qreatix","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-69103","published":"2026-06-16T20:56:56.328Z","updated":"2026-06-17T10:53:55.108Z","title":"WordPress Brikk theme <= 3.0.0 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Utillz","product":"Brikk","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-60085","published":"2026-06-16T20:56:55.682Z","updated":"2026-06-17T10:54:09.610Z","title":"WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX Group","product":"Learnify","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-58924","published":"2026-06-16T20:56:55.024Z","updated":"2026-06-17T10:54:25.371Z","title":"WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX Group","product":"Geya","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-54194","published":"2026-06-16T20:56:54.376Z","updated":"2026-06-17T10:54:40.081Z","title":"WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-40750","published":"2026-06-16T10:39:46.760Z","updated":"2026-06-16T12:18:17.312Z","title":"WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Kids Online Store","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-40809","published":"2026-06-16T09:05:03.712Z","updated":"2026-06-16T14:54:55.049Z","title":"WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rara Themes","product":"Metro Magazine","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-49772","published":"2026-06-16T09:04:02.573Z","updated":"2026-06-16T14:49:12.098Z","title":"WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.01937,"kevAdded":null},{"id":"CVE-2026-49774","published":"2026-06-16T09:02:45.076Z","updated":"2026-06-16T16:15:18.293Z","title":"WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Filipe Nasc","product":"RD Station","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-54198","published":"2026-06-16T09:00:38.625Z","updated":"2026-06-16T17:10:25.734Z","title":"WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-54197","published":"2026-06-16T09:00:37.802Z","updated":"2026-06-16T12:21:21.161Z","title":"WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"GetGenie","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-54191","published":"2026-06-16T09:00:37.010Z","updated":"2026-06-16T16:11:16.889Z","title":"WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pods Framework","product":"Pods","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-54190","published":"2026-06-16T09:00:36.164Z","updated":"2026-06-16T14:54:10.947Z","title":"WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Awesomemotive","product":"Envira Photo Gallery","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-52715","published":"2026-06-16T09:00:35.438Z","updated":"2026-06-16T14:56:01.939Z","title":"WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.01187,"kevAdded":null},{"id":"CVE-2026-52714","published":"2026-06-16T09:00:34.680Z","updated":"2026-06-16T12:19:02.095Z","title":"WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-52712","published":"2026-06-16T09:00:33.960Z","updated":"2026-06-16T17:10:31.823Z","title":"WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"tnomi","product":"Attendance Manager","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-52711","published":"2026-06-16T09:00:33.213Z","updated":"2026-06-16T12:23:19.883Z","title":"WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"kilbot","product":"WooCommerce POS","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-39581","published":"2026-06-16T09:00:32.149Z","updated":"2026-06-16T12:19:27.980Z","title":"WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"activity-log.com","product":"WP Sessions Time Monitoring Full Automatic","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-39574","published":"2026-06-16T09:00:31.418Z","updated":"2026-06-16T17:10:37.918Z","title":"WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"InPost Gallery","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-39490","published":"2026-06-16T09:00:30.684Z","updated":"2026-06-16T12:24:18.538Z","title":"WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"artbees","product":"JupiterX Core","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-39437","published":"2026-06-16T09:00:29.964Z","updated":"2026-06-16T16:10:14.168Z","title":"WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFactory","product":"Min Max Step Quantity Limits Manager for WooCommerce","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68045","published":"2026-06-16T09:00:29.079Z","updated":"2026-10-21T06:38:36.546Z","title":"WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-52703","published":"2026-06-15T20:19:35.341Z","updated":"2026-06-16T01:01:07.267Z","title":"WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Ninja Team","product":"FastDup","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-52702","published":"2026-06-15T20:19:34.691Z","updated":"2026-06-15T21:34:26.411Z","title":"WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wp-buy","product":"SEO Redirection","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-52700","published":"2026-06-15T20:19:34.039Z","updated":"2026-06-16T01:00:52.755Z","title":"WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WcMultishipping – Mondial Relay & Chronopost for Wooommerce","product":"WCMultiShipping","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-52699","published":"2026-06-15T20:19:33.398Z","updated":"2026-06-16T01:15:55.834Z","title":"WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-52697","published":"2026-06-15T20:19:32.754Z","updated":"2026-06-16T01:16:26.119Z","title":"WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Taskbuilder","product":"Taskbuilder","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-52695","published":"2026-06-15T20:19:32.110Z","updated":"2026-06-16T01:16:39.758Z","title":"WordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Al Monsor","product":"ABC Crypto Checkout","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-52694","published":"2026-06-15T20:19:31.460Z","updated":"2026-06-16T01:16:53.759Z","title":"WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WP E-Signature","product":"Signature Add-On for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-52693","published":"2026-06-15T20:19:30.813Z","updated":"2026-06-15T21:36:28.696Z","title":"WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-52692","published":"2026-06-15T20:19:30.167Z","updated":"2026-06-16T01:17:07.933Z","title":"WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-49781","published":"2026-06-15T20:19:29.522Z","updated":"2026-06-16T01:17:21.442Z","title":"WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-49780","published":"2026-06-15T20:19:28.889Z","updated":"2026-06-16T01:17:36.373Z","title":"WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Dokan, Inc.","product":"Dokan","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-49776","published":"2026-06-15T20:19:28.250Z","updated":"2026-06-16T01:17:49.918Z","title":"WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"JExtensions Store","product":"GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-49775","published":"2026-06-15T20:19:27.606Z","updated":"2026-06-16T01:18:03.299Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-49773","published":"2026-06-15T20:19:26.940Z","updated":"2026-06-15T21:36:43.747Z","title":"WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-49770","published":"2026-06-15T20:19:26.280Z","updated":"2026-06-16T01:18:17.278Z","title":"WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WP Travel Engine","product":"WP Travel Engine","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49769","published":"2026-06-15T20:19:25.631Z","updated":"2026-06-16T15:38:11.771Z","title":"WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-49768","published":"2026-06-15T20:19:24.982Z","updated":"2026-06-16T14:42:29.622Z","title":"WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Happyforms","product":"Happyforms","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49766","published":"2026-06-15T20:19:24.333Z","updated":"2026-06-16T14:35:20.540Z","title":"WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2026-49765","published":"2026-06-15T20:19:23.680Z","updated":"2026-06-16T12:21:58.784Z","title":"WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49764","published":"2026-06-15T20:19:23.035Z","updated":"2026-06-15T21:37:42.401Z","title":"WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-49763","published":"2026-06-15T20:19:22.379Z","updated":"2026-07-08T19:43:01.201Z","title":"WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for Contact Form 7 HubSpot","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49112","published":"2026-06-15T20:19:21.739Z","updated":"2026-06-16T15:36:09.188Z","title":"WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Tammersoft","product":"Shared Files","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-49110","published":"2026-06-15T20:19:21.028Z","updated":"2026-06-16T14:36:21.754Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-49109","published":"2026-06-15T20:19:20.383Z","updated":"2026-06-16T14:35:53.406Z","title":"WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"crm perks","product":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49106","published":"2026-06-15T20:19:19.724Z","updated":"2026-06-16T12:22:20.094Z","title":"WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for Contact Form 7 and Constant Contact","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-49105","published":"2026-06-15T20:19:19.065Z","updated":"2026-06-15T21:38:33.159Z","title":"WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-49104","published":"2026-06-15T20:19:18.410Z","updated":"2026-06-16T12:53:47.012Z","title":"WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-49085","published":"2026-06-15T20:19:17.744Z","updated":"2026-06-16T01:18:31.119Z","title":"WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-49083","published":"2026-06-15T20:19:17.107Z","updated":"2026-06-16T01:18:45.063Z","title":"WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability","severity":"HIGH","score":7.5,"vendor":"LatePoint","product":"LatePoint","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-49082","published":"2026-06-15T20:19:16.454Z","updated":"2026-06-16T01:18:58.516Z","title":"WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.4,"vendor":"Chatway Live Chat","product":"Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-49078","published":"2026-06-15T20:19:15.718Z","updated":"2026-06-16T01:19:11.884Z","title":"WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Travel Engine","product":"WP Travel Engine","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-49070","published":"2026-06-15T20:19:15.067Z","updated":"2026-06-15T21:43:15.125Z","title":"WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Knit Pay","product":"Knit Pay","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-49068","published":"2026-06-15T20:19:14.402Z","updated":"2026-06-16T01:19:25.798Z","title":"WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-49067","published":"2026-06-15T20:19:13.749Z","updated":"2026-06-16T01:19:39.239Z","title":"WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"yydevelopment","product":"Advanced 301 and 302 Redirect","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-49066","published":"2026-06-15T20:19:13.121Z","updated":"2026-06-16T01:19:53.359Z","title":"WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Conekta Group","product":"Conekta Payment Gateway","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-49065","published":"2026-06-15T20:19:12.467Z","updated":"2026-06-16T01:20:07.973Z","title":"WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"hippooo","product":"Hippoo Mobile App for WooCommerce","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-49063","published":"2026-06-15T20:19:11.815Z","updated":"2026-06-16T01:20:22.126Z","title":"WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.3,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-49061","published":"2026-06-15T20:19:11.162Z","updated":"2026-06-15T21:56:20.954Z","title":"WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"WPClever","product":"WPC Product Options for WooCommerce","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-49056","published":"2026-06-15T20:19:10.512Z","updated":"2026-06-16T01:20:36.581Z","title":"WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WebToffee","product":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-49055","published":"2026-06-15T20:19:09.863Z","updated":"2026-06-16T01:20:50.008Z","title":"WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Glen Don Mongaya","product":"Drag and Drop Multiple File Upload – Contact Form 7","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-49043","published":"2026-06-15T20:19:09.214Z","updated":"2026-06-16T01:21:03.911Z","title":"WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.7,"vendor":"WP Engine","product":"WP Migrate Lite","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-48970","published":"2026-06-15T20:19:08.561Z","updated":"2026-06-16T01:21:17.833Z","title":"WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-48966","published":"2026-06-15T20:19:07.824Z","updated":"2026-06-16T01:21:31.767Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FunnelKit","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-48965","published":"2026-06-15T20:19:07.173Z","updated":"2026-06-15T22:07:22.766Z","title":"WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"watchful","product":"XCloner","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-48964","published":"2026-06-15T20:19:06.519Z","updated":"2026-06-16T01:21:45.621Z","title":"WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ELEXtensions","product":"ELEX WordPress HelpDesk & Customer Ticketing System","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-48889","published":"2026-06-15T20:19:05.878Z","updated":"2026-06-16T01:21:59.053Z","title":"WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-48887","published":"2026-06-15T20:19:05.241Z","updated":"2026-06-16T01:22:12.473Z","title":"WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-48886","published":"2026-06-15T20:19:04.597Z","updated":"2026-06-16T01:22:26.081Z","title":"WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-48885","published":"2026-06-15T20:19:03.949Z","updated":"2026-06-16T01:22:40.902Z","title":"WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Groundhogg","product":"HollerBox","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-48883","published":"2026-06-15T20:19:03.290Z","updated":"2026-06-15T22:27:14.642Z","title":"WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPClever","product":"WPC Product Bundles for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-48882","published":"2026-06-15T20:19:02.652Z","updated":"2026-06-16T01:22:54.347Z","title":"WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"codepeople","product":"WP Time Slots Booking Form","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-48881","published":"2026-06-15T20:19:02.008Z","updated":"2026-06-16T15:35:19.965Z","title":"WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.1,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-48880","published":"2026-06-15T20:19:01.375Z","updated":"2026-06-16T15:09:57.246Z","title":"WordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-48878","published":"2026-06-15T20:19:00.725Z","updated":"2026-06-16T14:36:18.633Z","title":"WordPress Visual Link Preview plugin <= 2.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bootstrapped Ventures","product":"Visual Link Preview","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-48876","published":"2026-06-15T20:19:00.066Z","updated":"2026-06-16T12:25:13.971Z","title":"WordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Web Guy","product":"Stop Spammers","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-48874","published":"2026-06-15T20:18:59.414Z","updated":"2026-06-15T22:30:47.465Z","title":"WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-48873","published":"2026-06-15T20:18:58.759Z","updated":"2026-06-16T13:48:33.529Z","title":"WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Montonio","product":"Montonio for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-48872","published":"2026-06-15T20:18:58.122Z","updated":"2026-06-16T13:43:23.879Z","title":"WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPDeveloper","product":"EmbedPress","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-48871","published":"2026-06-15T20:18:57.470Z","updated":"2026-06-16T15:06:43.370Z","title":"WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Takashi Kitajima","product":"MW WP Form","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-48870","published":"2026-06-15T20:18:56.807Z","updated":"2026-06-16T14:33:26.545Z","title":"WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"King Addons","product":"King Addons for Elementor","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-48868","published":"2026-06-15T20:18:56.159Z","updated":"2026-06-16T12:25:36.274Z","title":"WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"mra13 / Team Tips and Tricks HQ","product":"Simple Shopping Cart","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-48867","published":"2026-06-15T20:18:55.505Z","updated":"2026-06-16T17:10:55.903Z","title":"WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-48838","published":"2026-06-15T20:18:54.839Z","updated":"2026-06-16T12:59:16.931Z","title":"WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPExperts","product":"Post SMTP","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-48836","published":"2026-06-15T20:18:54.197Z","updated":"2026-06-16T13:39:31.141Z","title":"WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"MantraBrain","product":"Easy Invoice","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2026-48835","published":"2026-06-15T20:18:53.544Z","updated":"2026-06-16T14:59:51.463Z","title":"WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Awesomemotive","product":"Contact Form by WPForms","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-45441","published":"2026-06-15T20:18:52.887Z","updated":"2026-06-16T14:37:21.093Z","title":"WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability","severity":"HIGH","score":7.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-45439","published":"2026-06-15T20:18:52.246Z","updated":"2026-06-16T12:26:45.649Z","title":"WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Realtyna","product":"Realtyna Organic IDX plugin","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-45437","published":"2026-06-15T20:18:51.605Z","updated":"2026-06-15T22:38:48.488Z","title":"WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bhavin Thummar","product":"Product Filter Widget for Elementor","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42775","published":"2026-06-15T20:18:50.960Z","updated":"2026-06-16T01:23:08.431Z","title":"WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42752","published":"2026-06-15T20:18:50.323Z","updated":"2026-06-16T01:23:21.946Z","title":"WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mra13 / Team Tips and Tricks HQ","product":"Stripe Payments","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-42743","published":"2026-06-15T20:18:49.676Z","updated":"2026-06-16T01:23:35.285Z","title":"WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"Masteriyo - LMS","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-42688","published":"2026-06-15T20:18:49.037Z","updated":"2026-06-16T01:23:48.798Z","title":"WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-42687","published":"2026-06-15T20:18:48.391Z","updated":"2026-06-16T01:24:02.220Z","title":"WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-42686","published":"2026-06-15T20:18:47.734Z","updated":"2026-06-16T01:24:15.641Z","title":"WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-42668","published":"2026-06-15T20:18:47.069Z","updated":"2026-06-16T01:24:29.956Z","title":"WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Omnisend","product":"Email Marketing for WooCommerce by Omnisend","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-42667","published":"2026-06-15T20:18:46.425Z","updated":"2026-06-16T01:24:43.572Z","title":"WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-42666","published":"2026-06-15T20:18:45.752Z","updated":"2026-06-16T01:24:57.021Z","title":"WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-42665","published":"2026-06-15T20:18:45.091Z","updated":"2026-06-16T01:25:11.078Z","title":"WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-42664","published":"2026-06-15T20:18:44.435Z","updated":"2026-06-16T12:29:55.738Z","title":"WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Motive Commerce Search","product":"AI Product Search for WooCommerce &#8211; Motive Commerce Search","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-42663","published":"2026-06-15T20:18:43.773Z","updated":"2026-06-16T17:11:01.608Z","title":"WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-42662","published":"2026-06-15T20:18:43.141Z","updated":"2026-06-16T13:03:42.375Z","title":"WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-42661","published":"2026-06-15T20:18:42.494Z","updated":"2026-06-16T13:35:57.479Z","title":"WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability","severity":"HIGH","score":8.8,"vendor":"aguilatechnologies","product":"WP Customer Area","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-42660","published":"2026-06-15T20:18:41.845Z","updated":"2026-06-16T15:04:58.281Z","title":"WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-42659","published":"2026-06-15T20:18:41.188Z","updated":"2026-06-16T01:25:25.181Z","title":"WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nasir Ahmed","product":"Advanced Form Integration","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-42658","published":"2026-06-15T20:18:40.535Z","updated":"2026-06-16T01:25:38.562Z","title":"WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42657","published":"2026-06-15T20:18:39.877Z","updated":"2026-06-16T01:25:51.998Z","title":"WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-42656","published":"2026-06-15T20:18:39.220Z","updated":"2026-06-16T01:26:07.488Z","title":"WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-42655","published":"2026-06-15T20:18:38.573Z","updated":"2026-06-15T22:30:46.983Z","title":"WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WPManageNinja","product":"Best Payments Plugin for WP","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-42651","published":"2026-06-15T20:18:37.908Z","updated":"2026-06-16T01:26:20.949Z","title":"WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-42650","published":"2026-06-15T20:18:37.277Z","updated":"2026-06-16T01:26:34.484Z","title":"WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.2,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-42649","published":"2026-06-15T20:18:36.620Z","updated":"2026-06-16T01:26:48.916Z","title":"WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Archetyped","product":"Favicon Rotator","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42640","published":"2026-06-15T20:18:35.968Z","updated":"2026-06-16T01:27:02.879Z","title":"WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-42639","published":"2026-06-15T20:18:35.311Z","updated":"2026-06-16T01:27:17.407Z","title":"WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Dev4Press","product":"GD Rating System","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-42411","published":"2026-06-15T20:18:34.651Z","updated":"2026-06-15T22:30:02.067Z","title":"WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"XServer","product":"CloudSecure WP Security","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-42386","published":"2026-06-15T20:18:34.002Z","updated":"2026-06-16T01:27:31.842Z","title":"WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"tychesoftwares","product":"Order Delivery Date for WooCommerce","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-42384","published":"2026-06-15T20:18:33.351Z","updated":"2026-06-16T14:38:26.688Z","title":"WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-42381","published":"2026-06-15T20:18:32.706Z","updated":"2026-06-16T12:31:15.056Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"FunnelKit","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-42378","published":"2026-06-15T20:18:32.060Z","updated":"2026-06-16T17:11:08.675Z","title":"WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-41556","published":"2026-06-15T20:18:31.411Z","updated":"2026-06-16T13:04:48.550Z","title":"WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-40799","published":"2026-06-15T20:18:30.750Z","updated":"2026-06-15T22:29:31.629Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.8,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-40798","published":"2026-06-15T20:18:30.041Z","updated":"2026-06-16T15:01:46.614Z","title":"WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-40796","published":"2026-06-15T20:18:29.382Z","updated":"2026-06-16T14:39:35.885Z","title":"WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ollybach","product":"WPPizza","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-40795","published":"2026-06-15T20:18:28.730Z","updated":"2026-06-16T01:27:45.671Z","title":"WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-40794","published":"2026-06-15T20:18:28.082Z","updated":"2026-06-16T01:27:59.148Z","title":"WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-40793","published":"2026-06-15T20:18:27.433Z","updated":"2026-06-16T01:28:12.691Z","title":"WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Groundhogg","product":"Groundhogg","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-40792","published":"2026-06-15T20:18:26.781Z","updated":"2026-06-15T22:28:54.301Z","title":"WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-40791","published":"2026-06-15T20:18:26.123Z","updated":"2026-06-16T01:28:26.570Z","title":"WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"WP Time Slots Booking Form","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-40790","published":"2026-06-15T20:18:25.472Z","updated":"2026-06-16T01:28:39.932Z","title":"WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VeronaLabs","product":"WP SMS","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-40789","published":"2026-06-15T20:18:24.831Z","updated":"2026-06-16T01:28:53.369Z","title":"WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-40788","published":"2026-06-15T20:18:24.184Z","updated":"2026-06-16T01:29:08.917Z","title":"WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-40787","published":"2026-06-15T20:18:23.530Z","updated":"2026-06-16T01:29:22.335Z","title":"WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-40785","published":"2026-06-15T20:18:22.884Z","updated":"2026-06-15T22:27:23.338Z","title":"WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-40782","published":"2026-06-15T20:18:22.238Z","updated":"2026-06-16T01:29:36.373Z","title":"WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-40781","published":"2026-06-15T20:18:21.598Z","updated":"2026-06-16T01:29:50.492Z","title":"WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"ReviewX","product":"ReviewX","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-40779","published":"2026-06-15T20:18:20.950Z","updated":"2026-06-16T12:32:03.228Z","title":"WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Yannick Lefebvre","product":"Link Library","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-40776","published":"2026-06-15T20:18:20.297Z","updated":"2026-06-16T17:11:14.673Z","title":"WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-40775","published":"2026-06-15T20:18:19.649Z","updated":"2026-06-16T13:14:36.843Z","title":"WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Royal Plugins","product":"Royal MCP","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-40774","published":"2026-06-15T20:18:19.002Z","updated":"2026-06-15T22:25:14.857Z","title":"WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"SaasProject","product":"Booking Package","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-40773","published":"2026-06-15T20:18:18.353Z","updated":"2026-06-16T18:07:02.542Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-40772","published":"2026-06-15T20:18:17.701Z","updated":"2026-06-16T14:40:03.294Z","title":"WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Ahmad","product":"GeekyBot","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-40771","published":"2026-06-15T20:18:17.075Z","updated":"2026-06-16T12:32:24.744Z","title":"WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-40770","published":"2026-06-15T20:18:16.429Z","updated":"2026-06-16T17:11:20.769Z","title":"WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-40769","published":"2026-06-15T20:18:15.771Z","updated":"2026-06-16T13:19:07.382Z","title":"WordPress Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Satinder Singh","product":"Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-40767","published":"2026-06-15T20:18:15.139Z","updated":"2026-06-15T22:24:32.247Z","title":"WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-40766","published":"2026-06-15T20:18:14.487Z","updated":"2026-06-16T15:12:06.966Z","title":"WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-40762","published":"2026-06-15T20:18:13.829Z","updated":"2026-06-16T14:25:44.458Z","title":"WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"WPGraphQL","product":"WPGraphQL","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-40743","published":"2026-06-15T20:18:13.192Z","updated":"2026-06-16T12:32:51.257Z","title":"WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-40741","published":"2026-06-15T20:18:12.544Z","updated":"2026-06-16T17:11:26.121Z","title":"WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Jose Conti","product":"Redsys for WooCommerce Light","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-40732","published":"2026-06-15T20:18:11.884Z","updated":"2026-06-16T13:35:37.184Z","title":"WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rainafarai","product":"Notification for Telegram","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-40727","published":"2026-06-15T20:18:11.246Z","updated":"2026-06-15T22:23:12.492Z","title":"WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Groundhogg","product":"Groundhogg","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-39594","published":"2026-06-15T20:18:10.615Z","updated":"2026-06-16T15:13:18.512Z","title":"WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Themefic","product":"Ultra Addons for WPForms","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-39591","published":"2026-06-15T20:18:09.965Z","updated":"2026-06-16T14:29:00.298Z","title":"WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"CMSJunkie – WordPress Business Directory Plugins","product":"WP-BusinessDirectory","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-39587","published":"2026-06-15T20:18:09.322Z","updated":"2026-06-16T12:33:13.234Z","title":"WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-39584","published":"2026-06-15T20:18:08.682Z","updated":"2026-06-16T17:11:31.439Z","title":"WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-39583","published":"2026-06-15T20:18:08.042Z","updated":"2026-06-16T13:43:10.144Z","title":"WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Datalogics","product":"Datalogics Ecommerce Delivery","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-39579","published":"2026-06-15T20:18:07.393Z","updated":"2026-06-15T22:22:02.036Z","title":"WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-39540","published":"2026-06-15T20:18:06.750Z","updated":"2026-06-16T15:36:31.547Z","title":"WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Amit Mittal","product":"Shipment Tracker for Woocommerce","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-39534","published":"2026-06-15T20:18:06.115Z","updated":"2026-06-16T14:28:08.480Z","title":"WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Wp Directory Kit","product":"WP Directory Kit","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-39533","published":"2026-06-15T20:18:05.463Z","updated":"2026-06-16T12:33:39.690Z","title":"WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPTasty","product":"AWP Classifieds","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-39532","published":"2026-06-15T20:18:04.811Z","updated":"2026-06-16T17:11:36.864Z","title":"WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Stiofan","product":"Events Calendar for GeoDirectory","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-39530","published":"2026-06-15T20:18:04.156Z","updated":"2026-06-16T13:49:12.591Z","title":"WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"SpeakOut!","product":"SpeakOut! Email Petitions","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-39527","published":"2026-06-15T20:18:03.459Z","updated":"2026-06-15T22:20:56.739Z","title":"WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sc Internet Vivoo","product":"WpStream","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-39525","published":"2026-06-15T20:18:02.802Z","updated":"2026-06-16T15:40:27.197Z","title":"WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-39524","published":"2026-06-15T20:18:02.164Z","updated":"2026-06-16T14:27:19.574Z","title":"WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGrill","product":"Masteriyo - LMS","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-39519","published":"2026-06-15T20:18:01.514Z","updated":"2026-06-16T12:36:27.496Z","title":"WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ahmad","product":"GeekyBot","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-39518","published":"2026-06-15T20:18:00.857Z","updated":"2026-06-16T17:11:42.240Z","title":"WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.1,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-39515","published":"2026-06-15T20:18:00.196Z","updated":"2026-06-16T14:02:06.375Z","title":"WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-39514","published":"2026-06-15T20:17:59.540Z","updated":"2026-06-15T22:20:26.340Z","title":"WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39513","published":"2026-06-15T20:17:58.887Z","updated":"2026-06-16T15:45:58.541Z","title":"WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Easy Appointments","product":"Easy Appointments","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-39512","published":"2026-06-15T20:17:58.234Z","updated":"2026-06-16T14:26:28.038Z","title":"WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-39511","published":"2026-06-15T20:17:57.566Z","updated":"2026-06-16T12:34:02.768Z","title":"WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-39507","published":"2026-06-15T20:17:56.914Z","updated":"2026-06-16T17:11:48.235Z","title":"WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeisle","product":"Social Slider Feed","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39503","published":"2026-06-15T20:17:56.267Z","updated":"2026-06-16T14:24:18.353Z","title":"WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-39502","published":"2026-06-15T20:17:55.614Z","updated":"2026-06-15T22:17:49.682Z","title":"WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"10Web","product":"Form Maker by 10Web","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-39499","published":"2026-06-15T20:17:54.975Z","updated":"2026-06-16T15:49:00.579Z","title":"WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Wombat Plugins","product":"Advanced Product Fields (Product Addons) for WooCommerce","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-39498","published":"2026-06-15T20:17:54.326Z","updated":"2026-06-16T14:21:20.468Z","title":"WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Yeeaddons","product":"YayMail","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-39493","published":"2026-06-15T20:17:53.649Z","updated":"2026-06-16T12:34:29.242Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-39492","published":"2026-06-15T20:17:53.002Z","updated":"2026-06-16T17:11:53.493Z","title":"WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Flipper Code – WordPress Development Company","product":"WP Maps","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-39491","published":"2026-06-15T20:17:52.361Z","updated":"2026-06-16T14:35:13.188Z","title":"WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"artbees","product":"JupiterX Core","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-39489","published":"2026-06-15T20:17:51.713Z","updated":"2026-06-15T22:17:06.535Z","title":"WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.4,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-39481","published":"2026-06-15T20:17:51.078Z","updated":"2026-06-16T18:05:20.377Z","title":"WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-39480","published":"2026-06-15T20:17:50.436Z","updated":"2026-06-16T14:24:35.327Z","title":"WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Inisev","product":"Backup Migration","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2026-39478","published":"2026-06-15T20:17:49.777Z","updated":"2026-06-16T12:36:54.641Z","title":"WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Eli Scheetz","product":"Anti-Malware Security and Brute-Force Firewall","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-39474","published":"2026-06-15T20:17:49.137Z","updated":"2026-06-16T17:11:59.402Z","title":"WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"metaphorcreations","product":"Post Duplicator","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-39472","published":"2026-06-15T20:17:48.488Z","updated":"2026-06-16T14:48:49.748Z","title":"WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Overnight","product":"WooCommerce PDF Invoices & Packing Slips","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-39471","published":"2026-06-15T20:17:47.824Z","updated":"2026-06-15T22:16:38.626Z","title":"WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-39470","published":"2026-06-15T20:17:47.174Z","updated":"2026-06-16T15:58:22.037Z","title":"WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Brainstorm Force","product":"WooCommerce Cart Abandonment Recovery","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-39468","published":"2026-06-15T20:17:46.515Z","updated":"2026-06-16T14:24:05.282Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2026-39465","published":"2026-06-15T20:17:45.857Z","updated":"2026-06-16T12:37:22.979Z","title":"WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"MetaSlider","product":"Responsive Slider by MetaSlider","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-39463","published":"2026-06-15T20:17:45.221Z","updated":"2026-06-16T17:12:07.093Z","title":"WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ManageWP","product":"ManageWP Worker","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39451","published":"2026-06-15T20:17:44.574Z","updated":"2026-06-16T14:51:38.985Z","title":"WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"jgwhite33","product":"WP Google Review Slider","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39450","published":"2026-06-15T20:17:43.929Z","updated":"2026-06-15T22:15:53.514Z","title":"WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-39449","published":"2026-06-15T20:17:43.278Z","updated":"2026-06-16T17:42:09.522Z","title":"WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IT Path Solutions","product":"Contact Form to Any API","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-39447","published":"2026-06-15T20:17:42.633Z","updated":"2026-06-16T14:23:32.914Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-39441","published":"2026-06-15T20:17:41.983Z","updated":"2026-06-16T12:40:12.410Z","title":"WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Naked Cat Plugins (by Webdados)","product":"Feed KuantoKusta for WooCommerce – Free","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-39435","published":"2026-06-15T20:17:41.329Z","updated":"2026-06-16T17:12:12.586Z","title":"WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bgermann","product":"CformsII","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-39434","published":"2026-06-15T20:17:40.681Z","updated":"2026-06-16T14:52:29.421Z","title":"WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WebAppick","product":"CTX Feed","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-34902","published":"2026-06-15T20:17:40.029Z","updated":"2026-06-15T22:14:40.820Z","title":"WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Product Table","product":"WooCommerce Product Table Lite","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-34901","published":"2026-06-15T20:17:39.373Z","updated":"2026-06-16T15:54:08.187Z","title":"WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Paul","product":"iControlWP","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-34900","published":"2026-06-15T20:17:38.726Z","updated":"2026-06-16T14:22:12.128Z","title":"WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-34898","published":"2026-06-15T20:17:38.066Z","updated":"2026-06-16T12:40:51.206Z","title":"WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Event Tickets Manager for WooCommerce","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-34892","published":"2026-06-15T20:17:37.428Z","updated":"2026-10-31T07:50:46.088Z","title":"WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-34891","published":"2026-06-15T20:17:36.775Z","updated":"2026-06-16T14:53:28.266Z","title":"WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"IDPay","product":"IDPay Payment Gateway for Woocommerce","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-34886","published":"2026-06-15T20:17:36.127Z","updated":"2026-06-15T22:13:22.094Z","title":"WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-27407","published":"2026-06-15T20:17:35.477Z","updated":"2026-06-16T18:11:25.205Z","title":"WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-27333","published":"2026-06-15T20:17:34.820Z","updated":"2026-06-16T14:14:00.714Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-27089","published":"2026-06-15T20:17:34.164Z","updated":"2026-06-16T12:41:12.254Z","title":"WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability","severity":"HIGH","score":7.5,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-27053","published":"2026-06-15T20:17:33.502Z","updated":"2026-06-16T17:12:23.197Z","title":"WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-25440","published":"2026-06-15T20:17:32.855Z","updated":"2026-06-16T14:54:00.518Z","title":"WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-25425","published":"2026-06-15T20:17:32.186Z","updated":"2026-06-15T22:12:41.867Z","title":"WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-24637","published":"2026-06-15T20:17:31.533Z","updated":"2026-06-16T18:16:42.744Z","title":"WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-23970","published":"2026-06-15T20:17:30.879Z","updated":"2026-06-16T14:19:01.623Z","title":"WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeisle","product":"Redirection for Contact Form 7","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-9691","published":"2026-06-15T20:17:30.135Z","updated":"2026-06-16T14:18:28.082Z","title":"WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2025-69332","published":"2026-06-15T20:17:29.479Z","updated":"2026-06-16T12:41:47.070Z","title":"WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"myCred","product":"Bookify","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-68872","published":"2026-06-15T20:17:28.836Z","updated":"2026-06-16T17:12:28.652Z","title":"WordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Eli","product":"Eli&#039;s WordCents adSense Widget with Analytics","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-68851","published":"2026-06-15T20:17:28.191Z","updated":"2026-06-16T14:58:19.463Z","title":"WordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ArrayHQ","product":"Okay Toolkit","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68840","published":"2026-06-15T20:17:27.538Z","updated":"2026-06-15T22:09:58.366Z","title":"WordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"markbeljaars","product":"iRobots.txt SEO","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-68049","published":"2026-06-15T20:17:26.877Z","updated":"2026-06-16T18:14:22.000Z","title":"WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"bunny.net","product":"bunny.net","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-60175","published":"2026-06-15T20:17:26.157Z","updated":"2026-06-16T14:17:26.674Z","title":"WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"vynnus","product":"PopAd","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-59133","published":"2026-06-15T20:17:25.507Z","updated":"2026-06-16T12:42:08.374Z","title":"WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Projectopia","product":"Projectopia","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-15659","published":"2026-06-15T15:14:19.058Z","updated":"2026-06-15T19:24:01.681Z","title":"WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"liseperu","product":"Elizaibots","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2025-15658","published":"2026-06-15T15:14:18.408Z","updated":"2026-06-15T16:08:18.323Z","title":"WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"rewish","product":"WP Emmet","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-64215","published":"2026-06-15T13:03:24.130Z","updated":"2026-06-15T16:12:38.334Z","title":"WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"MasterStudy LMS Pro","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-49064","published":"2026-06-15T13:01:25.698Z","updated":"2026-06-15T15:10:44.449Z","title":"WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Stiofan","product":"GetPaid","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-48969","published":"2026-06-15T12:58:56.144Z","updated":"2026-06-15T19:24:11.776Z","title":"WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Really Simple Plugins B.V.","product":"Really Simple SSL","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-49111","published":"2026-06-15T12:52:36.862Z","updated":"2026-06-15T15:51:36.374Z","title":"WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeGrill","product":"Masteriyo - LMS","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-49062","published":"2026-06-15T12:51:13.634Z","updated":"2026-06-15T14:48:17.589Z","title":"WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"WP Engine","product":"Faust.js","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-52704","published":"2026-06-15T12:49:49.160Z","updated":"2026-06-15T15:54:11.621Z","title":"WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Edgar Rojas","product":"WooCommerce PDF Invoice Builder","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-24618","published":"2026-06-12T20:46:18.717Z","updated":"2026-06-13T03:35:17.571Z","title":"WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HashThemes","product":"Hash Elements","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-42653","published":"2026-06-11T21:07:15.235Z","updated":"2026-06-12T13:43:54.132Z","title":"WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-39494","published":"2026-06-11T21:05:40.175Z","updated":"2026-06-12T10:04:30.552Z","title":"WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW Plugins","product":"Product Filter by WBW","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-42647","published":"2026-06-11T21:04:14.881Z","updated":"2026-06-12T15:41:24.715Z","title":"WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Beardev","product":"JoomSport","kev":false,"epss":0.01323,"kevAdded":null},{"id":"CVE-2026-49060","published":"2026-06-11T21:02:46.094Z","updated":"2026-06-12T12:28:12.294Z","title":"WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hippoo","product":"Hippoo Mobile App for WooCommerce","kev":false,"epss":0.01839,"kevAdded":null},{"id":"CVE-2023-32959","published":"2026-06-11T10:50:00.764Z","updated":"2026-06-11T16:03:17.760Z","title":"WordPress MetroStore theme <= 1.3.2 - Broken Access Control","severity":"MEDIUM","score":4.3,"vendor":"Sparkle WP","product":"MetroStore","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-25969","published":"2026-06-11T10:46:09.174Z","updated":"2026-06-11T14:36:17.024Z","title":"WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeHunk","product":"Contact Form & Lead Form Elementor Builder","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2022-47150","published":"2026-06-11T10:43:01.912Z","updated":"2026-06-11T12:25:01.706Z","title":"WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WooCommerce Conversion Tracking","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2022-45813","published":"2026-06-11T10:41:35.694Z","updated":"2026-06-11T16:13:25.077Z","title":"WordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRF","severity":"MEDIUM","score":5.4,"vendor":"BeRocket","product":"Advanced AJAX Product Filters","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2022-44630","published":"2026-06-11T09:50:59.773Z","updated":"2026-06-11T12:34:39.802Z","title":"WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)","severity":"MEDIUM","score":4.6,"vendor":"YITH","product":"YITH WooCommerce Product Slider Carousel","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2022-42479","published":"2026-06-11T09:47:50.956Z","updated":"2026-06-11T16:01:51.014Z","title":"WordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"TemplateHouse","product":"Soledad","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2023-40200","published":"2026-06-11T07:11:29.248Z","updated":"2026-06-11T13:52:11.680Z","title":"WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Essential Plugin","product":"WP Logo Showcase Responsive Slider and Carousel","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2024-32110","published":"2026-06-11T07:05:50.338Z","updated":"2026-06-11T16:13:31.880Z","title":"WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2023-33999","published":"2026-06-11T07:03:46.985Z","updated":"2026-06-11T15:59:33.856Z","title":"WordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPVibes","product":"WP Mail Log","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-49069","published":"2026-06-10T12:39:37.441Z","updated":"2026-06-10T15:09:57.355Z","title":"WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPZOOM","product":"WPZOOM Portfolio","kev":false,"epss":0.01166,"kevAdded":null},{"id":"CVE-2026-49777","published":"2026-06-05T08:59:53.320Z","updated":"2026-06-08T16:18:18.074Z","title":"WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability","severity":"CRITICAL","score":10,"vendor":"ShapedPlugin, LLC","product":"Product Slider Pro for WooCommerce","kev":false,"epss":0.01656,"kevAdded":null},{"id":"CVE-2026-49077","published":"2026-06-04T10:49:13.375Z","updated":"2026-06-04T15:06:55.581Z","title":"WordPress WP eMember plugin <= v10.2.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tips and Tricks HQ","product":"WP eMember","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-49771","published":"2026-06-04T09:49:49.368Z","updated":"2026-06-04T12:07:52.810Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-15656","published":"2026-06-03T09:04:26.501Z","updated":"2026-06-03T14:14:02.597Z","title":"WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Mojoomla","product":"School Management","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-15655","published":"2026-06-03T09:00:31.569Z","updated":"2026-06-03T12:35:57.420Z","title":"WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Mojoomla","product":"School Management","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-15654","published":"2026-06-03T08:55:51.229Z","updated":"2026-06-03T12:40:13.270Z","title":"WordPress Prague plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fox-themes","product":"Prague","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-40780","published":"2026-06-02T15:07:59.686Z","updated":"2026-06-02T15:53:37.430Z","title":"WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-42654","published":"2026-06-02T14:48:11.173Z","updated":"2026-06-02T16:48:26.226Z","title":"WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Wallet System for WooCommerce","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-49782","published":"2026-06-02T14:03:35.907Z","updated":"2026-06-02T14:41:13.598Z","title":"WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-27351","published":"2026-06-02T14:01:46.153Z","updated":"2026-06-02T15:13:17.122Z","title":"WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Sekander Badsha","product":"Crew HRM","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-28116","published":"2026-06-02T13:59:58.337Z","updated":"2026-06-02T15:13:53.750Z","title":"WordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Emilia Projects","product":"Progress Planner","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-68886","published":"2026-06-02T13:51:06.469Z","updated":"2026-06-02T15:03:28.403Z","title":"WordPress Cookiteer theme <= 1.4.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"androThemes","product":"Cookiteer","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-69369","published":"2026-06-02T13:50:03.635Z","updated":"2026-06-02T15:05:14.121Z","title":"WordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Axiomthemes","product":"Racquet","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-58897","published":"2026-06-02T13:48:50.524Z","updated":"2026-06-02T15:15:14.184Z","title":"WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Axiomthemes","product":"Fermentio","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-58707","published":"2026-06-02T13:48:05.064Z","updated":"2026-06-02T15:15:45.398Z","title":"WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Axiomthemes","product":"Spin","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-39555","published":"2026-06-02T13:34:50.731Z","updated":"2026-06-02T15:20:20.171Z","title":"WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Askka","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-39553","published":"2026-06-02T12:41:09.816Z","updated":"2026-06-02T14:45:37.674Z","title":"WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"WaveRide","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-39552","published":"2026-06-02T12:39:49.835Z","updated":"2026-06-02T14:45:53.020Z","title":"WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Code Supply Co.","product":"Blueprint","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-39551","published":"2026-06-02T10:46:56.854Z","updated":"2026-06-02T12:10:10.110Z","title":"WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Töbel","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-39550","published":"2026-06-02T10:44:44.165Z","updated":"2026-06-02T12:10:24.306Z","title":"WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Aperitif","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-42685","published":"2026-06-02T10:43:42.319Z","updated":"2026-06-02T12:10:38.070Z","title":"WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-42684","published":"2026-06-02T10:42:46.997Z","updated":"2026-06-02T12:10:52.635Z","title":"WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-42670","published":"2026-06-02T10:41:33.944Z","updated":"2026-06-02T15:21:07.502Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Etoile Web Design Incorporated","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-42669","published":"2026-06-02T10:40:24.435Z","updated":"2026-06-02T12:11:07.458Z","title":"WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-58705","published":"2026-06-02T10:27:26.083Z","updated":"2026-06-02T12:11:22.435Z","title":"WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Axiomthemes","product":"Crafti","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2025-58024","published":"2026-06-02T10:24:25.865Z","updated":"2026-06-02T12:11:37.367Z","title":"WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"UnboundStudio","product":"Accordion FAQ","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-53440","published":"2026-06-02T09:53:43.204Z","updated":"2026-06-02T12:11:51.486Z","title":"WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Axiomthemes","product":"Confidant","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2025-53346","published":"2026-06-02T09:52:09.457Z","updated":"2026-06-02T10:42:27.958Z","title":"WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"Thim Core","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-53345","published":"2026-06-02T09:47:50.705Z","updated":"2026-10-05T11:03:05.072Z","title":"WordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThimPress","product":"Thim Core","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-53302","published":"2026-06-02T09:45:48.853Z","updated":"2026-06-02T10:42:55.644Z","title":"WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Anton Shevchuk","product":"Constructor","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-53209","published":"2026-06-02T09:43:20.577Z","updated":"2026-06-02T10:43:09.589Z","title":"WordPress Masteriyo LMS PRO plugin <= 2.20.0  - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeisle","product":"Masteriyo LMS PRO","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-52766","published":"2026-06-02T09:41:47.303Z","updated":"2026-06-02T10:43:23.577Z","title":"WordPress Printeers Print & Ship plugin <= 1.17.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Printeers","product":"Printeers Print & Ship","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-52759","published":"2026-06-02T09:40:43.944Z","updated":"2026-06-02T10:43:37.457Z","title":"WordPress Accordion FAQ plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UnboundStudio","product":"Accordion FAQ","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-42671","published":"2026-06-01T15:28:45.728Z","updated":"2026-06-01T17:06:10.750Z","title":"WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-42672","published":"2026-06-01T15:27:46.841Z","updated":"2026-06-01T17:06:25.777Z","title":"WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Wp Directory Kit","product":"WP Directory Kit","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-42673","published":"2026-06-01T15:24:05.488Z","updated":"2026-06-01T17:06:40.773Z","title":"WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Logtivity Activity Logs","product":"Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-42674","published":"2026-06-01T15:22:10.252Z","updated":"2026-06-01T17:06:54.527Z","title":"WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability","severity":"HIGH","score":7.5,"vendor":"AAM Plugin","product":"Advanced Access Manager","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-42675","published":"2026-06-01T15:18:41.962Z","updated":"2026-06-01T17:07:08.054Z","title":"WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-42676","published":"2026-06-01T15:17:53.949Z","updated":"2026-06-01T17:07:22.055Z","title":"WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"myCred","product":"myCred","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-42677","published":"2026-06-01T15:16:18.238Z","updated":"2026-06-01T17:07:35.522Z","title":"WordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Ben Balter","product":"WP Document Revisions","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-42678","published":"2026-06-01T15:14:23.757Z","updated":"2026-06-01T17:07:50.165Z","title":"WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-42679","published":"2026-06-01T15:13:23.526Z","updated":"2026-06-01T17:08:04.612Z","title":"WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-42680","published":"2026-06-01T14:54:13.000Z","updated":"2026-06-01T16:17:52.856Z","title":"WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery Pro","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-42681","published":"2026-06-01T14:52:58.240Z","updated":"2026-06-01T16:18:08.230Z","title":"WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"E2Pdf.com","product":"e2pdf","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-42682","published":"2026-06-01T14:47:08.376Z","updated":"2026-06-01T16:18:21.693Z","title":"WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-42683","published":"2026-06-01T14:44:38.472Z","updated":"2026-06-01T16:18:35.103Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-48839","published":"2026-06-01T14:43:29.590Z","updated":"2026-06-01T16:18:50.112Z","title":"WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-48865","published":"2026-06-01T14:41:45.973Z","updated":"2026-06-01T16:19:03.535Z","title":"WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-48866","published":"2026-06-01T14:39:47.235Z","updated":"2026-06-01T16:19:18.234Z","title":"WordPress Gravity Forms  plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Rocketgenius Inc.","product":"Gravity Forms","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-48879","published":"2026-06-01T14:38:01.822Z","updated":"2026-06-01T16:19:32.323Z","title":"WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2022-41656","published":"2026-05-27T15:30:21.800Z","updated":"2026-05-27T17:31:30.495Z","title":"WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bizswoop","product":"Account Manager for WooCommerce","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-49054","published":"2026-05-27T15:12:03.620Z","updated":"2026-05-27T17:49:46.749Z","title":"WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mamunur Rashid","product":"The Post Grid","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-49053","published":"2026-05-27T14:58:16.215Z","updated":"2026-05-27T15:28:39.473Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-49052","published":"2026-05-27T14:55:55.994Z","updated":"2026-05-27T16:05:26.059Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-49051","published":"2026-05-27T14:53:44.345Z","updated":"2026-05-27T15:34:57.770Z","title":"WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Prasad Kirpekar","product":"WP Meta and Date Remover","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-49047","published":"2026-05-27T14:51:38.939Z","updated":"2026-05-27T17:48:33.038Z","title":"WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DearHive","product":"DearFlip","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-49046","published":"2026-05-27T14:49:37.761Z","updated":"2026-05-28T15:25:29.625Z","title":"WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Arjun Thakur","product":"Duplicate Page and Post","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-49044","published":"2026-05-27T14:46:17.551Z","updated":"2026-05-27T16:07:03.872Z","title":"WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Justin Kruit","product":"Advanced Custom Fields: Font Awesome Field","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-49045","published":"2026-05-27T14:44:05.685Z","updated":"2026-05-27T15:31:54.298Z","title":"WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Media","product":"Adminimize","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-49059","published":"2026-05-27T14:33:18.844Z","updated":"2026-05-28T00:33:43.335Z","title":"WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Facebook","product":"Facebook for WooCommerce","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-48973","published":"2026-05-27T14:28:59.191Z","updated":"2026-05-27T15:34:08.377Z","title":"WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Benbodhi","product":"SVG Support","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-48972","published":"2026-05-27T13:20:06.474Z","updated":"2026-05-27T14:46:23.991Z","title":"WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"SeedProd LLC","product":"SeedProd Pro","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-48971","published":"2026-05-27T11:53:24.538Z","updated":"2026-05-27T14:38:19.632Z","title":"WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Product Import Export for WooCommerce","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-42761","published":"2026-05-27T09:49:06.102Z","updated":"2026-05-27T10:47:15.749Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-42762","published":"2026-05-27T09:49:06.084Z","updated":"2026-05-27T10:47:29.773Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-42760","published":"2026-05-27T09:49:05.897Z","updated":"2026-05-27T10:47:45.332Z","title":"WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"revmakx","product":"Backup and Staging by WP Time Capsule","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-42758","published":"2026-05-27T09:49:05.837Z","updated":"2026-05-27T10:47:59.236Z","title":"WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Saleswonder Team: Tobias","product":"WebinarIgnition","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-42759","published":"2026-05-27T09:49:05.831Z","updated":"2026-05-27T10:48:13.381Z","title":"WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Timo","product":"Affiliate Super Assistent","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-42757","published":"2026-05-27T09:49:05.746Z","updated":"2026-05-27T10:48:27.794Z","title":"WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Saleswonder Team: Tobias","product":"WebinarIgnition","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-42756","published":"2026-05-27T09:49:05.712Z","updated":"2026-05-27T10:48:41.723Z","title":"WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Ludwig You","product":"QuickWebP &#8211; Compress / Optimize Images &amp; Convert WebP | SEO Friendly","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-42755","published":"2026-05-27T09:49:05.678Z","updated":"2026-05-27T10:48:55.254Z","title":"WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-42754","published":"2026-05-27T09:49:05.647Z","updated":"2026-05-27T10:49:08.838Z","title":"WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"phbernard","product":"Favicon","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-42751","published":"2026-05-27T09:49:05.581Z","updated":"2026-05-27T10:49:23.316Z","title":"WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Manager","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-42753","published":"2026-05-27T09:49:05.579Z","updated":"2026-05-27T10:49:37.618Z","title":"WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-42750","published":"2026-05-27T09:49:05.564Z","updated":"2026-05-27T10:49:51.087Z","title":"WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"WPComplete","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-42749","published":"2026-05-27T09:49:05.501Z","updated":"2026-05-27T10:50:05.078Z","title":"WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeisle","product":"Disable Comments for Any Post Types (Remove comments)","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-42748","published":"2026-05-27T09:49:05.477Z","updated":"2026-05-27T10:50:18.502Z","title":"WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPify","product":"WPify Woo Czech","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-42747","published":"2026-05-27T09:49:05.426Z","updated":"2026-05-27T10:50:32.583Z","title":"WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"hassantafreshi","product":"Easy Form Builder","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-42746","published":"2026-05-27T09:49:05.391Z","updated":"2026-05-27T10:50:46.565Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.3,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-42745","published":"2026-05-27T09:49:05.368Z","updated":"2026-05-27T10:51:00.336Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-42744","published":"2026-05-27T09:49:05.322Z","updated":"2026-05-27T10:51:14.177Z","title":"WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ads by WPQuads","product":"Ads by WPQuads","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-42740","published":"2026-05-27T09:49:05.087Z","updated":"2026-05-27T10:51:28.571Z","title":"WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"tainacan","product":"Tainacan","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-42739","published":"2026-05-27T09:49:05.017Z","updated":"2026-05-27T10:51:42.839Z","title":"WordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IniLerm","product":"Advanced IP Blocker","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-42738","published":"2026-05-27T09:49:04.835Z","updated":"2026-05-27T10:51:56.288Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-42737","published":"2026-05-27T09:49:04.590Z","updated":"2026-05-27T10:52:10.500Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-42736","published":"2026-05-27T09:49:04.452Z","updated":"2026-05-27T10:52:23.925Z","title":"WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-42735","published":"2026-05-27T09:49:04.375Z","updated":"2026-05-27T10:52:37.961Z","title":"WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability","severity":"HIGH","score":8.2,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-42728","published":"2026-05-27T09:49:04.347Z","updated":"2026-05-27T10:52:52.098Z","title":"WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"HT Plugins","product":"HT Contact Form 7","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-42730","published":"2026-05-27T09:49:04.330Z","updated":"2026-05-27T10:53:08.025Z","title":"WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-42733","published":"2026-05-27T09:49:04.144Z","updated":"2026-05-27T10:53:22.046Z","title":"WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"WPCS","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-42732","published":"2026-05-27T09:49:04.061Z","updated":"2026-05-27T10:53:36.798Z","title":"WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ads by WPQuads","product":"Ads by WPQuads","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-42725","published":"2026-05-27T09:49:04.049Z","updated":"2026-05-27T10:53:50.197Z","title":"WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Wham","product":"Checkout Files Upload for WooCommerce","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-42727","published":"2026-05-27T09:49:03.996Z","updated":"2026-05-27T10:54:04.749Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-42729","published":"2026-05-27T09:49:03.846Z","updated":"2026-05-27T10:54:18.249Z","title":"WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-42734","published":"2026-05-27T09:49:03.829Z","updated":"2026-05-27T10:54:32.385Z","title":"WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-42726","published":"2026-05-27T09:49:03.826Z","updated":"2026-05-27T10:54:46.207Z","title":"WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"AWP Classifieds","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-42731","published":"2026-05-27T09:49:03.156Z","updated":"2026-05-27T10:54:59.853Z","title":"WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-48968","published":"2026-05-27T08:48:52.315Z","updated":"2026-05-27T10:26:43.137Z","title":"WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Averta","product":"Master Slider","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-48877","published":"2026-05-27T08:47:23.577Z","updated":"2026-05-27T10:26:56.731Z","title":"WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tom","product":"GenerateBlocks","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-52747","published":"2026-05-27T08:40:21.524Z","updated":"2026-05-27T10:27:09.900Z","title":"WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jthemes","product":"Themebox - Digital Products Ecommerce","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-22741","published":"2026-05-27T08:35:03.372Z","updated":"2026-05-27T10:27:23.471Z","title":"WordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RiceTheme","product":"Felan Framework","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-14361","published":"2026-05-26T20:58:17.950Z","updated":"2026-05-27T10:42:23.535Z","title":"WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability","severity":"HIGH","score":7.1,"vendor":"AA-Team","product":"Woocommerce Envato Affiliates","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-25426","published":"2026-05-26T19:32:38.371Z","updated":"2026-05-27T10:42:37.078Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-24520","published":"2026-05-26T19:31:35.457Z","updated":"2026-05-27T10:42:51.509Z","title":"WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-25444","published":"2026-05-26T19:30:14.887Z","updated":"2026-05-27T10:43:05.630Z","title":"WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magepeople inc.","product":"WpBookingly","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27331","published":"2026-05-26T19:29:09.970Z","updated":"2026-05-27T10:43:19.687Z","title":"WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-24590","published":"2026-05-26T08:24:28.017Z","updated":"2026-05-26T10:47:02.945Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-24638","published":"2026-05-26T08:21:11.384Z","updated":"2026-05-26T10:47:16.343Z","title":"WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-27427","published":"2026-05-26T08:19:29.775Z","updated":"2026-05-26T10:47:30.404Z","title":"WordPress  Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-39642","published":"2026-05-26T07:51:29.452Z","updated":"2026-05-26T10:47:43.756Z","title":"WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SpabRice","product":"Nyla","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-39661","published":"2026-05-26T07:49:33.520Z","updated":"2026-05-26T10:47:57.175Z","title":"WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Magentech","product":"SW Core","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-39655","published":"2026-05-26T06:50:08.757Z","updated":"2026-05-26T10:48:10.546Z","title":"WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TeconceTheme","product":"Mayosis Core","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-32389","published":"2026-05-25T22:42:13.517Z","updated":"2026-05-26T10:49:19.385Z","title":"WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Linethemes","product":"NanoCare","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-42763","published":"2026-05-25T22:37:05.967Z","updated":"2026-05-26T10:49:33.396Z","title":"WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SePay team","product":"SePay Gateway","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-42773","published":"2026-05-25T22:35:22.966Z","updated":"2026-05-26T10:49:46.999Z","title":"WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"eMagicOne","product":"eMagicOne Store Manager","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-42774","published":"2026-05-25T22:34:09.714Z","updated":"2026-05-26T15:18:56.765Z","title":"WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-42776","published":"2026-05-25T22:32:53.753Z","updated":"2026-05-26T10:50:00.472Z","title":"WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-45209","published":"2026-05-25T22:31:15.254Z","updated":"2026-05-26T10:50:14.343Z","title":"WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"edward_plainview","product":"MyCryptoCheckout","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-45216","published":"2026-05-25T22:30:26.044Z","updated":"2026-05-26T10:50:28.271Z","title":"WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"StoreApps","product":"Smart Manager","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-45217","published":"2026-05-25T22:29:29.102Z","updated":"2026-05-26T10:50:41.696Z","title":"WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeHigh","product":"Stripe Payment Gateway for WooCommerce","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-45435","published":"2026-05-25T22:28:19.614Z","updated":"2026-05-26T15:19:10.629Z","title":"WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-45438","published":"2026-05-25T22:18:18.582Z","updated":"2026-05-26T10:50:55.141Z","title":"WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WebToffee","product":"Smart Coupons for WooCommerce","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-39436","published":"2026-05-25T22:15:20.514Z","updated":"2026-05-26T10:51:09.056Z","title":"WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"bgermann","product":"CformsII","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-24937","published":"2026-05-25T22:13:15.553Z","updated":"2026-05-26T10:51:22.482Z","title":"WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.2,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-48837","published":"2026-05-25T22:05:10.629Z","updated":"2026-05-26T10:51:35.869Z","title":"WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-27357","published":"2026-05-25T21:59:21.839Z","updated":"2026-05-26T10:51:50.030Z","title":"WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cornel Raiu","product":"WP Search Analytics","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-27398","published":"2026-05-25T21:56:44.615Z","updated":"2026-05-26T15:19:25.282Z","title":"WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"RSVP and Event Management","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-27346","published":"2026-05-25T21:54:57.073Z","updated":"2026-05-26T10:52:03.547Z","title":"WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Kings Plugins","product":"B2BKing","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-24554","published":"2026-05-25T21:41:48.295Z","updated":"2026-05-26T10:52:17.516Z","title":"WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Convers Lab","product":"WPSubscription","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-24527","published":"2026-05-25T21:40:35.813Z","updated":"2026-05-26T10:52:31.477Z","title":"WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Patterns in the cloud","product":"Autoship Cloud for WooCommerce Subscription Products","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-62745","published":"2026-05-25T21:34:48.423Z","updated":"2026-05-26T10:52:44.891Z","title":"WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Team Showcase","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-24586","published":"2026-05-25T21:32:42.595Z","updated":"2026-05-26T15:19:37.482Z","title":"WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Themeansar","product":"Newses","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-24592","published":"2026-05-25T21:31:16.558Z","updated":"2026-05-26T10:52:58.768Z","title":"WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Lucian Apostol","product":"Auto Affiliate Links","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-24582","published":"2026-05-25T21:10:18.203Z","updated":"2026-05-26T10:53:12.699Z","title":"WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPPOOL","product":"FlexTable","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-24545","published":"2026-05-25T21:08:33.958Z","updated":"2026-05-26T10:53:26.680Z","title":"WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nikki Blight","product":"QR Redirector","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-24574","published":"2026-05-25T21:07:12.854Z","updated":"2026-05-26T10:53:40.614Z","title":"WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Recorp","product":"Export WP Page to Static HTML/CSS","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-24597","published":"2026-05-25T21:05:44.747Z","updated":"2026-05-26T10:53:54.120Z","title":"WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WpDevArt","product":"Organization chart","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-24546","published":"2026-05-25T19:26:51.970Z","updated":"2026-05-26T15:19:51.670Z","title":"WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-39593","published":"2026-05-21T16:56:29.471Z","updated":"2026-05-21T19:30:53.577Z","title":"WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"HAPPY","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-39531","published":"2026-05-21T15:08:24.506Z","updated":"2026-05-21T15:56:39.967Z","title":"WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Wp Directory Kit","product":"WP Directory Kit","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-27393","published":"2026-05-21T08:24:57.386Z","updated":"2026-05-21T14:13:54.804Z","title":"WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tobias","product":"CF7 WOW Styler","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-27349","published":"2026-05-21T08:21:25.766Z","updated":"2026-05-21T12:06:37.088Z","title":"WordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFunnels Team","product":"Mail Mint","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-45444","published":"2026-05-20T18:00:51.131Z","updated":"2026-05-26T13:16:42.221Z","title":"WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Swings","product":"Gift Cards For WooCommerce Pro","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-42383","published":"2026-05-20T12:55:50.064Z","updated":"2026-05-20T15:29:13.270Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"YITH","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-24573","published":"2026-05-20T12:54:04.638Z","updated":"2026-05-20T13:48:33.272Z","title":"WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeisle","product":"Visualizer","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-27405","published":"2026-05-20T12:16:27.402Z","updated":"2026-05-20T14:18:21.835Z","title":"WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpBookingly","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-27424","published":"2026-05-20T12:13:34.960Z","updated":"2026-05-20T13:43:33.555Z","title":"WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-45443","published":"2026-05-20T12:11:50.087Z","updated":"2026-05-20T15:44:39.275Z","title":"WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"ADD-ONS.ORG","product":"PDF for Elementor Forms + Drag And Drop Template Builder","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-45442","published":"2026-05-19T10:54:55.655Z","updated":"2026-05-19T13:34:22.246Z","title":"WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-25431","published":"2026-05-12T16:32:39.081Z","updated":"2026-05-13T01:47:40.582Z","title":"WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Hustle","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-45215","published":"2026-05-12T11:02:10.118Z","updated":"2026-05-12T12:37:50.712Z","title":"WordPress WP EasyPay plugin <= 4.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-45218","published":"2026-05-12T11:02:10.114Z","updated":"2026-05-12T12:02:36.200Z","title":"WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability","severity":"HIGH","score":7.7,"vendor":"WP Travel","product":"WP Travel","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-45214","published":"2026-05-12T11:02:10.100Z","updated":"2026-05-12T21:13:24.367Z","title":"WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-45213","published":"2026-05-12T11:02:09.946Z","updated":"2026-05-12T12:40:02.851Z","title":"WordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"RealMag777","product":"BEAR","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-45211","published":"2026-05-12T11:02:09.926Z","updated":"2026-05-13T01:47:55.096Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Saad Iqbal","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-42742","published":"2026-05-12T11:02:09.910Z","updated":"2026-05-12T12:38:21.896Z","title":"WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Aman","product":"Views for WPForms","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-45212","published":"2026-05-12T11:02:09.902Z","updated":"2026-05-12T13:21:08.616Z","title":"WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gabe Livan","product":"Asset CleanUp: Page Speed Booster","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-45210","published":"2026-05-12T11:02:09.887Z","updated":"2026-05-12T12:04:47.372Z","title":"WordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Broadstreet","product":"Broadstreet Ads","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-42741","published":"2026-05-12T11:02:09.692Z","updated":"2026-05-12T21:13:31.727Z","title":"WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Aman","product":"Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-39432","published":"2026-05-12T07:49:19.358Z","updated":"2026-05-12T12:43:40.710Z","title":"WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-41554","published":"2026-05-07T13:28:59.279Z","updated":"2026-05-07T15:56:58.903Z","title":"WordPress Bricks Builder theme  1.9.2-2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bricks","product":"Bricks Builder","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-27415","published":"2026-05-07T10:20:28.844Z","updated":"2026-05-07T14:57:37.886Z","title":"WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PluginUs.Net","product":"BEAR","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-27416","published":"2026-05-07T08:38:15.411Z","updated":"2026-05-07T12:02:28.345Z","title":"WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-62127","published":"2026-05-07T07:54:04.998Z","updated":"2026-05-07T14:31:28.165Z","title":"WordPress WEN Logo Slider plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WEN Themes","product":"WEN Logo Slider","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-66105","published":"2026-05-07T07:46:34.030Z","updated":"2026-05-07T13:04:06.180Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-68060","published":"2026-05-07T07:44:12.919Z","updated":"2026-05-07T12:04:44.554Z","title":"WordPress Team Member plugin <= 8.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WPMart","product":"Team Member","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-68604","published":"2026-05-07T07:40:27.065Z","updated":"2026-05-07T14:57:47.072Z","title":"WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPGraphQL","product":"WPGraphQL","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-25468","published":"2026-05-07T07:37:59.351Z","updated":"2026-05-07T13:40:21.465Z","title":"WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-27329","published":"2026-05-07T07:35:51.273Z","updated":"2026-05-07T14:16:35.054Z","title":"WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Wishlist","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-25436","published":"2026-05-07T07:34:02.310Z","updated":"2026-05-07T15:59:27.450Z","title":"WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-27421","published":"2026-05-07T07:31:53.388Z","updated":"2026-05-07T13:03:38.524Z","title":"WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-40797","published":"2026-05-05T06:47:59.255Z","updated":"2026-05-05T12:26:25.646Z","title":"WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Saleswonder LLC","product":"WebinarIgnition","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-42641","published":"2026-04-29T10:40:45.970Z","updated":"2026-05-12T11:03:22.047Z","title":"WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ILLID","product":"Share This Image","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-42645","published":"2026-04-29T10:40:45.924Z","updated":"2026-05-12T11:03:21.814Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-42648","published":"2026-04-29T10:40:45.921Z","updated":"2026-05-12T11:03:21.810Z","title":"WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-42642","published":"2026-04-29T10:40:45.909Z","updated":"2026-05-12T11:03:22.036Z","title":"WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"StellarWP","product":"GiveWP","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-42646","published":"2026-04-29T10:40:45.888Z","updated":"2026-05-12T11:03:22.048Z","title":"WordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Steve Burge","product":"TaxoPress","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-42643","published":"2026-04-29T10:40:45.883Z","updated":"2026-05-12T11:03:22.050Z","title":"WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"StellarWP","product":"Image Widget","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-42644","published":"2026-04-29T10:40:45.882Z","updated":"2026-05-12T11:03:21.815Z","title":"WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"BetterDocs","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-42652","published":"2026-04-29T10:40:45.853Z","updated":"2026-05-12T11:03:21.812Z","title":"WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-42412","published":"2026-04-29T07:51:40.734Z","updated":"2026-04-29T13:34:49.632Z","title":"WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-42377","published":"2026-04-29T07:27:22.305Z","updated":"2026-04-29T13:16:17.514Z","title":"WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Brainstorm Force","product":"SureForms Pro","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-42410","published":"2026-04-27T10:41:03.641Z","updated":"2026-04-27T13:39:25.112Z","title":"WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-22337","published":"2026-04-27T10:31:04.017Z","updated":"2026-04-28T16:14:41.031Z","title":"WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Directorist","product":"Directorist Social Login","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-22336","published":"2026-04-27T10:24:43.323Z","updated":"2026-04-28T16:14:40.732Z","title":"WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Directorist Booking","product":"Directorist Booking","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-42379","published":"2026-04-27T08:26:37.727Z","updated":"2026-04-27T10:31:24.329Z","title":"WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.7,"vendor":"WPDeveloper","product":"Templately","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-39440","published":"2026-04-23T12:11:41.992Z","updated":"2026-04-23T13:39:41.336Z","title":"WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Funnelforms LLC","product":"FunnelFormsPro","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-62110","published":"2026-04-23T11:05:07.792Z","updated":"2026-04-28T16:14:01.755Z","title":"WordPress Rescue Shortcodes plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rescue Themes","product":"Rescue Shortcodes","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-62104","published":"2026-04-23T11:02:06.201Z","updated":"2026-04-28T16:14:01.739Z","title":"WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Navneil Naicker","product":"ACF Galerie 4","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-28040","published":"2026-04-23T11:00:04.172Z","updated":"2026-04-28T16:15:05.092Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-58922","published":"2026-04-22T15:44:47.623Z","updated":"2026-04-28T16:13:49.641Z","title":"WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeFusion","product":"Avada","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-39467","published":"2026-04-21T09:35:29.246Z","updated":"2026-05-19T17:18:42.463Z","title":"WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"MetaSlider","product":"Responsive Slider by MetaSlider","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2025-63029","published":"2026-04-15T16:21:23.512Z","updated":"2026-04-28T16:14:08.877Z","title":"WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-6372","published":"2026-04-15T16:16:46.970Z","updated":"2026-04-16T14:06:37.842Z","title":"WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Plisio","product":"Accept Cryptocurrencies with Plisio","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-6370","published":"2026-04-15T16:02:14.957Z","updated":"2026-04-16T14:09:47.438Z","title":"WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"HashThemes","product":"Mini Ajax Cart for WooCommerce","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-15636","published":"2026-04-15T15:55:51.930Z","updated":"2026-04-28T16:10:57.676Z","title":"WordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"emarket-design","product":"YouTube Showcase","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-15635","published":"2026-04-15T15:49:53.280Z","updated":"2026-04-28T16:10:57.603Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2025-53444","published":"2026-04-15T15:43:21.294Z","updated":"2026-04-28T16:13:24.932Z","title":"WordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DeluxeThemes","product":"Userpro","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-40786","published":"2026-04-15T10:21:36.068Z","updated":"2026-04-29T09:52:04.932Z","title":"WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Long Watch Studio","product":"MyRewards","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-40784","published":"2026-04-15T10:21:35.828Z","updated":"2026-04-29T09:52:04.970Z","title":"WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":8.1,"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-40778","published":"2026-04-15T10:21:35.665Z","updated":"2026-04-29T09:52:04.975Z","title":"WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-40764","published":"2026-04-15T10:21:35.430Z","updated":"2026-04-29T09:52:04.844Z","title":"WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"Syed Balkhi","product":"Contact Form by WPForms","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-40763","published":"2026-04-15T10:21:35.155Z","updated":"2026-04-29T09:52:04.809Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Royal","product":"Royal Elementor Addons","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-40745","published":"2026-04-15T10:21:34.904Z","updated":"2026-04-29T09:52:04.829Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"bdthemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-40744","published":"2026-04-15T10:21:34.729Z","updated":"2026-04-29T09:52:04.890Z","title":"WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Beaver Builder","product":"Beaver Builder","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-40742","published":"2026-04-15T10:21:34.560Z","updated":"2026-04-29T09:52:04.863Z","title":"WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nelio Software","product":"Nelio AB Testing","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-40740","published":"2026-04-15T10:21:34.311Z","updated":"2026-04-29T09:52:04.818Z","title":"WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-40737","published":"2026-04-15T10:21:34.150Z","updated":"2026-04-29T09:52:04.845Z","title":"WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"COMPE","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-40734","published":"2026-04-15T10:21:33.995Z","updated":"2026-04-29T09:52:04.754Z","title":"WordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Zahlan","product":"Categories Images","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-40730","published":"2026-04-15T10:21:33.831Z","updated":"2026-04-29T09:52:04.755Z","title":"WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"ThemeGrill Demo Importer","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-40729","published":"2026-04-15T10:21:33.661Z","updated":"2026-04-29T09:52:04.755Z","title":"WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"3D viewer – Embed 3D Models","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-40728","published":"2026-04-15T10:21:33.433Z","updated":"2026-04-29T09:52:04.761Z","title":"WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BlockArt","product":"Magazine Blocks","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-58920","published":"2026-04-10T13:25:31.611Z","updated":"2026-04-28T16:13:49.426Z","title":"WordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Zootemplate","product":"Cerato","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-58913","published":"2026-04-10T13:21:05.820Z","updated":"2026-04-28T16:13:49.305Z","title":"WordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CactusThemes","product":"VideoPro","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-5804","published":"2026-04-10T13:19:43.457Z","updated":"2026-04-28T16:13:41.220Z","title":"WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Case Themes","product":"Case Theme User","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-39716","published":"2026-04-08T08:30:49.850Z","updated":"2026-04-29T09:52:04.342Z","title":"WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CKThemes","product":"Flipmart","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-39715","published":"2026-04-08T08:30:49.638Z","updated":"2026-04-29T09:52:04.466Z","title":"WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AnyTrack","product":"AnyTrack Affiliate Link Manager","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-39714","published":"2026-04-08T08:30:49.299Z","updated":"2026-04-29T09:52:04.877Z","title":"WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"G5Theme","product":"G5Plus April","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-39713","published":"2026-04-08T08:30:49.120Z","updated":"2026-04-29T09:52:04.440Z","title":"WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mailercloud","product":"Mailercloud – Integrate webforms and synchronize website contacts","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-39712","published":"2026-04-08T08:30:48.938Z","updated":"2026-04-29T09:52:04.354Z","title":"WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-39711","published":"2026-04-08T08:30:48.755Z","updated":"2026-04-29T09:52:04.616Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-39710","published":"2026-04-08T08:30:48.574Z","updated":"2026-04-29T09:52:04.494Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-39709","published":"2026-04-08T08:30:48.380Z","updated":"2026-04-29T09:52:04.518Z","title":"WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"thetechtribe","product":"The Tribal","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-39708","published":"2026-04-08T08:30:48.106Z","updated":"2026-09-25T10:04:01.121Z","title":"WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UiCore","product":"UiCore Elements","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-39707","published":"2026-04-08T08:30:47.904Z","updated":"2026-04-29T09:52:04.465Z","title":"WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ZealousWeb","product":"Accept PayPal Payments using Contact Form 7","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-39706","published":"2026-04-08T08:30:47.730Z","updated":"2026-04-29T09:52:04.441Z","title":"WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Netro Systems","product":"Make My Trivia","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-39705","published":"2026-04-08T08:30:47.550Z","updated":"2026-04-29T09:52:04.408Z","title":"WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mulika Team","product":"MIPL WC Multisite Sync","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-39704","published":"2026-04-08T08:30:47.383Z","updated":"2026-04-29T09:52:04.568Z","title":"WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"nfusionsolutions","product":"Precious Metals Automated Product Pricing – Pro","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-39703","published":"2026-04-08T08:30:47.201Z","updated":"2026-04-29T09:52:04.308Z","title":"WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpbits","product":"WPBITS Addons For Elementor Page Builder","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-39702","published":"2026-04-08T08:30:47.029Z","updated":"2026-04-29T09:52:04.439Z","title":"WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wealcoder","product":"Animation Addons for Elementor","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-39701","published":"2026-04-08T08:30:46.861Z","updated":"2026-04-29T09:52:04.602Z","title":"WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Andrew","product":"ShopWP","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-39700","published":"2026-04-08T08:30:46.685Z","updated":"2026-04-29T09:52:04.440Z","title":"WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPXPO","product":"WowOptin","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39699","published":"2026-04-08T08:30:46.515Z","updated":"2026-04-29T09:52:04.567Z","title":"WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"massiveshift","product":"AI Workflow Automation","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-39698","published":"2026-04-08T08:30:46.345Z","updated":"2026-04-29T09:52:04.174Z","title":"WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PublisherDesk","product":"The Publisher Desk ads.txt","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39697","published":"2026-04-08T08:30:46.167Z","updated":"2026-04-29T09:52:04.143Z","title":"WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"HBSS Technologies","product":"MAIO – The new AI GEO / SEO tool","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-39696","published":"2026-04-08T08:30:45.974Z","updated":"2026-04-29T09:52:04.969Z","title":"WordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elfsight","product":"Elfsight WhatsApp Chat CC","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-39695","published":"2026-04-08T08:30:45.786Z","updated":"2026-04-29T09:52:04.201Z","title":"WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"podigee","product":"Podigee","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-39694","published":"2026-04-08T08:30:45.602Z","updated":"2026-04-29T09:52:04.096Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39693","published":"2026-04-08T08:30:45.404Z","updated":"2026-04-29T09:52:03.961Z","title":"WordPress FSM Custom Featured Image Caption plugin <= 1.25.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"fesomia","product":"FSM Custom Featured Image Caption","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-39692","published":"2026-04-08T08:30:44.987Z","updated":"2026-04-29T09:52:03.946Z","title":"WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-39691","published":"2026-04-08T08:30:44.797Z","updated":"2026-04-29T09:52:03.971Z","title":"WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AdAstraCrypto","product":"Cryptocurrency Donation Box – Bitcoin & Crypto Donations","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39690","published":"2026-04-08T08:30:44.607Z","updated":"2026-04-29T09:52:04.011Z","title":"WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Paul Bearne","product":"Author Avatars List/Block","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39689","published":"2026-04-08T08:30:44.317Z","updated":"2026-04-29T09:52:04.378Z","title":"WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eshipper","product":"eShipper Commerce","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-39688","published":"2026-04-08T08:30:44.046Z","updated":"2026-04-29T09:52:04.014Z","title":"WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Glowlogix","product":"WP Frontend Profile","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-39687","published":"2026-04-08T08:30:43.760Z","updated":"2026-04-29T09:52:04.000Z","title":"WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Rapid Car Check","product":"Rapid Car Check Vehicle Data","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39686","published":"2026-04-08T08:30:43.188Z","updated":"2026-04-29T09:52:03.978Z","title":"WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bannersky","product":"BSK PDF Manager","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-39685","published":"2026-04-08T08:30:42.864Z","updated":"2026-04-29T09:52:03.982Z","title":"WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"lvaudore","product":"The Moneytizer","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-39684","published":"2026-04-08T08:30:42.529Z","updated":"2026-04-29T09:52:03.980Z","title":"WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"UnTheme","product":"OrganicFood","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39683","published":"2026-04-08T08:30:42.120Z","updated":"2026-04-29T09:52:03.979Z","title":"WordPress Garden Gnome Package plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Chief Gnome","product":"Garden Gnome Package","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39682","published":"2026-04-08T08:30:41.356Z","updated":"2026-04-29T09:52:04.040Z","title":"WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arjan Pronk","product":"linkPizza-Manager","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39681","published":"2026-04-08T08:30:41.127Z","updated":"2026-04-29T09:52:03.967Z","title":"WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ApusTheme","product":"Homeo","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39680","published":"2026-04-08T08:30:40.929Z","updated":"2026-04-29T09:52:03.941Z","title":"WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"MWP Development","product":"Diet Calorie Calculator","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39679","published":"2026-04-08T08:30:40.735Z","updated":"2026-04-29T09:52:03.902Z","title":"WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ApusTheme","product":"Freeio","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39678","published":"2026-04-08T08:30:40.559Z","updated":"2026-10-08T18:48:33.614Z","title":"WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pinpoint Booking System","product":"Pinpoint Booking System","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39677","published":"2026-04-08T08:30:40.378Z","updated":"2026-04-29T09:52:03.973Z","title":"WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Creatives_Planet","product":"Emphires","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39676","published":"2026-04-08T08:30:40.171Z","updated":"2026-04-29T09:52:03.997Z","title":"WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39675","published":"2026-04-08T08:30:39.993Z","updated":"2026-04-29T09:52:03.910Z","title":"WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"webmuehle","product":"Court Reservation","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-39674","published":"2026-04-08T08:30:39.819Z","updated":"2026-04-29T09:52:04.007Z","title":"WordPress MK Google Directions plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Manoj Kumar","product":"MK Google Directions","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39673","published":"2026-04-08T08:30:39.650Z","updated":"2026-04-29T09:52:03.914Z","title":"WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"shrikantkale","product":"iZooto","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-39672","published":"2026-04-08T08:30:39.300Z","updated":"2026-04-29T09:52:04.052Z","title":"WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"shiptime","product":"ShipTime: Discounted Shipping Rates","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-39671","published":"2026-04-08T08:30:39.107Z","updated":"2026-04-29T09:52:03.764Z","title":"WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dotstore","product":"Extra Fees Plugin for WooCommerce","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-39670","published":"2026-04-08T08:30:38.929Z","updated":"2026-04-29T09:52:03.910Z","title":"WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6,"vendor":"Brecht","product":"Visual Link Preview","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-39669","published":"2026-04-08T08:30:38.737Z","updated":"2026-04-28T17:23:59.096Z","title":"WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NitroPack","product":"NitroPack","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39668","published":"2026-04-08T08:30:38.560Z","updated":"2026-04-29T09:52:03.848Z","title":"WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"g5theme","product":"Book Previewer for Woocommerce","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39667","published":"2026-04-08T08:30:38.379Z","updated":"2026-04-29T09:52:03.888Z","title":"WordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jongmyoung Kim","product":"Korea SNS","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39666","published":"2026-04-08T08:30:38.138Z","updated":"2026-04-29T09:52:03.875Z","title":"WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"telepathy","product":"Hello Bar Popup Builder","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39665","published":"2026-04-08T08:30:37.934Z","updated":"2026-04-29T09:52:03.811Z","title":"WordPress SEO Friendly Images plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vladimir Prelovac","product":"SEO Friendly Images","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39664","published":"2026-04-08T08:30:37.757Z","updated":"2026-04-29T09:52:03.923Z","title":"WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"leadrebel","product":"Leadrebel","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-39663","published":"2026-04-08T08:30:37.575Z","updated":"2026-04-29T09:52:04.116Z","title":"WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39662","published":"2026-04-08T08:30:37.354Z","updated":"2026-04-29T09:52:04.047Z","title":"WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ProWCPlugins","product":"Product Price by Formula for WooCommerce","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39658","published":"2026-04-08T08:30:36.675Z","updated":"2026-04-29T09:52:03.991Z","title":"WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Coding Panda","product":"Panda Pods Repeater Field","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-39657","published":"2026-04-08T08:30:36.400Z","updated":"2026-04-29T09:52:03.868Z","title":"WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"leadlovers","product":"leadlovers forms","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39656","published":"2026-04-08T08:30:36.077Z","updated":"2026-04-29T09:52:03.954Z","title":"WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Razorpay","product":"Razorpay for WooCommerce","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39654","published":"2026-04-08T08:30:35.896Z","updated":"2026-05-13T00:33:44.593Z","title":"WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ashish Ajani","product":"WP Simple HTML Sitemap","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39653","published":"2026-04-08T08:30:35.685Z","updated":"2026-04-29T09:52:03.822Z","title":"WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-39652","published":"2026-04-08T08:30:35.490Z","updated":"2026-04-29T09:52:03.871Z","title":"WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"igms","product":"iGMS Direct Booking","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39651","published":"2026-04-08T08:30:35.156Z","updated":"2026-04-29T09:52:03.735Z","title":"WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TotalSuite","product":"Total Poll Lite","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-39650","published":"2026-04-08T08:30:34.227Z","updated":"2026-04-29T09:52:03.827Z","title":"WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Unitech Web","product":"UnitechPay","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-39649","published":"2026-04-08T08:30:34.012Z","updated":"2026-04-29T09:52:03.911Z","title":"WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Royale News","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39648","published":"2026-04-08T08:30:33.766Z","updated":"2026-04-29T09:52:03.259Z","title":"WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Cream Blog","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39647","published":"2026-04-08T08:30:33.159Z","updated":"2026-04-29T09:52:03.948Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-39646","published":"2026-04-08T08:30:32.949Z","updated":"2026-04-29T09:52:03.489Z","title":"WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bozdoz","product":"Leaflet Map","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39645","published":"2026-04-08T08:30:32.779Z","updated":"2026-04-29T09:52:03.130Z","title":"WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Global Payments","product":"GlobalPayments WooCommerce","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-39644","published":"2026-04-08T08:30:32.605Z","updated":"2026-04-29T09:52:03.739Z","title":"WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Roxnor","product":"Wp Ultimate Review","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39643","published":"2026-04-08T08:30:32.373Z","updated":"2026-04-29T09:52:03.018Z","title":"WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Payment Plugins","product":"Payment Plugins for PayPal WooCommerce","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39641","published":"2026-04-08T08:30:32.097Z","updated":"2026-04-29T09:52:02.939Z","title":"WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Skywarrior","product":"Blackfyre","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-39640","published":"2026-04-08T08:30:31.919Z","updated":"2026-04-29T09:52:02.985Z","title":"WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability","severity":"CRITICAL","score":9.6,"vendor":"mndpsingh287","product":"Theme Editor","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39639","published":"2026-04-08T08:30:31.738Z","updated":"2026-04-29T09:52:02.943Z","title":"WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"redpixelstudios","product":"RPS Include Content","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-39638","published":"2026-04-08T08:30:31.510Z","updated":"2026-04-29T09:52:03.258Z","title":"WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themeum","product":"Qubely","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39637","published":"2026-04-08T08:30:30.861Z","updated":"2026-04-29T09:52:02.931Z","title":"WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SpabRice","product":"Mogi","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39636","published":"2026-04-08T08:30:30.492Z","updated":"2026-04-29T09:52:02.896Z","title":"WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"livemesh","product":"Livemesh Addons for Elementor","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39635","published":"2026-04-08T08:30:29.823Z","updated":"2026-04-29T09:52:03.013Z","title":"WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Magazine","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-39634","published":"2026-04-08T08:30:29.207Z","updated":"2026-04-29T09:52:03.042Z","title":"WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Portfolio","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-39633","published":"2026-04-08T08:30:29.018Z","updated":"2026-04-29T09:52:02.870Z","title":"WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGoods","product":"Grand Car Rental","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-39632","published":"2026-04-08T08:30:28.792Z","updated":"2026-04-29T09:52:03.040Z","title":"WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGoods","product":"Grand Blog","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-39631","published":"2026-04-08T08:30:28.625Z","updated":"2026-04-29T09:52:02.884Z","title":"WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Ronik@UnlimitedWP","product":"WPSchoolPress","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-39630","published":"2026-04-08T08:30:28.416Z","updated":"2026-04-29T09:52:02.938Z","title":"WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Getty Images","product":"Getty Images","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-39629","published":"2026-04-08T08:30:28.135Z","updated":"2026-04-29T09:52:02.915Z","title":"WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"Uminex","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-39628","published":"2026-04-08T08:30:27.843Z","updated":"2026-04-29T09:52:02.936Z","title":"WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"DukaMarket","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-39627","published":"2026-04-08T08:30:27.618Z","updated":"2026-04-29T09:52:02.867Z","title":"WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wproyal","product":"Ashe","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-39626","published":"2026-04-08T08:30:27.418Z","updated":"2026-04-29T09:52:02.725Z","title":"WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-39625","published":"2026-04-08T08:30:27.220Z","updated":"2026-04-29T09:52:02.768Z","title":"WordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-39624","published":"2026-04-08T08:30:27.029Z","updated":"2026-04-29T09:52:02.713Z","title":"WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39623","published":"2026-04-08T08:30:26.741Z","updated":"2026-04-29T09:52:02.641Z","title":"WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39622","published":"2026-04-08T08:30:26.564Z","updated":"2026-04-29T09:52:02.641Z","title":"WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"acmethemes","product":"Education Base","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39621","published":"2026-04-08T08:30:26.321Z","updated":"2026-04-29T09:52:02.618Z","title":"WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability","severity":"HIGH","score":8.8,"vendor":"spicethemes","product":"SpicePress","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39620","published":"2026-04-08T08:30:26.089Z","updated":"2026-04-29T09:52:02.575Z","title":"WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.6,"vendor":"priyanshumittal","product":"Appointment","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39619","published":"2026-04-08T08:30:25.868Z","updated":"2026-04-29T09:52:02.646Z","title":"WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.6,"vendor":"priyanshumittal","product":"Busiprof","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39618","published":"2026-04-08T08:30:25.559Z","updated":"2026-04-29T09:52:02.607Z","title":"WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themearile","product":"NewsExo","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-39617","published":"2026-04-08T08:30:25.380Z","updated":"2026-04-29T09:52:02.644Z","title":"WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability","severity":"CRITICAL","score":9.6,"vendor":"priyanshumittal","product":"Bluestreet","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-39616","published":"2026-04-08T08:30:25.169Z","updated":"2026-04-29T09:52:02.578Z","title":"WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"dFactory","product":"Download Attachments","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-39615","published":"2026-04-08T08:30:24.822Z","updated":"2026-04-29T09:52:02.577Z","title":"WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39614","published":"2026-04-08T08:30:24.340Z","updated":"2026-04-29T09:52:02.597Z","title":"WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ilGhera","product":"JW Player for WordPress","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-39613","published":"2026-04-08T08:30:24.110Z","updated":"2026-04-29T09:52:02.672Z","title":"WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39612","published":"2026-04-08T08:30:23.931Z","updated":"2026-04-29T09:52:02.606Z","title":"WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39611","published":"2026-04-08T08:30:23.760Z","updated":"2026-04-29T09:52:02.574Z","title":"WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39610","published":"2026-04-08T08:30:23.579Z","updated":"2026-04-29T09:52:02.574Z","title":"WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pankaj Kumar","product":"WpXmas-Snow","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39609","published":"2026-04-08T08:30:23.375Z","updated":"2026-04-29T09:52:02.553Z","title":"WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wava.co","product":"Wava Payment","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39608","published":"2026-04-08T08:30:23.084Z","updated":"2026-04-29T09:52:02.513Z","title":"WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iPOSPays","product":"iPOSpays Gateways WC","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39607","published":"2026-04-08T08:30:22.832Z","updated":"2026-04-29T09:52:02.334Z","title":"WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wpbens","product":"Filter Plus","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-39606","published":"2026-04-08T08:30:22.616Z","updated":"2026-04-29T09:52:02.426Z","title":"WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Foysal Imran","product":"BizReview","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39605","published":"2026-04-08T08:30:22.401Z","updated":"2026-04-29T09:52:02.309Z","title":"WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Obadiah","product":"Super Custom Login","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39604","published":"2026-04-08T08:30:22.200Z","updated":"2026-04-29T09:52:02.316Z","title":"WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"zookatron","product":"MyBookTable Bookstore","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39603","published":"2026-04-08T08:30:22.019Z","updated":"2026-04-29T09:52:02.301Z","title":"WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Photography","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-39602","published":"2026-04-08T08:30:21.845Z","updated":"2026-04-29T09:52:02.238Z","title":"WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Rustaurius","product":"Order Tracking","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39592","published":"2026-04-08T08:30:21.650Z","updated":"2026-04-29T09:52:02.344Z","title":"WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Andy Ha","product":"DEPART","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-39588","published":"2026-04-08T08:30:21.468Z","updated":"2026-04-29T09:52:02.195Z","title":"WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"nmerii","product":"NM Gift Registry and Wishlist Lite","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39586","published":"2026-04-08T08:30:21.237Z","updated":"2026-04-29T09:52:02.494Z","title":"WordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ateeq Rafeeq","product":"RepairBuddy","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39585","published":"2026-04-08T08:30:21.023Z","updated":"2026-05-12T07:50:49.191Z","title":"WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39575","published":"2026-04-08T08:30:20.812Z","updated":"2026-04-29T09:52:02.179Z","title":"WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ronald Huereca","product":"Custom Query Blocks","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39572","published":"2026-04-08T08:30:20.629Z","updated":"2026-04-29T09:52:02.255Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"magepeopleteam","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-39571","published":"2026-04-08T08:30:20.418Z","updated":"2026-04-29T09:52:02.139Z","title":"WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themefic","product":"Instantio","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39570","published":"2026-04-08T08:30:20.143Z","updated":"2026-04-29T09:52:02.117Z","title":"WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AA Web Servant","product":"12 Step Meeting List","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39569","published":"2026-04-08T08:30:19.885Z","updated":"2026-04-29T09:52:02.105Z","title":"WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AA Web Servant","product":"12 Step Meeting List","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-39566","published":"2026-04-08T08:30:19.228Z","updated":"2026-04-29T09:52:02.142Z","title":"WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-39565","published":"2026-04-08T08:30:19.049Z","updated":"2026-04-29T09:52:02.130Z","title":"WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"magepeopleteam","product":"WpTravelly","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-39564","published":"2026-04-08T08:30:18.874Z","updated":"2026-04-29T09:52:02.141Z","title":"WordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39563","published":"2026-04-08T08:30:18.659Z","updated":"2026-04-29T09:52:02.266Z","title":"WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ILLID","product":"Share This Image","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39562","published":"2026-04-08T08:30:18.463Z","updated":"2026-04-29T09:52:02.114Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39561","published":"2026-04-08T08:30:18.238Z","updated":"2026-04-29T09:52:02.099Z","title":"WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Revive.so","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39544","published":"2026-04-08T08:30:17.993Z","updated":"2026-04-29T09:52:02.136Z","title":"WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"themeStek","product":"LabtechCO","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39543","published":"2026-04-08T08:30:17.808Z","updated":"2026-04-29T09:52:02.060Z","title":"WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themefic","product":"Tourfic","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-39542","published":"2026-04-08T08:30:17.588Z","updated":"2026-04-29T09:52:02.103Z","title":"WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Doofinder","product":"Doofinder for WooCommerce","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39541","published":"2026-04-08T08:30:17.312Z","updated":"2026-04-29T09:52:02.050Z","title":"WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-39538","published":"2026-04-08T08:30:17.109Z","updated":"2026-04-29T09:52:02.066Z","title":"WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Mikado-Themes","product":"Mikado Core","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-39536","published":"2026-04-08T08:30:16.908Z","updated":"2026-04-29T09:52:02.098Z","title":"WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"RSVP and Event Management","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39535","published":"2026-04-08T08:30:16.732Z","updated":"2026-04-29T09:52:02.221Z","title":"WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"fullworks","product":"Display Eventbrite Events","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39528","published":"2026-04-08T08:30:16.548Z","updated":"2026-04-29T09:52:02.208Z","title":"WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Delicious","product":"WP Delicious","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39526","published":"2026-04-08T08:30:16.335Z","updated":"2026-04-29T09:52:01.932Z","title":"WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpstream","product":"WpStream","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-39521","published":"2026-04-08T08:30:16.011Z","updated":"2026-04-29T09:52:02.065Z","title":"WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Nelio Software","product":"Nelio Content","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-39520","published":"2026-04-08T08:30:15.736Z","updated":"2026-04-29T09:52:01.951Z","title":"WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weDocs","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-39517","published":"2026-04-08T08:30:15.367Z","updated":"2026-04-29T09:52:01.930Z","title":"WordPress Blog Filter plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"A WP Life","product":"Blog Filter","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39516","published":"2026-04-08T08:30:14.904Z","updated":"2026-04-29T09:52:01.912Z","title":"WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"POSIMYTH","product":"Nexter Blocks","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39510","published":"2026-04-08T08:30:14.471Z","updated":"2026-04-29T09:52:01.890Z","title":"WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"LOW","score":2.7,"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-39509","published":"2026-04-08T08:30:14.240Z","updated":"2026-04-29T09:52:02.099Z","title":"WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39508","published":"2026-04-08T08:30:14.055Z","updated":"2026-04-29T09:52:01.963Z","title":"WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Josh Kohlbach","product":"Advanced Coupons for WooCommerce Coupons","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39506","published":"2026-04-08T08:30:13.840Z","updated":"2026-04-29T09:52:01.954Z","title":"WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jordy Meow","product":"AI Engine (Pro)","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-39505","published":"2026-04-08T08:30:13.629Z","updated":"2026-04-29T09:52:01.953Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-39504","published":"2026-04-08T08:30:13.405Z","updated":"2026-04-29T09:52:01.914Z","title":"WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-39501","published":"2026-04-08T08:30:13.172Z","updated":"2026-04-29T09:52:01.916Z","title":"WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RealMag777","product":"FOX","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-39500","published":"2026-04-08T08:30:12.864Z","updated":"2026-04-29T09:52:01.969Z","title":"WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themesflat","product":"themesflat-addons-for-elementor","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39497","published":"2026-04-08T08:30:12.597Z","updated":"2026-04-29T09:52:01.939Z","title":"WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"RealMag777","product":"FOX","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-39496","published":"2026-04-08T08:30:12.339Z","updated":"2026-04-29T09:52:01.932Z","title":"WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YayMail","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-39495","published":"2026-04-08T08:30:12.091Z","updated":"2026-04-29T09:52:01.948Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-39488","published":"2026-04-08T08:30:11.861Z","updated":"2026-04-29T09:52:01.930Z","title":"WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-39487","published":"2026-04-08T08:30:11.682Z","updated":"2026-04-29T09:52:01.937Z","title":"WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"ameliabooking","product":"Amelia","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-39486","published":"2026-04-08T08:30:11.488Z","updated":"2026-04-29T09:52:01.879Z","title":"WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-39485","published":"2026-04-08T08:30:11.011Z","updated":"2026-04-29T09:52:01.953Z","title":"WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"embedplus","product":"Youtube Embed Plus","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-39484","published":"2026-04-08T08:30:10.796Z","updated":"2026-04-29T09:52:01.908Z","title":"WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"John Darrel","product":"Hide My WP Ghost","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-39483","published":"2026-04-08T08:30:10.547Z","updated":"2026-04-29T09:52:01.879Z","title":"WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hidekazu Ishikawa","product":"VK All in One Expansion Unit","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-39482","published":"2026-04-08T08:30:10.093Z","updated":"2026-04-29T09:52:01.909Z","title":"WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"Post Expirator","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-39479","published":"2026-04-08T08:30:09.840Z","updated":"2026-04-29T09:52:01.958Z","title":"WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-39477","published":"2026-04-08T08:30:09.658Z","updated":"2026-04-29T09:52:01.937Z","title":"WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-39476","published":"2026-04-08T08:30:09.401Z","updated":"2026-04-29T09:52:01.915Z","title":"WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"User Feedback","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-39475","published":"2026-04-08T08:30:09.133Z","updated":"2026-04-29T09:52:01.836Z","title":"WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Syed Balkhi","product":"User Feedback","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-39473","published":"2026-04-08T08:30:08.855Z","updated":"2026-04-29T09:52:01.820Z","title":"WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pär Thernström","product":"Simple History","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-39469","published":"2026-04-08T08:30:07.826Z","updated":"2026-04-29T09:52:01.692Z","title":"WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Softaculous","product":"PageLayer","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-39466","published":"2026-04-08T08:30:07.229Z","updated":"2026-04-29T09:52:01.751Z","title":"WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Broken Link Checker","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-39464","published":"2026-04-08T08:30:06.040Z","updated":"2026-04-29T09:52:01.723Z","title":"WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"SeedProd","product":"Coming Soon Page, Under Construction & Maintenance Mode by SeedProd","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-34903","published":"2026-04-07T08:57:51.189Z","updated":"2026-04-07T12:59:24.495Z","title":"WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"OceanWP","product":"Ocean Extra","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-34899","published":"2026-04-07T08:31:37.373Z","updated":"2026-04-07T13:11:05.535Z","title":"WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Eniture technology","product":"LTL Freight Quotes – Worldwide Express Edition","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-34904","published":"2026-04-07T08:22:26.209Z","updated":"2026-04-07T13:35:08.146Z","title":"WordPress Simple Social Media Share Buttons plugin <= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.5,"vendor":"Analytify","product":"Simple Social Media Share Buttons","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-34896","published":"2026-04-07T08:20:42.775Z","updated":"2026-04-07T13:37:48.429Z","title":"WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.5,"vendor":"Analytify","product":"Under Construction, Coming Soon & Maintenance Mode","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-34897","published":"2026-04-06T14:50:48.088Z","updated":"2026-04-06T16:53:41.468Z","title":"WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-34885","published":"2026-04-06T14:47:31.754Z","updated":"2026-04-06T15:24:38.062Z","title":"WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.01668,"kevAdded":null},{"id":"CVE-2026-34890","published":"2026-04-02T12:58:01.605Z","updated":"2026-04-02T13:16:23.200Z","title":"WordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mark O’Donnell","product":"MSTW League Manager","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-34889","published":"2026-04-01T08:51:32.192Z","updated":"2026-04-01T13:29:40.506Z","title":"WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Ultimate Addons for WPBakery Page Builder","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-34887","published":"2026-03-31T10:19:46.282Z","updated":"2026-03-31T12:32:04.044Z","title":"WordPress Kubio AI Page Builder plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Extend Themes","product":"Kubio AI Page Builder","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-32573","published":"2026-03-25T16:15:12.700Z","updated":"2026-04-29T09:52:01.711Z","title":"WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Nelio Software","product":"Nelio AB Testing","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-32567","published":"2026-03-25T16:15:12.478Z","updated":"2026-04-29T09:52:01.485Z","title":"WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"icopydoc","product":"YML for Yandex Market","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-32562","published":"2026-03-25T16:15:12.284Z","updated":"2026-04-29T09:52:01.624Z","title":"WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Folio Team","product":"PPWP","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-32546","published":"2026-03-25T16:15:12.093Z","updated":"2026-04-29T09:52:01.587Z","title":"WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StellarWP","product":"Restrict Content","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-32545","published":"2026-03-25T16:15:11.926Z","updated":"2026-04-29T09:52:01.599Z","title":"WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Taboola","product":"Taboola Pixel","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32544","published":"2026-03-25T16:15:11.772Z","updated":"2026-04-29T09:52:01.545Z","title":"WordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OOPSpam Team","product":"OOPSpam Anti-Spam","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-32542","published":"2026-03-25T16:15:11.603Z","updated":"2026-04-29T09:52:01.638Z","title":"WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32541","published":"2026-03-25T16:15:11.437Z","updated":"2026-04-29T09:52:01.501Z","title":"WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Premmerce","product":"Premmerce Redirect Manager","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-32540","published":"2026-03-25T16:15:11.278Z","updated":"2026-04-29T09:52:01.368Z","title":"WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32539","published":"2026-03-25T16:15:11.088Z","updated":"2026-04-29T09:52:01.265Z","title":"WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-32538","published":"2026-03-25T16:15:10.925Z","updated":"2026-04-29T09:52:01.563Z","title":"WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Noor Alam","product":"SMTP Mailer","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-32537","published":"2026-03-25T16:15:10.746Z","updated":"2026-04-29T09:52:01.243Z","title":"WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"nK","product":"Visual Portfolio, Photo Gallery & Post Grid","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-32536","published":"2026-03-25T16:15:10.543Z","updated":"2026-04-29T09:52:01.372Z","title":"WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"halfdata","product":"Green Downloads","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-32535","published":"2026-03-25T16:15:10.312Z","updated":"2026-04-29T09:52:01.258Z","title":"WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-32534","published":"2026-03-25T16:15:10.074Z","updated":"2026-04-29T09:52:01.574Z","title":"WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-32533","published":"2026-03-25T16:15:09.898Z","updated":"2026-04-29T09:52:01.260Z","title":"WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LatePoint","product":"LatePoint","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-32532","published":"2026-03-25T16:15:09.742Z","updated":"2026-04-29T09:52:01.149Z","title":"WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Contact Form & Lead Form Elementor Builder","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-32531","published":"2026-03-25T16:15:09.570Z","updated":"2026-04-29T09:52:01.234Z","title":"WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Kunco","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-32530","published":"2026-03-25T16:15:09.310Z","updated":"2026-04-29T09:52:01.161Z","title":"WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-32529","published":"2026-03-25T16:15:09.111Z","updated":"2026-04-29T09:52:00.980Z","title":"WordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"don-themes","product":"Molla","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32528","published":"2026-03-25T16:15:08.931Z","updated":"2026-04-29T09:52:01.231Z","title":"WordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"don-themes","product":"Riode","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-32527","published":"2026-03-25T16:15:08.775Z","updated":"2026-04-29T09:52:01.216Z","title":"WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CRM Perks","product":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32526","published":"2026-03-25T16:15:08.581Z","updated":"2026-04-29T09:52:01.125Z","title":"WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"Abandoned Cart Recovery for WooCommerce","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-32525","published":"2026-03-25T16:15:08.389Z","updated":"2026-04-29T09:52:01.154Z","title":"WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-32524","published":"2026-03-25T16:15:08.023Z","updated":"2026-04-29T09:52:00.984Z","title":"WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Jordy Meow","product":"Photo Engine","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-32523","published":"2026-03-25T16:15:07.729Z","updated":"2026-04-29T09:52:01.251Z","title":"WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-32522","published":"2026-03-25T16:15:07.516Z","updated":"2026-04-29T09:52:01.063Z","title":"WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"vanquish","product":"WooCommerce Support Ticket System","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-32521","published":"2026-03-25T16:15:07.348Z","updated":"2026-04-29T09:52:00.979Z","title":"WordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Northern Beaches Websites","product":"WP Custom Admin Interface","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-32520","published":"2026-03-25T16:15:07.137Z","updated":"2026-04-29T09:52:00.921Z","title":"WordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Andrew Munro / AffiliateWP","product":"RewardsWP","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-32519","published":"2026-03-25T16:15:06.931Z","updated":"2026-04-29T09:52:00.955Z","title":"WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9,"vendor":"Bit Apps","product":"Bit SMTP","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-32518","published":"2026-03-25T16:15:06.764Z","updated":"2026-04-29T09:52:01.190Z","title":"WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"imithemes","product":"Gaea","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-32517","published":"2026-03-25T16:15:06.566Z","updated":"2026-04-29T09:52:01.015Z","title":"WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kleor","product":"Contact Manager","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-32516","published":"2026-03-25T16:15:06.373Z","updated":"2026-04-29T09:52:00.909Z","title":"WordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"kamleshyadav","product":"Miraculous Core Plugin","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-32515","published":"2026-03-25T16:15:06.206Z","updated":"2026-04-29T09:52:01.009Z","title":"WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"kamleshyadav","product":"Miraculous","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-32514","published":"2026-03-25T16:15:06.016Z","updated":"2026-04-29T09:52:00.963Z","title":"WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Anton Voytenko","product":"Petitioner","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-32513","published":"2026-03-25T16:15:05.821Z","updated":"2026-04-29T09:52:01.027Z","title":"WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Miguel Useche","product":"JS Archive List","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-32512","published":"2026-03-25T16:15:05.596Z","updated":"2026-04-29T09:52:01.116Z","title":"WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Edge-Themes","product":"Pelicula","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-32511","published":"2026-03-25T16:15:05.301Z","updated":"2026-04-29T09:52:01.013Z","title":"WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Stål","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32510","published":"2026-03-25T16:15:04.782Z","updated":"2026-04-29T09:52:01.095Z","title":"WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Edge-Themes","product":"Kamperen","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32509","published":"2026-03-25T16:15:04.245Z","updated":"2026-04-29T09:52:00.833Z","title":"WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Edge-Themes","product":"Gracey","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-32508","published":"2026-03-25T16:15:04.028Z","updated":"2026-04-29T09:52:00.987Z","title":"WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Halstein","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32507","published":"2026-03-25T16:15:03.836Z","updated":"2026-04-29T09:52:01.003Z","title":"WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Elated-Themes","product":"Leroux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32506","published":"2026-03-25T16:15:03.602Z","updated":"2026-04-29T09:52:00.924Z","title":"WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Edge-Themes","product":"Archicon","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-32505","published":"2026-03-25T16:15:02.952Z","updated":"2026-04-29T09:52:00.886Z","title":"WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CreativeWS","product":"Kiddy","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-32504","published":"2026-03-25T16:15:01.383Z","updated":"2026-04-29T09:52:00.839Z","title":"WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CreativeWS","product":"VintWood","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-32503","published":"2026-03-25T16:15:01.160Z","updated":"2026-04-29T09:52:00.717Z","title":"WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CreativeWS","product":"Trendustry","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-32502","published":"2026-03-25T16:15:00.990Z","updated":"2026-04-29T09:52:00.844Z","title":"WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Select-Themes","product":"Borgholm","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-32501","published":"2026-03-25T16:15:00.819Z","updated":"2026-04-29T09:52:00.812Z","title":"WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"wp-configurator","product":"WP Configurator Pro","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-32500","published":"2026-03-25T16:15:00.649Z","updated":"2026-04-29T09:52:00.843Z","title":"WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CreativeWS","product":"MetaMax","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-32499","published":"2026-03-25T16:15:00.491Z","updated":"2026-04-29T09:52:00.317Z","title":"WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-32498","published":"2026-03-25T16:14:59.903Z","updated":"2026-04-29T09:52:00.404Z","title":"WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-32497","published":"2026-03-25T16:14:59.736Z","updated":"2026-04-29T09:52:00.796Z","title":"WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PickPlugins","product":"User Verification","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-32496","published":"2026-03-25T16:14:59.586Z","updated":"2026-04-29T09:52:00.715Z","title":"WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"NYSL","product":"Spam Protect for Contact Form 7","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-32495","published":"2026-03-25T16:14:59.408Z","updated":"2026-04-29T09:52:00.725Z","title":"WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Link Software LLC","product":"WP Terms Popup","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-32494","published":"2026-03-25T16:14:59.237Z","updated":"2026-04-29T09:52:00.741Z","title":"WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Image Slider by Ays","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-32493","published":"2026-03-25T16:14:59.078Z","updated":"2026-05-13T00:33:29.996Z","title":"WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-32492","published":"2026-03-25T16:14:58.909Z","updated":"2026-04-29T09:52:00.702Z","title":"WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Joe Dolson","product":"My Tickets","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-32491","published":"2026-03-25T16:14:58.745Z","updated":"2026-04-29T09:52:00.819Z","title":"WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jgwhite33","product":"WP Review Slider","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-32490","published":"2026-03-25T16:14:58.592Z","updated":"2026-04-29T09:52:00.855Z","title":"WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jgwhite33","product":"WP TripAdvisor Review Slider","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-32489","published":"2026-03-25T16:14:58.411Z","updated":"2026-04-29T09:52:00.331Z","title":"WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-32488","published":"2026-03-25T16:14:58.228Z","updated":"2026-04-29T09:52:00.524Z","title":"WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-32485","published":"2026-03-25T16:14:58.069Z","updated":"2026-04-29T09:52:00.195Z","title":"WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-32484","published":"2026-03-25T16:14:57.893Z","updated":"2026-04-29T09:52:00.080Z","title":"WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BoldGrid","product":"weForms","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-32483","published":"2026-03-25T16:14:57.726Z","updated":"2026-04-29T09:52:00.864Z","title":"WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Contact Form Email","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-32482","published":"2026-03-25T16:14:57.573Z","updated":"2026-04-29T09:52:00.102Z","title":"WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"deothemes","product":"Ona","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-32441","published":"2026-03-25T16:14:57.389Z","updated":"2026-04-29T09:51:59.449Z","title":"WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.7,"vendor":"WebToffee","product":"Comments Import & Export","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-31921","published":"2026-03-25T16:14:57.217Z","updated":"2026-04-29T09:51:57.417Z","title":"WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Devteam HaywoodTech","product":"Product Rearrange for WooCommerce","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-31920","published":"2026-03-25T16:14:57.049Z","updated":"2026-04-29T09:51:57.368Z","title":"WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Devteam HaywoodTech","product":"Product Rearrange for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-31914","published":"2026-03-25T16:14:56.894Z","updated":"2026-04-29T09:51:57.078Z","title":"WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hookandhook","product":"WP Courses LMS","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-31913","published":"2026-03-25T16:14:56.717Z","updated":"2026-04-29T09:51:57.206Z","title":"WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Whitebox-Studio","product":"Scape","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-27095","published":"2026-03-25T16:14:56.549Z","updated":"2026-04-28T16:15:01.667Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"magepeopleteam","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-27088","published":"2026-03-25T16:14:56.364Z","updated":"2026-04-28T16:15:01.676Z","title":"WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"G5Theme","product":"Darna Framework","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-27087","published":"2026-03-25T16:14:56.146Z","updated":"2026-04-28T16:15:01.676Z","title":"WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"G5Theme","product":"Wolverine Framework","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-27084","published":"2026-03-25T16:14:55.996Z","updated":"2026-04-28T16:15:01.370Z","title":"WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Buisson","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2026-27083","published":"2026-03-25T16:14:55.830Z","updated":"2026-04-28T16:15:01.375Z","title":"WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Work & Travel Company","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-27082","published":"2026-03-25T16:14:55.661Z","updated":"2026-04-28T16:15:01.576Z","title":"WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Love Story","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-27081","published":"2026-03-25T16:14:55.507Z","updated":"2026-04-28T16:15:01.334Z","title":"WordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Rosebud","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27080","published":"2026-03-25T16:14:55.336Z","updated":"2026-04-28T16:15:01.368Z","title":"WordPress Deston theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Deston","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-27079","published":"2026-03-25T16:14:55.169Z","updated":"2026-04-28T16:15:01.341Z","title":"WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Amfissa","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27078","published":"2026-03-25T16:14:55.015Z","updated":"2026-04-28T16:15:01.332Z","title":"WordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Emaurri","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-27077","published":"2026-03-25T16:14:54.843Z","updated":"2026-04-28T16:15:01.304Z","title":"WordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"MultiOffice","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27076","published":"2026-03-25T16:14:54.687Z","updated":"2026-04-28T16:15:01.246Z","title":"WordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"LuxeDrive","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-27075","published":"2026-03-25T16:14:54.455Z","updated":"2026-04-28T16:15:01.332Z","title":"WordPress Belfort theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Belfort","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27073","published":"2026-03-25T16:14:54.270Z","updated":"2026-04-28T16:15:01.171Z","title":"WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Addi","product":"Addi – Cuotas que se adaptan a ti","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-27071","published":"2026-03-25T16:14:54.113Z","updated":"2026-04-29T09:51:57.242Z","title":"WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Arraytics","product":"WPCafe","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-27054","published":"2026-03-25T16:14:53.945Z","updated":"2026-04-28T16:15:00.479Z","title":"WordPress Penci Soledad Data Migrator plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PenciDesign","product":"Penci Soledad Data Migrator","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-27051","published":"2026-03-25T16:14:53.781Z","updated":"2026-04-28T16:15:00.856Z","title":"WordPress Golo theme <= 1.7.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-27049","published":"2026-03-25T16:14:53.632Z","updated":"2026-04-28T16:14:59.937Z","title":"WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"NooTheme","product":"Jobica Core","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-27048","published":"2026-03-25T16:14:53.467Z","updated":"2026-04-28T16:14:59.959Z","title":"WordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"The Aisle Core","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27047","published":"2026-03-25T16:14:53.295Z","updated":"2026-04-28T16:14:59.783Z","title":"WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Curly Core","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-27046","published":"2026-03-25T16:14:53.119Z","updated":"2026-04-28T16:14:59.910Z","title":"WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaira","product":"StoreCustomizer","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-27045","published":"2026-03-25T16:14:52.853Z","updated":"2026-04-28T16:14:59.741Z","title":"WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"sbthemes","product":"WooCommerce Infinite Scroll","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-27044","published":"2026-03-25T16:14:52.650Z","updated":"2026-04-28T16:14:59.700Z","title":"WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"TotalSuite","product":"Total Poll Lite","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-27040","published":"2026-03-25T16:14:52.312Z","updated":"2026-04-28T16:14:59.712Z","title":"WordPress WZone plugin <= 14.0.31 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.8,"vendor":"AA-Team","product":"WZone","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2026-27039","published":"2026-03-25T16:14:52.135Z","updated":"2026-04-28T16:14:59.687Z","title":"WordPress WZone plugin <= 14.0.31 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AA-Team","product":"WZone","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-25469","published":"2026-03-25T16:14:51.967Z","updated":"2026-04-28T16:14:59.669Z","title":"WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ViaBill for WooCommerce","product":"ViaBill – WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-25465","published":"2026-03-25T16:14:51.810Z","updated":"2026-04-28T16:14:59.404Z","title":"WordPress CP Multi View Event Calendar  plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"CP Multi View Event Calendar","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-25464","published":"2026-03-25T16:14:51.623Z","updated":"2026-04-28T16:14:59.533Z","title":"WordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25462","published":"2026-03-25T16:14:51.394Z","updated":"2026-04-28T16:14:59.430Z","title":"WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"avalex","product":"avalex","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-25461","published":"2026-03-25T16:14:51.182Z","updated":"2026-04-28T16:14:59.337Z","title":"WordPress Listeo Core plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"purethemes","product":"Listeo Core","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25460","published":"2026-03-25T16:14:51.015Z","updated":"2026-04-28T16:14:59.520Z","title":"WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"LiquidThemes","product":"Ave Core","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-25458","published":"2026-03-25T16:14:50.862Z","updated":"2026-04-28T16:14:59.342Z","title":"WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Moments","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25457","published":"2026-03-25T16:14:50.698Z","updated":"2026-04-28T16:14:59.328Z","title":"WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Mixtape","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25456","published":"2026-03-25T16:14:50.530Z","updated":"2026-04-28T16:14:59.355Z","title":"WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Aarsiv Groups","product":"Automated FedEx live/manual rates with shipping labels","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-25455","published":"2026-03-25T16:14:50.367Z","updated":"2026-04-28T16:14:59.348Z","title":"WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Product Slider for WooCommerce","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-25454","published":"2026-03-25T16:14:50.201Z","updated":"2026-04-28T16:14:59.292Z","title":"WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MVPThemes","product":"The League","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-25452","published":"2026-03-25T16:14:50.050Z","updated":"2026-04-28T16:14:59.236Z","title":"WordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDO","product":"Remoji","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25447","published":"2026-03-25T16:14:49.882Z","updated":"2026-04-28T16:14:59.087Z","title":"WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Jonathan Daggerhart","product":"Widget Wrangler","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-25437","published":"2026-03-25T16:14:49.711Z","updated":"2026-04-28T16:14:58.752Z","title":"WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"سید محمدامین هاشمی","product":"GZSEO","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-25435","published":"2026-03-25T16:14:49.497Z","updated":"2026-04-28T16:14:58.679Z","title":"WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdevart","product":"Booking calendar, Appointment Booking System","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25430","published":"2026-03-25T16:14:49.329Z","updated":"2026-04-28T16:14:58.488Z","title":"WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CRM Perks","product":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-25429","published":"2026-03-25T16:14:49.161Z","updated":"2026-04-28T16:14:58.674Z","title":"WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpdive","product":"Nexa Blocks","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-25417","published":"2026-03-25T16:14:49.008Z","updated":"2026-04-28T16:14:58.504Z","title":"WordPress ProfileGrid  plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-25414","published":"2026-03-25T16:14:48.841Z","updated":"2026-04-28T16:14:58.592Z","title":"WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"iqonicdesign","product":"WPBookit Pro","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-25413","published":"2026-03-25T16:14:48.675Z","updated":"2026-04-28T16:14:58.423Z","title":"WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"iqonicdesign","product":"WPBookit Pro","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-25406","published":"2026-03-25T16:14:48.521Z","updated":"2026-04-28T16:14:57.820Z","title":"WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"Themeum","product":"Tutor LMS Pro","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-25401","published":"2026-03-25T16:14:48.355Z","updated":"2026-04-28T16:14:57.849Z","title":"WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Arni Cinco","product":"WPCargo Track & Trace","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-25400","published":"2026-03-25T16:14:48.183Z","updated":"2026-04-28T16:14:57.555Z","title":"WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"thememount","product":"Apicona","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-25398","published":"2026-03-25T16:14:48.027Z","updated":"2026-04-28T16:14:57.603Z","title":"WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webilia Inc.","product":"Vertex Addons for Elementor","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-25397","published":"2026-03-25T16:14:47.850Z","updated":"2026-04-28T16:14:57.543Z","title":"WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Snowray Software","product":"File Uploader for WooCommerce","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-25396","published":"2026-03-25T16:14:47.683Z","updated":"2026-04-29T09:51:57.261Z","title":"WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"CoderPress","product":"Commerce Coinbase For WooCommerce","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-25390","published":"2026-03-25T16:14:47.530Z","updated":"2026-04-28T16:14:57.633Z","title":"WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"New User Approve","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-25383","published":"2026-03-25T16:14:47.362Z","updated":"2026-04-28T16:14:57.339Z","title":"WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25382","published":"2026-03-25T16:14:47.198Z","updated":"2026-04-28T16:14:57.039Z","title":"WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"IdealAuto","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25381","published":"2026-03-25T16:14:47.045Z","updated":"2026-04-28T16:14:57.276Z","title":"WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"LoveDate","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25380","published":"2026-03-25T16:14:46.878Z","updated":"2026-04-28T16:14:56.984Z","title":"WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"Feedy","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25379","published":"2026-03-25T16:14:46.711Z","updated":"2026-04-28T16:14:57.221Z","title":"WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"StreamVid","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25377","published":"2026-03-25T16:14:46.544Z","updated":"2026-04-28T16:14:57.263Z","title":"WordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"eyecix","product":"Addon Jobsearch Chat","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-25376","published":"2026-03-25T16:14:46.370Z","updated":"2026-04-28T16:14:57.028Z","title":"WordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"eyecix","product":"Addon Jobsearch Chat","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25373","published":"2026-03-25T16:14:46.162Z","updated":"2026-04-28T16:14:56.998Z","title":"WordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ProgressionStudios","product":"Vayvo","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25371","published":"2026-03-25T16:14:45.995Z","updated":"2026-04-28T16:14:56.954Z","title":"WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"King-Theme","product":"Lumise Product Designer","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-25366","published":"2026-03-25T16:14:45.830Z","updated":"2026-04-28T16:14:56.667Z","title":"WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Themeisle","product":"Woody ad snippets","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-25365","published":"2026-03-25T16:14:45.681Z","updated":"2026-04-28T16:14:56.821Z","title":"WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Özgür KARALAR","product":"Kargo Takip","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-25361","published":"2026-03-25T16:14:45.515Z","updated":"2026-04-28T16:14:56.702Z","title":"WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25360","published":"2026-03-25T16:14:45.362Z","updated":"2026-04-28T16:14:56.707Z","title":"WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Vex","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-25359","published":"2026-03-25T16:14:45.178Z","updated":"2026-04-28T16:14:56.672Z","title":"WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Pendulum","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-25358","published":"2026-03-25T16:14:44.886Z","updated":"2026-04-28T16:14:56.706Z","title":"WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Meloo","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-25357","published":"2026-03-25T16:14:44.726Z","updated":"2026-04-28T16:14:56.691Z","title":"WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability","severity":"HIGH","score":8.1,"vendor":"azzaroco","product":"Ultimate Membership Pro","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-25356","published":"2026-03-25T16:14:44.550Z","updated":"2026-04-28T16:14:56.378Z","title":"WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Yobazar","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-25355","published":"2026-03-25T16:14:44.356Z","updated":"2026-04-28T16:14:56.569Z","title":"WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"skygroup","product":"Sanzo","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-25354","published":"2026-03-25T16:14:44.206Z","updated":"2026-04-28T16:14:56.500Z","title":"WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Reebox","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25353","published":"2026-03-25T16:14:44.036Z","updated":"2026-04-28T16:14:56.393Z","title":"WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Nooni","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25352","published":"2026-03-25T16:14:43.864Z","updated":"2026-04-28T16:14:56.404Z","title":"WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"MyDecor","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25351","published":"2026-03-25T16:14:43.709Z","updated":"2026-04-28T16:14:56.373Z","title":"WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"MyMedi","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25350","published":"2026-03-25T16:14:43.538Z","updated":"2026-04-28T16:14:56.306Z","title":"WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Miti","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25349","published":"2026-03-25T16:14:43.362Z","updated":"2026-04-28T16:14:56.370Z","title":"WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Loobek","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25347","published":"2026-03-25T16:14:43.153Z","updated":"2026-04-28T16:14:56.287Z","title":"WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Acato","product":"WP REST Cache","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25346","published":"2026-03-25T16:14:42.888Z","updated":"2026-04-29T09:51:56.899Z","title":"WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"FAQ Builder AYS","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25345","published":"2026-03-25T16:14:42.721Z","updated":"2026-04-28T16:14:55.926Z","title":"WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9.9,"vendor":"GalleryCreator","product":"SimpLy Gallery","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-25344","published":"2026-03-25T16:14:42.559Z","updated":"2026-04-29T09:51:56.733Z","title":"WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"Review Schema","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-25342","published":"2026-03-25T16:14:42.373Z","updated":"2026-04-28T16:14:55.907Z","title":"WordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25341","published":"2026-03-25T16:14:42.160Z","updated":"2026-04-28T16:14:55.920Z","title":"WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RSJoomla!","product":"RSFirewall!","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25340","published":"2026-03-25T16:14:42.002Z","updated":"2026-04-28T16:14:55.918Z","title":"WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-25339","published":"2026-03-25T16:14:41.799Z","updated":"2026-04-29T09:51:56.874Z","title":"WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syed Balkhi","product":"Contact Form by WPForms","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-25334","published":"2026-03-25T16:14:41.531Z","updated":"2026-04-28T16:14:55.647Z","title":"WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability","severity":"HIGH","score":8.1,"vendor":"wordpresschef","product":"Salon Booking System Pro","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-25328","published":"2026-03-25T16:14:40.912Z","updated":"2026-04-28T16:14:55.567Z","title":"WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"add-ons.org","product":"Product File Upload for WooCommerce","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-25327","published":"2026-03-25T16:14:40.419Z","updated":"2026-04-29T09:51:56.663Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rustaurius","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-25317","published":"2026-03-25T16:14:40.043Z","updated":"2026-04-29T09:51:56.759Z","title":"WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"tychesoftwares","product":"Print Invoice & Delivery Notes for WooCommerce","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-25309","published":"2026-03-25T16:14:39.628Z","updated":"2026-04-28T16:14:54.640Z","title":"WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-25306","published":"2026-03-25T16:14:39.348Z","updated":"2026-04-28T16:14:54.758Z","title":"WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme","product":"XStore Core","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25304","published":"2026-03-25T16:14:39.195Z","updated":"2026-04-28T16:14:54.263Z","title":"WordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Jaroti","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25035","published":"2026-03-25T16:14:39.024Z","updated":"2026-04-28T16:14:54.148Z","title":"WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-25034","published":"2026-03-25T16:14:38.857Z","updated":"2026-04-28T16:14:54.040Z","title":"WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-25033","published":"2026-03-25T16:14:38.692Z","updated":"2026-04-28T16:14:54.017Z","title":"WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"uixthemes","product":"Motta Addons","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25032","published":"2026-03-25T16:14:38.543Z","updated":"2026-04-28T16:14:54.031Z","title":"WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"park_of_ideas","product":"Ricky","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-25031","published":"2026-03-25T16:14:38.375Z","updated":"2026-04-28T16:14:54.014Z","title":"WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"park_of_ideas","product":"Tasty Daily","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-25030","published":"2026-03-25T16:14:38.188Z","updated":"2026-04-28T16:14:54.025Z","title":"WordPress Goldish theme < 3.47 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"park_of_ideas","product":"Goldish","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-25029","published":"2026-03-25T16:14:37.998Z","updated":"2026-04-28T16:14:54.031Z","title":"WordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"park_of_ideas","product":"KIDZ","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-25026","published":"2026-03-25T16:14:37.824Z","updated":"2026-04-29T09:51:56.738Z","title":"WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"RadiusTheme","product":"Team","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-25025","published":"2026-03-25T16:14:37.651Z","updated":"2026-04-28T16:14:54.041Z","title":"WordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRestaurants","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-25018","published":"2026-03-25T16:14:37.497Z","updated":"2026-04-28T16:14:53.695Z","title":"WordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"stmcan","product":"NaturaLife Extensions","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-25017","published":"2026-03-25T16:14:37.330Z","updated":"2026-04-28T16:14:53.524Z","title":"WordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"stmcan","product":"NaturaLife Extensions","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-25013","published":"2026-03-25T16:14:37.180Z","updated":"2026-04-28T16:14:53.351Z","title":"WordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WHMCSdes","product":"Phox Hosting","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-25009","published":"2026-03-25T16:14:37.014Z","updated":"2026-04-28T16:14:53.256Z","title":"WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"raratheme","product":"Education Zone","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-25007","published":"2026-03-25T16:14:36.845Z","updated":"2026-04-28T16:14:53.255Z","title":"WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Element Invader","product":"ElementInvader Addons for Elementor","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-25002","published":"2026-03-25T16:14:36.682Z","updated":"2026-04-29T09:51:56.664Z","title":"WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress – Sepay Payment","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-25001","published":"2026-03-25T16:14:36.514Z","updated":"2026-04-28T16:14:52.806Z","title":"WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.5,"vendor":"Saad Iqbal","product":"Post Snippets","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-24993","published":"2026-03-25T16:14:36.347Z","updated":"2026-04-28T16:14:52.690Z","title":"WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFactory","product":"Advanced WooCommerce Product Sales Reporting","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-24989","published":"2026-03-25T16:14:36.190Z","updated":"2026-04-28T16:14:52.804Z","title":"WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"FantasticPlugins","product":"SUMO Affiliates Pro","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-24987","published":"2026-03-25T16:14:36.023Z","updated":"2026-04-28T16:14:52.658Z","title":"WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"activity-log.com","product":"WP System Log","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-24983","published":"2026-03-25T16:14:35.855Z","updated":"2026-04-28T16:14:52.538Z","title":"WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-24981","published":"2026-03-25T16:14:35.700Z","updated":"2026-04-28T16:14:52.542Z","title":"WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"Visionary Core","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24980","published":"2026-03-25T16:14:35.532Z","updated":"2026-04-28T16:14:52.509Z","title":"WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Visionary Core","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-24979","published":"2026-03-25T16:14:35.367Z","updated":"2026-04-28T16:14:52.546Z","title":"WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Jobica Core","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-24978","published":"2026-03-25T16:14:35.214Z","updated":"2026-04-28T16:14:52.534Z","title":"WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"Jobica Core","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24977","published":"2026-03-25T16:14:35.048Z","updated":"2026-04-28T16:14:52.499Z","title":"WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"NooTheme","product":"Organici Library","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-24976","published":"2026-03-25T16:14:34.868Z","updated":"2026-04-28T16:14:52.256Z","title":"WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"Organici Library","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24975","published":"2026-03-25T16:14:34.575Z","updated":"2026-04-28T16:14:52.276Z","title":"WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Organici Library","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-24974","published":"2026-03-25T16:14:34.280Z","updated":"2026-04-28T16:14:52.209Z","title":"WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"CitiLights","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24973","published":"2026-03-25T16:14:34.123Z","updated":"2026-04-28T16:14:51.940Z","title":"WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"CitiLights","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-24972","published":"2026-03-25T16:14:33.958Z","updated":"2026-04-28T16:14:51.955Z","title":"WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elated-Themes","product":"Elated Listing","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-24971","published":"2026-03-25T16:14:33.794Z","updated":"2026-04-28T16:14:52.047Z","title":"WordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Elated-Themes","product":"Search & Go","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-24970","published":"2026-03-25T16:14:33.639Z","updated":"2026-04-28T16:14:51.984Z","title":"WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"designingmedia","product":"Energox","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-24969","published":"2026-03-25T16:14:33.459Z","updated":"2026-04-28T16:14:51.951Z","title":"WordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"designingmedia","product":"Instant VA","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-24968","published":"2026-03-25T16:14:33.279Z","updated":"2026-04-28T16:14:51.921Z","title":"WordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Xagio SEO","product":"Xagio SEO","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2026-24964","published":"2026-03-25T16:14:33.077Z","updated":"2026-04-28T16:14:51.965Z","title":"WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-24391","published":"2026-03-25T16:14:32.850Z","updated":"2026-04-28T16:14:48.536Z","title":"WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeMakers","product":"Car Dealer","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-24382","published":"2026-03-25T16:14:32.688Z","updated":"2026-04-28T16:14:48.412Z","title":"WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wproyal","product":"News Magazine X","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-24378","published":"2026-03-25T16:14:32.518Z","updated":"2026-04-28T16:14:48.361Z","title":"WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-24376","published":"2026-03-25T16:14:32.352Z","updated":"2026-04-28T16:14:48.339Z","title":"WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Javier Casares","product":"WPVulnerability","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-24373","published":"2026-03-25T16:14:32.185Z","updated":"2026-04-28T16:14:48.184Z","title":"WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability","severity":"HIGH","score":8.1,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-24372","published":"2026-03-25T16:14:32.017Z","updated":"2026-04-29T09:51:56.675Z","title":"WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Subscriptions for WooCommerce","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2026-24370","published":"2026-03-25T16:14:31.861Z","updated":"2026-09-01T21:35:36.980Z","title":"WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeOne","product":"The Grid","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-24369","published":"2026-03-25T16:14:31.699Z","updated":"2026-09-01T14:42:38.646Z","title":"WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeOne","product":"The Grid","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-24364","published":"2026-03-25T16:14:31.531Z","updated":"2026-04-28T16:14:47.895Z","title":"WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-24363","published":"2026-03-25T16:14:31.370Z","updated":"2026-04-28T16:14:48.378Z","title":"WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"loopus","product":"WP Cost Estimation & Payment Forms Builder","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-24362","published":"2026-03-25T16:14:31.201Z","updated":"2026-04-28T16:14:48.017Z","title":"WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"bdthemes","product":"Ultimate Post Kit","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-24359","published":"2026-03-25T16:14:31.035Z","updated":"2026-04-28T16:14:47.818Z","title":"WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Dokan, Inc.","product":"Dokan","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-23979","published":"2026-03-25T16:14:30.832Z","updated":"2026-04-28T16:14:47.357Z","title":"WordPress Gyan Elements plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Softwebmedia","product":"Gyan Elements","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-23977","published":"2026-03-25T16:14:30.616Z","updated":"2026-04-28T16:14:47.290Z","title":"WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPFactory","product":"Helpdesk Support Ticket System for WooCommerce","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-23973","published":"2026-03-25T16:14:30.420Z","updated":"2026-04-28T16:14:47.484Z","title":"WordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-23972","published":"2026-03-25T16:14:30.153Z","updated":"2026-04-28T16:14:47.260Z","title":"WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-23971","published":"2026-03-25T16:14:29.883Z","updated":"2026-04-28T16:14:47.256Z","title":"WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"xtemos","product":"WoodMart","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-23807","published":"2026-03-25T16:14:29.657Z","updated":"2026-04-28T16:14:47.237Z","title":"WordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Socio","product":"WP Telegram Widget and Join Link","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-23806","published":"2026-03-25T16:14:29.327Z","updated":"2026-04-28T16:14:47.302Z","title":"WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-22524","published":"2026-03-25T16:14:29.032Z","updated":"2026-04-28T17:23:50.712Z","title":"WordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themepassion","product":"Legacy Admin","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-22523","published":"2026-03-25T16:14:28.779Z","updated":"2026-04-28T17:23:42.192Z","title":"WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themepassion","product":"Ultra WordPress Admin","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-22520","published":"2026-03-25T16:14:28.517Z","updated":"2026-04-28T17:23:33.783Z","title":"WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"G5Theme","product":"Handmade Framework","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22516","published":"2026-03-25T16:14:28.255Z","updated":"2026-04-28T17:23:24.778Z","title":"WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Wizor's","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-22515","published":"2026-03-25T16:14:27.982Z","updated":"2026-04-28T17:23:16.262Z","title":"WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"VegaDays","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-22514","published":"2026-03-25T16:14:27.702Z","updated":"2026-04-28T17:23:07.893Z","title":"WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Unica","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-22513","published":"2026-03-25T16:14:27.447Z","updated":"2026-04-28T17:22:59.357Z","title":"WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Triompher","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-22512","published":"2026-03-25T16:14:27.180Z","updated":"2026-04-28T17:22:51.072Z","title":"WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Roisin","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22511","published":"2026-03-25T16:14:26.897Z","updated":"2026-04-28T17:22:42.635Z","title":"WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"NeoBeat","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22510","published":"2026-03-25T16:14:26.647Z","updated":"2026-04-28T17:22:34.268Z","title":"WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Melody","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-22509","published":"2026-03-25T16:14:26.367Z","updated":"2026-04-28T17:22:25.403Z","title":"WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Gioia","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22508","published":"2026-03-25T16:14:26.112Z","updated":"2026-04-28T17:22:16.547Z","title":"WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Dentalux","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22507","published":"2026-03-25T16:14:25.846Z","updated":"2026-04-28T17:22:07.619Z","title":"WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Beelove","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-22506","published":"2026-03-25T16:14:25.621Z","updated":"2026-04-28T17:21:57.130Z","title":"WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Amoli","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22505","published":"2026-03-25T16:14:25.319Z","updated":"2026-04-28T17:21:48.011Z","title":"WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Morning Records","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-22504","published":"2026-03-25T16:14:25.040Z","updated":"2026-04-28T17:21:38.626Z","title":"WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"ProLingua","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22503","published":"2026-03-25T16:14:24.784Z","updated":"2026-04-28T17:21:30.237Z","title":"WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Nelson","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22502","published":"2026-03-25T16:14:24.505Z","updated":"2026-04-28T17:21:21.052Z","title":"WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Mr. Cobbler","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22500","published":"2026-03-25T16:14:24.264Z","updated":"2026-04-28T17:21:03.160Z","title":"WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"m2 | Construction and Tools Store","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-22499","published":"2026-03-25T16:14:24.098Z","updated":"2026-04-28T17:20:54.739Z","title":"WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Lella","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22498","published":"2026-03-25T16:14:23.933Z","updated":"2026-04-28T17:20:46.343Z","title":"WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Laurent","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22496","published":"2026-03-25T16:14:23.766Z","updated":"2026-04-28T17:20:28.290Z","title":"WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Hypnotherapy","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22495","published":"2026-03-25T16:14:23.613Z","updated":"2026-04-28T17:20:18.782Z","title":"WordPress Greenville theme <= 1.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Greenville","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22494","published":"2026-03-25T16:14:23.360Z","updated":"2026-04-28T17:20:10.502Z","title":"WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Good Homes","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22493","published":"2026-03-25T16:14:23.135Z","updated":"2026-04-28T17:20:03.530Z","title":"WordPress Gaspard theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Gaspard","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-22491","published":"2026-03-25T16:14:22.926Z","updated":"2026-04-28T17:19:53.497Z","title":"WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2026-22485","published":"2026-03-25T16:14:22.760Z","updated":"2026-04-28T17:19:44.647Z","title":"WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ruhul Amin","product":"My Album Gallery","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-22484","published":"2026-03-25T16:14:22.610Z","updated":"2026-04-28T17:19:37.944Z","title":"WordPress Lisfinity Core plugin <= 1.5.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"pebas","product":"Lisfinity Core","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-22480","published":"2026-03-25T16:14:22.428Z","updated":"2026-04-28T17:19:01.917Z","title":"WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WebToffee","product":"Product Feed for WooCommerce","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-22448","published":"2026-03-25T16:14:22.252Z","updated":"2026-04-28T17:12:08.343Z","title":"WordPress PitchPrint plugin <= 11.1.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"flexcubed","product":"PitchPrint","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2025-69358","published":"2026-03-25T16:14:22.085Z","updated":"2026-04-28T16:14:38.669Z","title":"WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-69347","published":"2026-03-25T16:14:21.905Z","updated":"2026-04-28T16:14:38.637Z","title":"WordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":8.6,"vendor":"Convers Lab","product":"WPSubscription","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-69096","published":"2026-03-25T16:14:21.692Z","updated":"2026-04-28T16:14:36.587Z","title":"WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"G5Theme","product":"Zorka","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22324","published":"2026-03-20T09:36:37.854Z","updated":"2026-04-28T16:14:40.624Z","title":"WordPress Melania theme <= 2.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Melania","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2026-0677","published":"2026-03-20T09:31:42.957Z","updated":"2026-06-10T19:23:56.064Z","title":"WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability","severity":"MEDIUM","score":6.3,"vendor":"TotalSuite","product":"TotalContest Lite","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2024-32537","published":"2026-03-20T09:09:46.014Z","updated":"2026-04-28T16:09:36.808Z","title":"WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"joshuae1974","product":"Flash Video Player","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2024-31119","published":"2026-03-20T09:07:26.652Z","updated":"2026-04-28T16:09:28.550Z","title":"WordPress Download Special Box for Content plugin <= 1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Vasilis Triantafyllou","product":"Special Box for Content","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-27043","published":"2026-03-19T14:49:20.612Z","updated":"2026-04-28T16:14:59.730Z","title":"WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability","severity":"HIGH","score":7.2,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-27070","published":"2026-03-19T08:43:55.956Z","updated":"2026-04-28T16:15:01.076Z","title":"WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPEverest","product":"Everest Forms Pro","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-27068","published":"2026-03-19T08:42:37.658Z","updated":"2026-04-28T16:15:01.020Z","title":"WordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ryan Howard","product":"Website LLMs.txt","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-27067","published":"2026-03-19T08:41:18.492Z","updated":"2026-04-28T16:15:01.331Z","title":"WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Syarif","product":"Mobile App Editor","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-27065","published":"2026-03-19T08:39:06.032Z","updated":"2026-05-13T00:33:15.552Z","title":"WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThimPress","product":"BuilderPress","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-25445","published":"2026-03-19T08:37:53.763Z","updated":"2026-04-28T16:14:59.220Z","title":"WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Membership Software","product":"WishList Member X","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-25443","published":"2026-03-19T08:36:32.093Z","updated":"2026-04-28T16:14:59.203Z","title":"WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Dotstore","product":"Fraud Prevention For Woocommerce","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-25442","published":"2026-03-19T08:35:29.071Z","updated":"2026-05-13T00:33:00.862Z","title":"WordPress Kentha theme <= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QantumThemes","product":"Kentha","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-25438","published":"2026-03-19T08:34:38.200Z","updated":"2026-04-28T16:14:59.207Z","title":"WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Gutenberg Blocks","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-68836","published":"2026-03-19T08:33:02.946Z","updated":"2026-04-28T16:14:31.682Z","title":"WordPress Table of Contents Creator plugin <= 1.6.4.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Markbeljaars","product":"Table of Contents Creator","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-67618","published":"2026-03-19T08:31:39.918Z","updated":"2026-04-28T16:14:22.615Z","title":"WordPress Brookside theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ArtstudioWorks","product":"Brookside","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62043","published":"2026-03-19T08:25:18.077Z","updated":"2026-04-28T16:13:59.624Z","title":"WordPress WPCasa plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPSight","product":"WPCasa","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-60237","published":"2026-03-19T08:14:27.761Z","updated":"2026-04-28T16:13:58.342Z","title":"WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeton","product":"Finag","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2025-60233","published":"2026-03-19T08:13:15.424Z","updated":"2026-04-28T16:13:58.113Z","title":"WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Themeton","product":"Zuut","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2025-53222","published":"2026-03-19T08:10:35.552Z","updated":"2026-04-28T16:13:21.344Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-50001","published":"2026-03-19T08:07:39.900Z","updated":"2026-04-29T09:51:56.673Z","title":"WordPress tagDiv Composer plugin <= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-32223","published":"2026-03-19T08:05:59.217Z","updated":"2026-04-29T09:51:54.944Z","title":"WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-25312","published":"2026-03-19T07:20:59.799Z","updated":"2026-04-29T09:51:56.756Z","title":"WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-25471","published":"2026-03-19T07:17:54.170Z","updated":"2026-04-28T16:14:59.631Z","title":"WordPress Admin Safety Guard plugin <= 1.2.6 - Broken Authentication vulnerability","severity":"HIGH","score":8.1,"vendor":"Themepaste","product":"Admin Safety Guard","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-27091","published":"2026-03-19T06:48:21.913Z","updated":"2026-04-28T16:15:01.703Z","title":"WordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"UiPress","product":"UiPress lite","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-27093","published":"2026-03-19T06:41:10.108Z","updated":"2026-04-28T16:15:01.696Z","title":"WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"Tripgo","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-27096","published":"2026-03-19T05:31:42.330Z","updated":"2026-04-28T16:15:01.674Z","title":"WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.1,"vendor":"BuddhaThemes","product":"ColorFolio - Freelance Designer WordPress Theme","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-27397","published":"2026-03-19T05:30:18.525Z","updated":"2026-04-28T16:15:02.887Z","title":"WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Really Simple Plugins B.V.","product":"Really Simple Security Pro","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-27413","published":"2026-03-19T05:28:13.373Z","updated":"2026-04-28T16:15:03.091Z","title":"WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Cozmoslabs","product":"Profile Builder Pro","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-27540","published":"2026-03-19T05:24:45.836Z","updated":"2026-04-29T09:51:57.128Z","title":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Rymera Web Co Pty Ltd.","product":"Woocommerce Wholesale Lead Capture","kev":false,"epss":0.02688,"kevAdded":null},{"id":"CVE-2026-27542","published":"2026-03-19T05:22:49.717Z","updated":"2026-04-29T09:51:57.085Z","title":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Rymera Web Co Pty Ltd.","product":"Woocommerce Wholesale Lead Capture","kev":false,"epss":0.01737,"kevAdded":null},{"id":"CVE-2026-28044","published":"2026-03-19T05:21:26.027Z","updated":"2026-04-28T16:15:05.132Z","title":"WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-28070","published":"2026-03-19T05:20:03.784Z","updated":"2026-04-28T16:15:06.675Z","title":"WordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tips and Tricks HQ","product":"WP eMember","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-28073","published":"2026-03-19T05:18:56.777Z","updated":"2026-04-28T16:15:06.683Z","title":"WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tips and Tricks HQ","product":"WP eMember","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-25449","published":"2026-03-18T13:12:25.884Z","updated":"2026-04-28T16:14:59.219Z","title":"WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-32565","published":"2026-03-18T09:31:47.839Z","updated":"2026-04-29T09:52:01.704Z","title":"WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ajay","product":"Contextual Related Posts","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-32586","published":"2026-03-17T08:24:13.299Z","updated":"2026-04-29T09:52:01.711Z","title":"WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-32587","published":"2026-03-16T15:30:04.835Z","updated":"2026-04-29T09:52:01.759Z","title":"WordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-32583","published":"2026-03-16T15:11:29.198Z","updated":"2026-03-16T17:53:41.571Z","title":"WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Webnus Inc.","product":"Modern Events Calendar","kev":false,"epss":0.00715,"kevAdded":null},{"id":"CVE-2026-25369","published":"2026-03-16T14:13:48.908Z","updated":"2026-05-11T20:50:26.639Z","title":"WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"flexmls","product":"Flexmls® IDX","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-32543","published":"2026-03-13T11:42:24.104Z","updated":"2026-04-29T09:52:01.668Z","title":"WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CyberChimps","product":"Responsive Blocks","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-32487","published":"2026-03-13T11:42:23.913Z","updated":"2026-04-29T09:52:00.640Z","title":"WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Lawyer Landing Page","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-32486","published":"2026-03-13T11:42:23.741Z","updated":"2026-04-29T09:52:00.438Z","title":"WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wptravelengine","product":"Travel Booking","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-32462","published":"2026-03-13T11:42:23.560Z","updated":"2026-04-29T09:51:59.918Z","title":"WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Liton Arefin","product":"Master Addons for Elementor","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-32461","published":"2026-03-13T11:42:23.380Z","updated":"2026-04-29T09:52:00.212Z","title":"WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-32460","published":"2026-03-13T11:42:23.111Z","updated":"2026-04-29T09:51:59.939Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-32459","published":"2026-03-13T11:42:22.929Z","updated":"2026-04-29T09:52:00.325Z","title":"WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"flycart","product":"UpsellWP","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-32458","published":"2026-03-13T11:42:22.748Z","updated":"2026-04-29T09:52:00.263Z","title":"WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"RealMag777","product":"WOLF","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-32457","published":"2026-03-13T11:42:22.574Z","updated":"2026-04-29T09:51:59.964Z","title":"WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wombat Plugins","product":"Advanced Product Fields (Product Addons) for WooCommerce","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-32456","published":"2026-03-13T11:42:22.381Z","updated":"2026-04-29T09:51:59.956Z","title":"WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Janis Elsts","product":"Admin Menu Editor","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-32455","published":"2026-03-13T11:42:22.200Z","updated":"2026-04-29T09:52:00.095Z","title":"WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"MDTF","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-32454","published":"2026-03-13T11:42:22.010Z","updated":"2026-04-29T09:52:00.202Z","title":"WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeFusion","product":"Avada Core","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-32453","published":"2026-03-13T11:42:21.829Z","updated":"2026-04-29T09:51:59.866Z","title":"WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeFusion","product":"Avada Core","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-32452","published":"2026-03-13T11:42:21.652Z","updated":"2026-04-29T09:51:59.747Z","title":"WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-32451","published":"2026-03-13T11:42:21.480Z","updated":"2026-04-29T09:51:59.766Z","title":"WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-32450","published":"2026-03-13T11:42:21.288Z","updated":"2026-04-29T09:51:59.770Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-32449","published":"2026-03-13T11:42:21.103Z","updated":"2026-04-29T09:51:59.756Z","title":"WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themifyme","product":"Themify Event Post","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-32448","published":"2026-03-13T11:42:20.912Z","updated":"2026-04-29T09:51:59.723Z","title":"WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Eric Teubert","product":"Podlove Podcast Publisher","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-32447","published":"2026-03-13T11:42:20.710Z","updated":"2026-04-29T09:51:59.757Z","title":"WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-32446","published":"2026-03-13T11:42:20.527Z","updated":"2026-04-29T09:51:59.635Z","title":"WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"Contact Form by WPForms","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-32445","published":"2026-03-13T11:42:20.356Z","updated":"2026-04-29T09:51:59.696Z","title":"WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-32443","published":"2026-03-13T11:42:20.167Z","updated":"2026-04-29T09:51:59.562Z","title":"WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Josh Kohlbach","product":"Product Feed PRO for WooCommerce","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-32442","published":"2026-03-13T11:42:19.991Z","updated":"2026-04-29T09:51:59.628Z","title":"WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"E2Pdf","product":"e2pdf","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-32440","published":"2026-03-13T11:42:19.810Z","updated":"2026-04-29T09:51:59.644Z","title":"WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ex-Themes","product":"WP Food","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-32439","published":"2026-03-13T11:42:19.604Z","updated":"2026-04-29T09:51:59.607Z","title":"WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebGeniusLab","product":"BigHearts","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-32438","published":"2026-03-13T11:42:19.358Z","updated":"2026-04-29T09:51:59.665Z","title":"WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW School Education","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-32437","published":"2026-03-13T11:42:19.177Z","updated":"2026-04-29T09:51:59.450Z","title":"WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Portfolio","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-32436","published":"2026-03-13T11:42:19.005Z","updated":"2026-04-29T09:51:59.512Z","title":"WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Photography","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-32435","published":"2026-03-13T11:42:18.837Z","updated":"2026-04-29T09:51:59.351Z","title":"WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Pet Shop","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-32434","published":"2026-03-13T11:42:18.658Z","updated":"2026-04-29T09:51:59.392Z","title":"WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Fitness","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-32433","published":"2026-03-13T11:42:18.460Z","updated":"2026-04-29T09:51:59.288Z","title":"WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"codepeople","product":"CP Contact Form with Paypal","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-32432","published":"2026-03-13T11:42:18.279Z","updated":"2026-04-29T09:51:59.166Z","title":"WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"codepeople","product":"WP Time Slots Booking Form","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32431","published":"2026-03-13T11:42:18.080Z","updated":"2026-04-29T09:51:59.081Z","title":"WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Astra Bulk Edit","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32430","published":"2026-03-13T11:42:17.868Z","updated":"2026-04-29T09:51:59.446Z","title":"WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32429","published":"2026-03-13T11:42:17.710Z","updated":"2026-04-29T09:51:59.102Z","title":"WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"Magical Addons For Elementor","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32428","published":"2026-03-13T11:42:17.541Z","updated":"2026-04-29T09:51:59.116Z","title":"WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Popup Like box","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32427","published":"2026-03-13T11:42:17.358Z","updated":"2026-04-29T09:51:59.440Z","title":"WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vowelweb","product":"VW Education Lite","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-32426","published":"2026-03-13T11:42:17.181Z","updated":"2026-04-29T09:51:59.103Z","title":"WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"themelexus","product":"Medilazar Core","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32425","published":"2026-03-13T11:42:17.005Z","updated":"2026-04-29T09:51:59.115Z","title":"WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"linknacional","product":"Payment Gateway Pix For GiveWP","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32424","published":"2026-03-13T11:42:16.828Z","updated":"2026-04-29T09:51:59.261Z","title":"WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BoldGrid","product":"Sprout Clients","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32423","published":"2026-03-13T11:42:16.662Z","updated":"2026-04-29T09:51:59.167Z","title":"WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Bowo","product":"Admin and Site Enhancements (ASE)","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-32422","published":"2026-03-13T11:42:16.471Z","updated":"2026-04-29T09:51:59.010Z","title":"WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"levelfourdevelopment","product":"WP EasyCart","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32421","published":"2026-03-13T11:42:16.295Z","updated":"2026-04-29T09:51:59.122Z","title":"WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Agile Logix","product":"Post Timeline","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32420","published":"2026-03-13T11:42:16.126Z","updated":"2026-04-29T09:51:58.994Z","title":"WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-32419","published":"2026-03-13T11:42:15.955Z","updated":"2026-04-29T09:51:59.081Z","title":"WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Fernando Briano","product":"List category posts","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-32418","published":"2026-03-13T11:42:15.769Z","updated":"2026-04-29T09:51:59.016Z","title":"WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Jordy Meow","product":"Meow Gallery","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-32417","published":"2026-03-13T11:42:15.593Z","updated":"2026-04-29T09:51:59.221Z","title":"WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wppochipp","product":"Pochipp","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-32416","published":"2026-03-13T11:42:15.425Z","updated":"2026-04-29T09:51:59.108Z","title":"WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-32415","published":"2026-03-13T11:42:15.203Z","updated":"2026-04-29T09:51:59.409Z","title":"WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability","severity":"MEDIUM","score":5,"vendor":"Bogdan Bendziukov","product":"Squeeze","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-32414","published":"2026-03-13T11:42:14.914Z","updated":"2026-04-29T09:51:59.110Z","title":"WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.2,"vendor":"ILLID","product":"Advanced Woo Labels","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-32413","published":"2026-03-13T11:42:14.732Z","updated":"2026-04-29T09:51:59.009Z","title":"WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Maciej Bis","product":"Permalink Manager Lite","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32412","published":"2026-03-13T11:42:14.544Z","updated":"2026-04-29T09:51:59.019Z","title":"WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Gift Up!","product":"Gift Up Gift Cards for WordPress and WooCommerce","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-32411","published":"2026-03-13T11:42:14.354Z","updated":"2026-04-29T09:51:58.999Z","title":"WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Simpma","product":"Embed Calendly","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32410","published":"2026-03-13T11:42:14.149Z","updated":"2026-04-29T09:51:59.092Z","title":"WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WBW Plugins","product":"WBW Currency Switcher for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-32409","published":"2026-03-13T11:42:13.977Z","updated":"2026-04-29T09:51:58.891Z","title":"WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Forminator","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-32408","published":"2026-03-13T11:42:13.798Z","updated":"2026-04-29T09:51:58.964Z","title":"WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themefusecom","product":"Brizy","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-32407","published":"2026-03-13T11:42:13.638Z","updated":"2026-04-29T09:51:58.963Z","title":"WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPClever","product":"WPC Smart Wishlist for WooCommerce","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-32406","published":"2026-03-13T11:42:13.454Z","updated":"2026-04-29T09:51:58.976Z","title":"WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPClever","product":"WPC Product Bundles for WooCommerce","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-32405","published":"2026-03-13T11:42:13.263Z","updated":"2026-04-29T09:51:58.844Z","title":"WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"xtemos","product":"WoodMart","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-32404","published":"2026-03-13T11:42:13.050Z","updated":"2026-04-29T09:51:58.970Z","title":"WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Studio99","product":"Studio99 WP Monitor","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32403","published":"2026-03-13T11:42:12.862Z","updated":"2026-04-29T09:51:58.888Z","title":"WordPress Toocheke Companion plugin <= 1.194 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"toocheke","product":"Toocheke Companion","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32402","published":"2026-03-13T11:42:12.702Z","updated":"2026-04-29T09:51:58.889Z","title":"WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Image Slider by Ays","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32401","published":"2026-03-13T11:42:12.509Z","updated":"2026-04-29T09:51:58.783Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.2,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-32400","published":"2026-03-13T11:42:12.279Z","updated":"2026-04-29T09:51:58.899Z","title":"WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemetechMount","product":"Boldman","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32399","published":"2026-03-13T11:42:12.062Z","updated":"2026-04-29T09:51:58.813Z","title":"WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32398","published":"2026-03-13T11:42:11.880Z","updated":"2026-04-29T09:51:58.739Z","title":"WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Subrata Mal","product":"TeraWallet – For WooCommerce","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-32397","published":"2026-03-13T11:42:11.696Z","updated":"2026-04-29T09:51:58.759Z","title":"WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YMC","product":"Filter & Grids","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-32396","published":"2026-03-13T11:42:11.496Z","updated":"2026-04-29T09:51:58.898Z","title":"WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RadiusTheme","product":"Team","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32395","published":"2026-03-13T11:42:11.324Z","updated":"2026-04-29T09:51:58.835Z","title":"WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Xpro","product":"Xpro Addons For Beaver Builder – Lite","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32394","published":"2026-03-13T11:42:11.143Z","updated":"2026-04-29T09:51:58.729Z","title":"WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-32393","published":"2026-03-13T11:42:10.976Z","updated":"2026-04-29T09:51:58.827Z","title":"WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Creatives_Planet","product":"Greenly Theme Addons","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32392","published":"2026-03-13T11:42:10.798Z","updated":"2026-04-29T09:51:58.844Z","title":"WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Creatives_Planet","product":"Greenly","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32391","published":"2026-03-13T11:42:10.625Z","updated":"2026-04-29T09:51:58.837Z","title":"WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"linethemes","product":"SmartFix","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-32390","published":"2026-03-13T11:42:10.444Z","updated":"2026-04-29T09:51:58.692Z","title":"WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"linethemes","product":"Nanosoft","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-32388","published":"2026-03-13T11:42:10.279Z","updated":"2026-04-29T09:51:58.883Z","title":"WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"linethemes","product":"GLB","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-32387","published":"2026-03-13T11:42:10.082Z","updated":"2026-04-29T09:51:58.338Z","title":"WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Noor Alam","product":"Checkout for PayPal","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-32386","published":"2026-03-13T11:42:09.906Z","updated":"2026-04-29T09:51:58.671Z","title":"WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EnvoThemes","product":"Envo Extra","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-32385","published":"2026-03-13T11:42:09.694Z","updated":"2026-04-29T09:51:58.727Z","title":"WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-32384","published":"2026-03-13T11:42:09.282Z","updated":"2026-04-29T09:51:58.350Z","title":"WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"magepeopleteam","product":"WpBookingly","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32383","published":"2026-03-13T11:42:09.113Z","updated":"2026-04-29T09:51:58.297Z","title":"WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Ridhi","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32382","published":"2026-03-13T11:42:08.933Z","updated":"2026-04-29T09:51:58.252Z","title":"WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Digital Download","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32381","published":"2026-03-13T11:42:08.756Z","updated":"2026-04-29T09:51:58.284Z","title":"WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"App Landing Page","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32380","published":"2026-03-13T11:42:08.583Z","updated":"2026-04-29T09:51:58.128Z","title":"WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Numinous","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32379","published":"2026-03-13T11:42:08.354Z","updated":"2026-04-29T09:51:57.980Z","title":"WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Rara Academic","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32378","published":"2026-03-13T11:42:08.127Z","updated":"2026-04-29T09:51:58.062Z","title":"WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Book Landing Page","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32377","published":"2026-03-13T11:42:07.877Z","updated":"2026-04-29T09:51:58.100Z","title":"WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Pranayama Yoga","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32376","published":"2026-03-13T11:42:07.705Z","updated":"2026-04-29T09:51:57.939Z","title":"WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Kalon","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32375","published":"2026-03-13T11:42:07.525Z","updated":"2026-04-29T09:51:57.994Z","title":"WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Travel Diaries","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32374","published":"2026-03-13T11:42:07.346Z","updated":"2026-04-29T09:51:58.006Z","title":"WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"The Minimal","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32373","published":"2026-03-13T11:42:07.122Z","updated":"2026-04-29T09:51:57.970Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Cozy Vision","product":"SMS Alert Order Notifications","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-32372","published":"2026-03-13T11:42:06.960Z","updated":"2026-04-29T09:51:57.968Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RadiusTheme","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-32371","published":"2026-03-13T11:42:06.790Z","updated":"2026-04-29T09:51:57.973Z","title":"WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Elegant Pink","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32370","published":"2026-03-13T11:42:06.611Z","updated":"2026-04-29T09:51:58.117Z","title":"WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Influencer","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32369","published":"2026-03-13T11:42:06.431Z","updated":"2026-04-29T09:51:57.971Z","title":"WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"RadiusTheme","product":"Medilink-Core","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32368","published":"2026-03-13T11:42:06.228Z","updated":"2026-04-29T09:51:57.878Z","title":"WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"delphiknight","product":"Geo to Lat","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32367","published":"2026-03-13T11:42:06.050Z","updated":"2026-04-29T09:51:57.847Z","title":"WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Yannick Lefebvre","product":"Modal Dialog","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-32366","published":"2026-03-13T11:42:05.867Z","updated":"2026-04-29T09:51:57.828Z","title":"WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"robfelty","product":"Collapsing Categories","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32365","published":"2026-03-13T11:42:05.684Z","updated":"2026-04-29T09:51:57.856Z","title":"WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"robfelty","product":"Collapsing Archives","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-32364","published":"2026-03-13T11:42:05.501Z","updated":"2026-04-29T09:51:57.872Z","title":"WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"redqteam","product":"Turbo Manager","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-32363","published":"2026-03-13T11:42:05.330Z","updated":"2026-04-29T09:51:57.912Z","title":"WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Funlus Oy","product":"WPLifeCycle","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32362","published":"2026-03-13T11:42:05.065Z","updated":"2026-04-29T09:51:57.881Z","title":"WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"activity-log.com","product":"WP Sessions Time Monitoring Full Automatic","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32361","published":"2026-03-13T11:42:04.715Z","updated":"2026-04-29T09:51:57.676Z","title":"WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marketing Fire","product":"Editorial Calendar","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32360","published":"2026-03-13T11:42:04.382Z","updated":"2026-04-29T09:51:57.858Z","title":"WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"richplugins","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-32359","published":"2026-03-13T11:42:04.157Z","updated":"2026-04-29T09:51:57.977Z","title":"WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Icon List Block","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32358","published":"2026-03-13T11:42:03.699Z","updated":"2026-04-29T09:51:57.850Z","title":"WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-32357","published":"2026-03-13T11:42:01.168Z","updated":"2026-04-29T09:51:57.855Z","title":"WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Katsushi Kawamori","product":"Simple Blog Card","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-32356","published":"2026-03-13T11:42:00.938Z","updated":"2026-04-29T09:51:57.730Z","title":"WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"robosoft","product":"Robo Gallery","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-32355","published":"2026-03-13T11:42:00.737Z","updated":"2026-04-29T09:51:57.881Z","title":"WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2026-32354","published":"2026-03-13T11:41:59.838Z","updated":"2026-04-29T09:51:57.771Z","title":"WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-32353","published":"2026-03-13T11:41:59.644Z","updated":"2026-04-29T09:51:57.649Z","title":"WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"MailerPress Team","product":"MailerPress","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-32352","published":"2026-03-13T11:41:59.354Z","updated":"2026-04-29T09:51:57.697Z","title":"WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-32351","published":"2026-03-13T11:41:59.168Z","updated":"2026-04-29T09:51:57.787Z","title":"WordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-32350","published":"2026-03-13T11:41:58.999Z","updated":"2026-04-29T09:51:57.879Z","title":"WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpradiant","product":"Chocolate House","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32349","published":"2026-03-13T11:41:58.830Z","updated":"2026-04-29T09:51:57.755Z","title":"WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Andy Fragen","product":"Embed PDF Viewer","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-32348","published":"2026-03-13T11:41:58.651Z","updated":"2026-04-29T09:51:57.707Z","title":"WordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"MadrasThemes","product":"MAS Videos","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32347","published":"2026-03-13T11:41:58.469Z","updated":"2026-04-29T09:51:57.768Z","title":"WordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Restaurant and Cafe","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32346","published":"2026-03-13T11:41:58.085Z","updated":"2026-04-29T09:51:57.729Z","title":"WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Travel Agency","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32345","published":"2026-03-13T11:41:57.904Z","updated":"2026-04-29T09:51:57.656Z","title":"WordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Perfect Portfolio","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32344","published":"2026-03-13T11:41:57.714Z","updated":"2026-04-29T09:51:57.631Z","title":"WordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"desertthemes","product":"Corpiva","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-32343","published":"2026-03-13T11:41:57.540Z","updated":"2026-04-29T09:51:57.680Z","title":"WordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magazine3","product":"Easy Table of Contents","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-32342","published":"2026-03-13T11:41:57.370Z","updated":"2026-04-29T09:51:57.637Z","title":"WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-32341","published":"2026-03-13T11:41:57.194Z","updated":"2026-04-29T09:51:57.636Z","title":"WordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Benevolent","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32340","published":"2026-03-13T11:41:57.010Z","updated":"2026-04-29T09:51:57.638Z","title":"WordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Business One Page","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32339","published":"2026-03-13T11:41:56.845Z","updated":"2026-04-29T09:51:57.611Z","title":"WordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Bakes And Cakes","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32338","published":"2026-03-13T11:41:56.674Z","updated":"2026-04-29T09:51:57.320Z","title":"WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Construction Landing Page","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32337","published":"2026-03-13T11:41:56.507Z","updated":"2026-04-29T09:51:57.625Z","title":"WordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Preschool and Kindergarten","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32336","published":"2026-03-13T11:41:56.325Z","updated":"2026-04-29T09:51:57.648Z","title":"WordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Rara Business","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32335","published":"2026-03-13T11:41:56.138Z","updated":"2026-04-29T09:51:57.309Z","title":"WordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"The Conference","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32334","published":"2026-03-13T11:41:55.950Z","updated":"2026-04-29T09:51:57.303Z","title":"WordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"JobScout","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32332","published":"2026-03-13T11:41:55.724Z","updated":"2026-04-29T09:51:57.567Z","title":"WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Easy Form","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-32331","published":"2026-03-13T11:41:55.444Z","updated":"2026-04-29T09:51:57.457Z","title":"WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Israpil","product":"Textmetrics","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-32330","published":"2026-03-13T11:41:55.160Z","updated":"2026-04-29T09:51:57.561Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-32329","published":"2026-03-13T11:41:54.930Z","updated":"2026-04-29T09:51:57.449Z","title":"WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Advanced Related Posts","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-32328","published":"2026-03-13T11:41:54.754Z","updated":"2026-04-29T09:51:57.361Z","title":"WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"shufflehound","product":"Lemmony","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-31922","published":"2026-03-13T11:41:54.569Z","updated":"2026-04-29T09:51:57.358Z","title":"WordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ays Pro","product":"Fox LMS","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-31919","published":"2026-03-13T11:41:54.329Z","updated":"2026-04-29T09:51:57.344Z","title":"WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Josh Kohlbach","product":"Advanced Coupons for WooCommerce Coupons","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-31918","published":"2026-03-13T11:41:54.126Z","updated":"2026-04-29T09:51:57.609Z","title":"WordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"immonex","product":"immonex Kickstart","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-31917","published":"2026-03-13T11:41:53.941Z","updated":"2026-04-29T09:51:57.241Z","title":"WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-31916","published":"2026-03-13T11:41:53.694Z","updated":"2026-04-29T09:51:57.330Z","title":"WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Iulia Cazan","product":"Latest Post Shortcode","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-31915","published":"2026-03-13T11:41:53.239Z","updated":"2026-04-29T09:51:57.665Z","title":"WordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-28080","published":"2026-03-06T12:04:08.429Z","updated":"2026-04-28T16:15:07.040Z","title":"WordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rank Math","product":"Rank Math SEO PRO","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-28106","published":"2026-03-06T11:49:35.492Z","updated":"2026-03-09T08:03:30.146Z","title":"WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Kings Plugins","product":"B2BKing Premium","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2024-35644","published":"2026-03-06T11:40:49.854Z","updated":"2026-04-28T16:09:52.134Z","title":"WordPress Preferred Languages plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Pascal Birchler","product":"Preferred Languages","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-28137","published":"2026-03-05T05:54:31.838Z","updated":"2026-04-28T16:15:09.340Z","title":"WordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuanticaLabs","product":"MediCenter - Health Medical Clinic","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28135","published":"2026-03-05T05:54:31.656Z","updated":"2026-04-29T09:51:57.103Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability","severity":"HIGH","score":8.2,"vendor":"WP Royal","product":"Royal Elementor Addons","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-28134","published":"2026-03-05T05:54:31.474Z","updated":"2026-04-28T16:15:09.346Z","title":"WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-28133","published":"2026-03-05T05:54:31.266Z","updated":"2026-04-28T16:15:09.431Z","title":"WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability","severity":"HIGH","score":8.5,"vendor":"WP Chill","product":"Filr","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-28130","published":"2026-03-05T05:54:31.074Z","updated":"2026-04-28T16:15:08.927Z","title":"WordPress UDesign theme <= 4.14.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AndonDesign","product":"UDesign","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28129","published":"2026-03-05T05:54:30.896Z","updated":"2026-04-28T17:48:12.259Z","title":"WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Little Birdies","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28128","published":"2026-03-05T05:54:30.693Z","updated":"2026-04-28T17:47:58.146Z","title":"WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Verse","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-28127","published":"2026-03-05T05:54:30.492Z","updated":"2026-04-28T17:47:49.846Z","title":"WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"Lawyer Directory","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28126","published":"2026-03-05T05:54:30.292Z","updated":"2026-04-28T17:47:38.068Z","title":"WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"sizam","product":"RH Frontend Publishing Pro","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28125","published":"2026-03-05T05:54:30.102Z","updated":"2026-04-28T17:47:27.500Z","title":"WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Midi","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28124","published":"2026-03-05T05:54:29.899Z","updated":"2026-04-28T17:47:16.704Z","title":"WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Notarius","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28123","published":"2026-03-05T05:54:29.564Z","updated":"2026-04-28T17:47:07.560Z","title":"WordPress Veil theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Veil","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-28122","published":"2026-03-05T05:54:29.324Z","updated":"2026-04-28T17:46:57.446Z","title":"WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28121","published":"2026-03-05T05:54:29.080Z","updated":"2026-04-28T17:46:48.209Z","title":"WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Anderson","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28120","published":"2026-03-05T05:54:28.910Z","updated":"2026-04-28T17:46:38.844Z","title":"WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Dr.Patterson","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28119","published":"2026-03-05T05:54:28.706Z","updated":"2026-04-28T17:46:28.855Z","title":"WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Nirvana","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28118","published":"2026-03-05T05:54:28.532Z","updated":"2026-04-28T17:46:20.559Z","title":"WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Welldone","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-28117","published":"2026-03-05T05:54:28.342Z","updated":"2026-04-28T17:46:10.852Z","title":"WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"smart SEO","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-28115","published":"2026-03-05T05:54:28.114Z","updated":"2026-04-28T17:46:02.104Z","title":"WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"loopus","product":"WP Attractive Donations System - Easy Stripe & Paypal donations","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-28114","published":"2026-03-05T05:54:27.931Z","updated":"2026-04-28T17:45:52.423Z","title":"WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"firassaidi","product":"WooCommerce License Manager","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-28113","published":"2026-03-05T05:54:27.757Z","updated":"2026-04-28T17:45:42.729Z","title":"WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"azzaroco","product":"Ultimate Learning Pro","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28112","published":"2026-03-05T05:54:27.571Z","updated":"2026-04-28T17:45:33.584Z","title":"WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"AllInOne - Banner Rotator","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28110","published":"2026-03-05T05:54:27.399Z","updated":"2026-04-28T17:45:24.351Z","title":"WordPress LambertGroup - AllInOne - Banner with Playlist plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Banner with Playlist","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28109","published":"2026-03-05T05:54:27.176Z","updated":"2026-04-28T17:45:14.351Z","title":"WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Content Slider","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-28108","published":"2026-03-05T05:54:26.972Z","updated":"2026-04-28T17:45:04.681Z","title":"WordPress LambertGroup - AllInOne - Banner with Thumbnails plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Banner with Thumbnails","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28107","published":"2026-03-05T05:54:26.800Z","updated":"2026-04-28T17:44:55.296Z","title":"WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Muzicon","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28105","published":"2026-03-05T05:54:26.592Z","updated":"2026-04-28T17:44:45.609Z","title":"WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Good Energy","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-28104","published":"2026-03-05T05:54:26.400Z","updated":"2026-04-28T17:44:33.806Z","title":"WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aryan Shirani Bid Abadi","product":"Site Suggest","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-28103","published":"2026-03-05T05:54:26.209Z","updated":"2026-04-28T17:44:23.703Z","title":"WordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"LBG Zoominoutslider","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28102","published":"2026-03-05T05:54:26.036Z","updated":"2026-04-28T17:44:13.726Z","title":"WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"UberSlider Classic","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28101","published":"2026-03-05T05:54:25.838Z","updated":"2026-04-28T17:44:04.097Z","title":"WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"UberSlider MouseInteraction","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28100","published":"2026-03-05T05:54:25.660Z","updated":"2026-04-28T17:43:53.534Z","title":"WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"UberSlider PerpetuumMobile","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28099","published":"2026-03-05T05:54:25.484Z","updated":"2026-04-28T17:43:43.618Z","title":"WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"UberSlider Ultra","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28098","published":"2026-03-05T05:54:25.315Z","updated":"2026-04-28T17:43:37.909Z","title":"WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Save Life","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28097","published":"2026-03-05T05:54:25.140Z","updated":"2026-04-28T17:43:26.292Z","title":"WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Artrium","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28096","published":"2026-03-05T05:54:24.950Z","updated":"2026-04-28T17:43:17.201Z","title":"WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"WealthCo","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28095","published":"2026-03-05T05:54:24.760Z","updated":"2026-04-28T17:43:08.955Z","title":"WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Marcell","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28094","published":"2026-03-05T05:54:24.563Z","updated":"2026-04-28T17:42:59.162Z","title":"WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"RexCoin","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28093","published":"2026-03-05T05:54:24.324Z","updated":"2026-04-28T17:42:50.000Z","title":"WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Ozisti","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28092","published":"2026-03-05T05:54:24.121Z","updated":"2026-04-28T17:42:40.417Z","title":"WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Sounder","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28091","published":"2026-03-05T05:54:23.931Z","updated":"2026-04-28T17:42:30.919Z","title":"WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Coleo","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28090","published":"2026-03-05T05:54:23.740Z","updated":"2026-04-28T17:42:21.848Z","title":"WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gamezone","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28089","published":"2026-03-05T05:54:23.540Z","updated":"2026-04-28T17:42:13.652Z","title":"WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Daiquiri","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28088","published":"2026-03-05T05:54:23.334Z","updated":"2026-04-28T17:42:03.910Z","title":"WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Aqualots","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28087","published":"2026-03-05T05:54:23.147Z","updated":"2026-04-28T17:41:55.435Z","title":"WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Filmax","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28086","published":"2026-03-05T05:54:22.957Z","updated":"2026-04-28T17:41:44.222Z","title":"WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Run Gran","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28085","published":"2026-03-05T05:54:22.767Z","updated":"2026-04-28T17:41:36.151Z","title":"WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Mahogany","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28084","published":"2026-03-05T05:54:22.540Z","updated":"2026-04-28T17:41:25.299Z","title":"WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Bazinga","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28081","published":"2026-03-05T05:54:22.328Z","updated":"2026-04-28T17:41:17.068Z","title":"WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Windsor","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28079","published":"2026-03-05T05:54:22.122Z","updated":"2026-04-28T17:41:06.174Z","title":"WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Conquerors","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28078","published":"2026-03-05T05:54:21.873Z","updated":"2026-04-28T17:40:54.915Z","title":"WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-28077","published":"2026-03-05T05:54:21.615Z","updated":"2026-04-28T17:40:43.558Z","title":"WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Vapester","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28076","published":"2026-03-05T05:54:21.380Z","updated":"2026-04-28T17:40:35.373Z","title":"WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Frenify","product":"Guff","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-28075","published":"2026-03-05T05:54:21.138Z","updated":"2026-04-28T17:40:23.937Z","title":"WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"p-themes","product":"Porto","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28074","published":"2026-03-05T05:54:20.932Z","updated":"2026-04-28T17:40:15.760Z","title":"WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Pizza House","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-28072","published":"2026-03-05T05:54:20.739Z","updated":"2026-04-28T17:40:05.775Z","title":"WordPress pixfort Core plugin <= 3.2.22 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PixFort","product":"pixfort Core","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28071","published":"2026-03-05T05:54:20.538Z","updated":"2026-04-28T17:39:56.102Z","title":"WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"PixFort","product":"pixfort Core","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-28069","published":"2026-03-05T05:54:20.348Z","updated":"2026-04-28T17:39:47.047Z","title":"WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Le Truffe","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28068","published":"2026-03-05T05:54:20.146Z","updated":"2026-04-28T17:39:37.775Z","title":"WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Rhythmo","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28067","published":"2026-03-05T05:54:19.957Z","updated":"2026-04-28T17:39:21.412Z","title":"WordPress Bassein theme <= 1.0.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Bassein","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28066","published":"2026-03-05T05:54:19.780Z","updated":"2026-04-28T17:39:12.353Z","title":"WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Legrand","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28065","published":"2026-03-05T05:54:19.599Z","updated":"2026-04-28T17:39:03.257Z","title":"WordPress Eject theme <= 2.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Eject","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28064","published":"2026-03-05T05:54:19.375Z","updated":"2026-04-28T17:38:54.426Z","title":"WordPress Edge Decor theme <= 2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Edge Decor","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-28063","published":"2026-03-05T05:54:19.186Z","updated":"2026-04-28T17:38:45.398Z","title":"WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Asia Garden","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28062","published":"2026-03-05T05:54:18.978Z","updated":"2026-04-28T17:38:35.994Z","title":"WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Happy Baby","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28061","published":"2026-03-05T05:54:18.780Z","updated":"2026-04-28T17:36:10.759Z","title":"WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Tiger Claw","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28060","published":"2026-03-05T05:54:18.534Z","updated":"2026-04-28T17:36:00.419Z","title":"WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"S.King","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28059","published":"2026-03-05T05:54:18.281Z","updated":"2026-04-28T17:35:50.287Z","title":"WordPress Dermatology Clinic theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Dermatology Clinic","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28058","published":"2026-03-05T05:54:18.112Z","updated":"2026-04-28T17:35:40.588Z","title":"WordPress Dixon theme <= 1.4.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Dixon","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28057","published":"2026-03-05T05:54:17.924Z","updated":"2026-04-28T17:35:31.249Z","title":"WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Mandala","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28056","published":"2026-03-05T05:54:17.743Z","updated":"2026-04-28T17:35:20.041Z","title":"WordPress MCKinney's Politics theme <= 1.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"MCKinney's Politics","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28055","published":"2026-03-05T05:54:17.567Z","updated":"2026-04-28T17:35:09.069Z","title":"WordPress M.Williamson theme <= 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"M.Williamson","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28054","published":"2026-03-05T05:54:17.366Z","updated":"2026-04-28T17:34:58.668Z","title":"WordPress Legal Stone theme <= 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Legal Stone","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28053","published":"2026-03-05T05:54:17.162Z","updated":"2026-04-28T17:34:47.080Z","title":"WordPress Miller theme <= 1.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Miller","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28052","published":"2026-03-05T05:54:16.972Z","updated":"2026-04-28T17:34:32.629Z","title":"WordPress Peter Mason theme <= 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Peter Mason","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28051","published":"2026-03-05T05:54:16.778Z","updated":"2026-04-28T17:34:22.065Z","title":"WordPress Yacht Rental theme <= 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Yacht Rental","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28050","published":"2026-03-05T05:54:16.597Z","updated":"2026-04-28T17:34:12.991Z","title":"WordPress Beacon theme <= 2.24 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Beacon","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-28049","published":"2026-03-05T05:54:16.390Z","updated":"2026-04-28T17:34:03.689Z","title":"WordPress Police Department theme <= 2.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Police Department","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28048","published":"2026-03-05T05:54:16.183Z","updated":"2026-04-28T17:33:54.875Z","title":"WordPress FlashMart theme <= 2.0.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"magentech","product":"FlashMart","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28047","published":"2026-03-05T05:54:16.010Z","updated":"2026-04-28T17:33:45.381Z","title":"WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"magentech","product":"Victo","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28046","published":"2026-03-05T05:54:15.823Z","updated":"2026-04-28T17:33:36.218Z","title":"WordPress Law Office theme <= 3.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Law Office","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28045","published":"2026-03-05T05:54:15.615Z","updated":"2026-04-28T17:33:25.969Z","title":"WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"N7 | Golf Club Sports & Events","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28043","published":"2026-03-05T05:54:15.415Z","updated":"2026-04-28T17:33:16.984Z","title":"WordPress Healer - Doctor, Clinic & Medical WordPress Theme theme <= 1.0.0 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Healer - Doctor, Clinic & Medical WordPress Theme","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2026-28042","published":"2026-03-05T05:54:15.214Z","updated":"2026-04-28T17:33:07.193Z","title":"WordPress Listify plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Astoundify","product":"Listify","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28041","published":"2026-03-05T05:54:14.988Z","updated":"2026-04-28T17:32:56.553Z","title":"WordPress Grit theme <= 1.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Grit","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28039","published":"2026-03-05T05:54:14.794Z","updated":"2026-10-27T07:00:54.536Z","title":"WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"TMS","product":"wpDataTables","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-28038","published":"2026-03-05T05:54:14.595Z","updated":"2026-04-28T17:32:37.827Z","title":"WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm_Force","product":"Ultimate Addons for WPBakery Page Builder","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-28037","published":"2026-03-05T05:54:14.384Z","updated":"2026-04-28T17:32:28.488Z","title":"WordPress EventON plugin <= 4.9.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ashanjay","product":"EventON","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-28036","published":"2026-03-05T05:54:14.141Z","updated":"2026-04-28T17:32:18.546Z","title":"WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"SkatDesign","product":"Ratatouille","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-28035","published":"2026-03-05T05:54:13.960Z","updated":"2026-04-28T17:32:10.112Z","title":"WordPress Printy theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Printy","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28034","published":"2026-03-05T05:54:13.781Z","updated":"2026-04-28T17:32:00.312Z","title":"WordPress Progress theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Progress","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28033","published":"2026-03-05T05:54:13.558Z","updated":"2026-04-28T17:31:51.500Z","title":"WordPress Edifice theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Edifice","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28032","published":"2026-03-05T05:54:13.068Z","updated":"2026-04-28T17:31:40.153Z","title":"WordPress Tuning theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Tuning","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28031","published":"2026-03-05T05:54:12.795Z","updated":"2026-04-28T17:31:29.178Z","title":"WordPress Invetex theme <= 2.18 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Invetex","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28030","published":"2026-03-05T05:54:12.578Z","updated":"2026-04-28T17:31:20.746Z","title":"WordPress Bonbon theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Bonbon","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-28029","published":"2026-03-05T05:54:12.360Z","updated":"2026-04-28T17:31:10.500Z","title":"WordPress EmojiNation theme <= 1.0.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"EmojiNation","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28028","published":"2026-03-05T05:54:12.174Z","updated":"2026-04-28T17:31:01.215Z","title":"WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"MoneyFlow","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28027","published":"2026-03-05T05:54:11.997Z","updated":"2026-04-28T17:30:51.979Z","title":"WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Kayon","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28026","published":"2026-03-05T05:54:11.791Z","updated":"2026-04-28T17:30:42.348Z","title":"WordPress Motorix theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Motorix","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28025","published":"2026-03-05T05:54:11.576Z","updated":"2026-04-28T17:30:31.972Z","title":"WordPress Stargaze theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Stargaze","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28024","published":"2026-03-05T05:54:11.297Z","updated":"2026-04-28T17:30:22.283Z","title":"WordPress Helion theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Helion","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28023","published":"2026-03-05T05:54:11.094Z","updated":"2026-04-28T17:30:13.224Z","title":"WordPress Nuts theme <= 1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Nuts","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28022","published":"2026-03-05T05:54:10.847Z","updated":"2026-04-28T17:29:58.680Z","title":"WordPress Foodie theme <= 1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Foodie","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28021","published":"2026-03-05T05:54:10.626Z","updated":"2026-04-28T17:29:49.417Z","title":"WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Craftis","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-28020","published":"2026-03-05T05:54:10.388Z","updated":"2026-04-28T17:29:38.346Z","title":"WordPress Chroma theme <= 1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Chroma","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28019","published":"2026-03-05T05:54:10.132Z","updated":"2026-04-28T17:26:08.447Z","title":"WordPress Manoir theme <= 1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Manoir","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28018","published":"2026-03-05T05:54:09.917Z","updated":"2026-04-28T17:26:00.137Z","title":"WordPress Global Logistics theme <= 3.20 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Global Logistics","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28017","published":"2026-03-05T05:54:09.348Z","updated":"2026-04-28T17:25:51.694Z","title":"WordPress Green Thumb theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Green Thumb","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28016","published":"2026-03-05T05:54:09.165Z","updated":"2026-04-28T17:25:42.826Z","title":"WordPress Luxury Wine theme <= 1.1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Luxury Wine","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28015","published":"2026-03-05T05:54:08.984Z","updated":"2026-04-28T17:25:33.824Z","title":"WordPress ShiftCV theme <= 3.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"ShiftCV","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28014","published":"2026-03-05T05:54:08.775Z","updated":"2026-04-28T17:25:25.348Z","title":"WordPress Translogic theme <= 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Translogic","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-28013","published":"2026-03-05T05:54:08.591Z","updated":"2026-04-28T17:25:16.997Z","title":"WordPress Kratz theme <= 1.0.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Kratz","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28012","published":"2026-03-05T05:54:08.395Z","updated":"2026-04-28T17:25:08.568Z","title":"WordPress Gridiron theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gridiron","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28011","published":"2026-03-05T05:54:08.158Z","updated":"2026-04-28T17:24:59.642Z","title":"WordPress Yottis theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Yottis","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-28010","published":"2026-03-05T05:54:07.893Z","updated":"2026-04-28T17:24:51.121Z","title":"WordPress Scientia theme <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Scientia","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28009","published":"2026-03-05T05:54:07.668Z","updated":"2026-04-28T17:24:42.125Z","title":"WordPress DroneX theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"DroneX","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28007","published":"2026-03-05T05:54:07.474Z","updated":"2026-04-28T17:24:33.714Z","title":"WordPress Coinpress theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Coinpress","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-28006","published":"2026-03-05T05:54:07.274Z","updated":"2026-04-28T17:24:25.224Z","title":"WordPress Yungen theme <= 1.0.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Yungen","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-27998","published":"2026-03-05T05:54:07.077Z","updated":"2026-04-28T16:46:29.568Z","title":"WordPress Vixus theme <= 1.0.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Vixus","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-27997","published":"2026-03-05T05:54:06.887Z","updated":"2026-04-28T16:46:20.923Z","title":"WordPress Maxify theme <= 1.0.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Maxify","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-27996","published":"2026-03-05T05:54:06.719Z","updated":"2026-04-28T16:46:12.610Z","title":"WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Lingvico","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27995","published":"2026-03-05T05:54:06.537Z","updated":"2026-04-28T16:46:04.176Z","title":"WordPress Justitia theme <= 1.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Justitia","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27994","published":"2026-03-05T05:54:06.343Z","updated":"2026-04-28T16:45:55.820Z","title":"WordPress Tediss theme <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Tediss","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27993","published":"2026-03-05T05:54:06.102Z","updated":"2026-04-28T16:45:47.052Z","title":"WordPress Aldo theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Aldo","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27992","published":"2026-03-05T05:54:05.910Z","updated":"2026-04-28T16:45:38.405Z","title":"WordPress Meals & Wheels theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Meals & Wheels","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-27991","published":"2026-03-05T05:54:05.713Z","updated":"2026-04-28T16:45:29.998Z","title":"WordPress Avventure theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Avventure","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27990","published":"2026-03-05T05:54:05.485Z","updated":"2026-04-28T16:45:21.751Z","title":"WordPress ConFix theme <= 1.013 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"ConFix","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27989","published":"2026-03-05T05:54:05.123Z","updated":"2026-04-28T16:45:12.986Z","title":"WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Quanzo","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27988","published":"2026-03-05T05:54:04.846Z","updated":"2026-04-28T16:45:04.564Z","title":"WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Equadio","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27987","published":"2026-03-05T05:54:04.405Z","updated":"2026-04-28T16:44:55.179Z","title":"WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"The Qlean","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-27986","published":"2026-03-05T05:54:04.106Z","updated":"2026-04-28T16:44:46.576Z","title":"WordPress OsTende theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"OsTende","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27985","published":"2026-03-05T05:54:03.890Z","updated":"2026-04-28T16:44:38.182Z","title":"WordPress Humanum theme <= 1.1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Humanum","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27984","published":"2026-03-05T05:54:03.700Z","updated":"2026-04-28T16:44:29.910Z","title":"WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9,"vendor":"Marketing Fire","product":"Widget Options","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-27983","published":"2026-03-05T05:54:03.452Z","updated":"2026-04-28T16:15:03.560Z","title":"WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"designthemes","product":"LMS Elementor Pro","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-27541","published":"2026-03-05T05:54:03.112Z","updated":"2026-04-29T09:51:57.127Z","title":"WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Josh Kohlbach","product":"Wholesale Suite","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-27439","published":"2026-03-05T05:54:02.747Z","updated":"2026-04-28T16:15:03.183Z","title":"WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Dentario","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-27438","published":"2026-03-05T05:54:01.401Z","updated":"2026-04-28T16:15:03.172Z","title":"WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Kingler","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-27437","published":"2026-03-05T05:54:01.091Z","updated":"2026-04-28T16:15:03.572Z","title":"WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Tennis Club","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-27428","published":"2026-03-05T05:54:00.898Z","updated":"2026-04-28T16:15:03.184Z","title":"WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Eagle-Themes","product":"Eagle Booking","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-27417","published":"2026-03-05T05:54:00.710Z","updated":"2026-04-28T16:15:03.093Z","title":"WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"SeventhQueen","product":"Sweet Date","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-27411","published":"2026-03-05T05:54:00.517Z","updated":"2026-04-29T09:51:56.875Z","title":"WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability","severity":"MEDIUM","score":5.4,"vendor":"jp-secure","product":"SiteGuard WP Plugin","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-27406","published":"2026-03-05T05:53:59.993Z","updated":"2026-04-29T09:51:56.874Z","title":"WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Joe Dolson","product":"My Tickets","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-27396","published":"2026-03-05T05:53:59.803Z","updated":"2026-04-28T16:15:03.088Z","title":"WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-27390","published":"2026-03-05T05:53:59.606Z","updated":"2026-04-28T16:15:02.940Z","title":"WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"WeDesignTech Ultimate Booking Addon","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-27389","published":"2026-03-05T05:53:59.344Z","updated":"2026-04-28T16:15:02.962Z","title":"WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"designthemes","product":"WeDesignTech Ultimate Booking Addon","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-27388","published":"2026-03-05T05:53:59.120Z","updated":"2026-04-28T16:15:03.136Z","title":"WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"designthemes","product":"DesignThemes Booking Manager","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-27386","published":"2026-03-05T05:53:58.932Z","updated":"2026-04-28T16:15:02.940Z","title":"WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"designthemes","product":"DesignThemes Directory Addon","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-27385","published":"2026-03-05T05:53:58.742Z","updated":"2026-04-28T16:15:02.893Z","title":"WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"DesignThemes Portfolio","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27384","published":"2026-03-05T05:53:58.537Z","updated":"2026-04-29T09:51:57.156Z","title":"WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9,"vendor":"BoldGrid","product":"W3 Total Cache","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-27383","published":"2026-03-05T05:53:58.330Z","updated":"2026-04-28T16:15:02.575Z","title":"WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"RadiusTheme","product":"Metro","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-27382","published":"2026-03-05T05:53:58.133Z","updated":"2026-04-28T16:15:02.818Z","title":"WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Metro","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-27381","published":"2026-03-05T05:53:57.141Z","updated":"2026-04-28T16:15:02.547Z","title":"WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Aora","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27379","published":"2026-03-05T05:53:56.951Z","updated":"2026-04-28T16:15:02.763Z","title":"WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"NextScripts","product":"NextScripts","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-27376","published":"2026-03-05T05:53:56.747Z","updated":"2026-04-28T16:15:02.699Z","title":"WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"JanStudio","product":"Claue - Clean, Minimal Elementor WooCommerce Theme","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27375","published":"2026-03-05T05:53:56.554Z","updated":"2026-04-28T16:15:02.713Z","title":"WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"JanStudio","product":"Gecko","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27374","published":"2026-03-05T05:53:56.379Z","updated":"2026-04-28T16:15:02.568Z","title":"WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"vanquish","product":"WooCommerce Order Details","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-27373","published":"2026-03-05T05:53:56.198Z","updated":"2026-04-28T16:15:02.520Z","title":"WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Essekia","product":"Tablesome","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-27370","published":"2026-03-05T05:53:55.991Z","updated":"2026-04-29T09:51:57.065Z","title":"WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Premio","product":"Chaty","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-27369","published":"2026-03-05T05:53:55.756Z","updated":"2026-04-28T16:15:02.417Z","title":"WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"BoldThemes","product":"Celeste","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-27367","published":"2026-03-05T05:53:55.265Z","updated":"2026-04-28T16:15:02.389Z","title":"WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Musico","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27363","published":"2026-03-05T05:53:55.033Z","updated":"2026-04-28T16:15:02.340Z","title":"WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kamleshyadav","product":"WP Bakery Autoresponder Addon","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27362","published":"2026-03-05T05:53:54.793Z","updated":"2026-04-28T16:15:02.484Z","title":"WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kamleshyadav","product":"WP Bakery Autoresponder Addon","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-27361","published":"2026-03-05T05:53:54.588Z","updated":"2026-04-28T16:15:02.171Z","title":"WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WebCodingPlace","product":"Responsive Posts Carousel Pro","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-27359","published":"2026-03-05T05:53:54.321Z","updated":"2026-04-28T16:15:02.365Z","title":"WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fox-themes","product":"Awa Plugins","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27358","published":"2026-03-05T05:53:54.072Z","updated":"2026-04-28T16:15:02.216Z","title":"WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Architecturer","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27354","published":"2026-03-05T05:53:53.894Z","updated":"2026-04-28T16:15:02.216Z","title":"WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WebCodingPlace","product":"WooCommerce Coming Soon Product with Countdown","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-27353","published":"2026-03-05T05:53:53.733Z","updated":"2026-04-28T16:15:02.212Z","title":"WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand News","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27352","published":"2026-03-05T05:53:53.546Z","updated":"2026-04-28T16:15:02.134Z","title":"WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Starto","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-27348","published":"2026-03-05T05:53:53.365Z","updated":"2026-04-28T16:15:02.156Z","title":"WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-27344","published":"2026-03-05T05:53:53.188Z","updated":"2026-04-28T16:15:02.137Z","title":"WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"inseriswiss","product":"inseri core","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-27342","published":"2026-03-05T05:53:52.944Z","updated":"2026-04-28T16:15:02.151Z","title":"WordPress TopFit - Fitness and Gym WordPress Theme theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TopFit - Fitness and Gym WordPress Theme","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-27341","published":"2026-03-05T05:53:52.713Z","updated":"2026-04-28T16:15:02.083Z","title":"WordPress TopScorer - Sports WordPress Theme theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TopScorer - Sports WordPress Theme","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-27340","published":"2026-03-05T05:53:52.325Z","updated":"2026-04-28T16:15:02.041Z","title":"WordPress Apollo | Night Club, DJ Event WordPress Theme theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Apollo | Night Club, DJ Event WordPress Theme","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27339","published":"2026-03-05T05:53:52.097Z","updated":"2026-04-28T16:15:02.080Z","title":"WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27338","published":"2026-03-05T05:53:51.887Z","updated":"2026-04-28T16:15:02.036Z","title":"WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"AivahThemes","product":"Car Zone","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-27337","published":"2026-03-05T05:53:51.696Z","updated":"2026-04-28T16:15:01.916Z","title":"WordPress Chronicle - Lifestyle Magazine & Blog WordPress Theme theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Chronicle - Lifestyle Magazine & Blog WordPress Theme","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-27336","published":"2026-03-05T05:53:51.498Z","updated":"2026-04-28T16:15:01.913Z","title":"WordPress Consultor | Consulting, Accounting & Legal Counsel WordPress Theme theme <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Consultor | Consulting, Accounting & Legal Counsel WordPress Theme","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27335","published":"2026-03-05T05:53:51.227Z","updated":"2026-04-28T16:15:01.900Z","title":"WordPress Ekoterra - NonProfit, Green Energy & Ecology Theme theme <= 1.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Ekoterra - NonProfit, Green Energy & Ecology Theme","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27334","published":"2026-03-05T05:53:50.970Z","updated":"2026-04-28T16:15:01.899Z","title":"WordPress Alchemists theme <= 4.6.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"dan_fisher","product":"Alchemists","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27332","published":"2026-03-05T05:53:50.791Z","updated":"2026-04-28T16:15:01.793Z","title":"WordPress Agrofood theme < 1.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Agrofood","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-27326","published":"2026-03-05T05:53:50.615Z","updated":"2026-04-28T16:15:01.792Z","title":"WordPress AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme theme <= 1.2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-27098","published":"2026-03-05T05:53:50.427Z","updated":"2026-04-28T16:15:01.888Z","title":"WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Au Pair Agency - Babysitting & Nanny Theme","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-27097","published":"2026-03-05T05:53:50.204Z","updated":"2026-04-28T16:15:01.680Z","title":"WordPress CasaMia | Property Rental Real Estate WordPress Theme theme <= 1.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CasaMia | Property Rental Real Estate WordPress Theme","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-24963","published":"2026-03-05T05:53:49.963Z","updated":"2026-04-28T16:14:52.063Z","title":"WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"ameliabooking","product":"Amelia","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-24960","published":"2026-03-05T05:53:49.748Z","updated":"2026-04-28T16:14:51.940Z","title":"WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Charety","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-24385","published":"2026-03-05T05:53:49.345Z","updated":"2026-04-28T16:14:48.530Z","title":"WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"gerritvanaaken","product":"Podlove Web Player","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-23802","published":"2026-03-05T05:53:49.148Z","updated":"2026-04-28T16:14:47.357Z","title":"WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Jordy Meow","product":"AI Engine","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-23801","published":"2026-03-05T05:53:48.966Z","updated":"2026-04-28T16:14:47.079Z","title":"WordPress The Issue theme <= 1.6.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"fuelthemes","product":"The Issue","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-23799","published":"2026-03-05T05:53:48.754Z","updated":"2026-04-28T16:14:46.898Z","title":"WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-23798","published":"2026-03-05T05:53:48.543Z","updated":"2026-04-28T16:14:46.858Z","title":"WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-23546","published":"2026-03-05T05:53:48.361Z","updated":"2026-04-28T16:14:46.840Z","title":"WordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-22501","published":"2026-03-05T05:53:48.161Z","updated":"2026-04-28T17:21:11.574Z","title":"WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Mounthood","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22497","published":"2026-03-05T05:53:47.948Z","updated":"2026-04-28T17:20:36.984Z","title":"WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Jardi","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22479","published":"2026-03-05T05:53:47.776Z","updated":"2026-04-28T17:18:53.507Z","title":"WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeRuby","product":"Easy Post Submission","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-22478","published":"2026-03-05T05:53:47.583Z","updated":"2026-04-28T17:18:45.264Z","title":"WordPress FindAll theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"FindAll","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22477","published":"2026-03-05T05:53:47.385Z","updated":"2026-04-28T17:18:36.850Z","title":"WordPress Felizia theme <= 1.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Felizia","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22476","published":"2026-03-05T05:53:47.083Z","updated":"2026-04-28T17:18:28.078Z","title":"WordPress Etchy theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Etchy","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22475","published":"2026-03-05T05:53:46.895Z","updated":"2026-04-28T17:18:19.761Z","title":"WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Estate","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-22474","published":"2026-03-05T05:53:46.712Z","updated":"2026-04-28T17:18:11.322Z","title":"WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Equestrian Centre","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-22473","published":"2026-03-05T05:53:46.541Z","updated":"2026-04-28T17:18:02.741Z","title":"WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Dental Clinic","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-22471","published":"2026-03-05T05:53:46.338Z","updated":"2026-04-28T17:17:43.919Z","title":"WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"maximsecudeal","product":"Secudeal Payments for Ecommerce","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-22467","published":"2026-03-05T05:53:46.108Z","updated":"2026-04-28T17:17:09.304Z","title":"WordPress DeepDigital theme <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mwtemplates","product":"DeepDigital","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-22465","published":"2026-03-05T05:53:45.914Z","updated":"2026-04-28T17:16:51.637Z","title":"WordPress BuddyApp theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SeventhQueen","product":"BuddyApp","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-22460","published":"2026-03-05T05:53:45.703Z","updated":"2026-04-28T17:16:09.852Z","title":"WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"wpWax","product":"FormGent","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-22459","published":"2026-03-05T05:53:45.404Z","updated":"2026-04-28T17:16:01.577Z","title":"WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Blend Media","product":"WordPress CTA","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-22457","published":"2026-03-05T05:53:44.994Z","updated":"2026-04-28T17:15:44.462Z","title":"WordPress Wanderland theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Wanderland","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22456","published":"2026-03-05T05:53:44.769Z","updated":"2026-04-28T17:15:35.532Z","title":"WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Askka","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22455","published":"2026-03-05T05:53:44.531Z","updated":"2026-04-28T17:15:26.701Z","title":"WordPress Thebe theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"foreverpinetree","product":"Thebe","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-22454","published":"2026-03-05T05:53:44.299Z","updated":"2026-04-28T17:15:18.382Z","title":"WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Solaris","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22453","published":"2026-03-05T05:53:44.072Z","updated":"2026-04-28T17:15:10.127Z","title":"WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Pets Club","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22452","published":"2026-03-05T05:53:43.856Z","updated":"2026-04-28T17:15:02.223Z","title":"WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Hoverex","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22451","published":"2026-03-05T05:53:43.605Z","updated":"2026-04-28T17:14:52.387Z","title":"WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Handyman","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22449","published":"2026-03-05T05:53:43.390Z","updated":"2026-04-28T17:12:16.813Z","title":"WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Don Peppe","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22446","published":"2026-03-05T05:53:43.168Z","updated":"2026-04-28T17:11:50.825Z","title":"WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Prowess","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22443","published":"2026-03-05T05:53:42.874Z","updated":"2026-04-28T17:11:34.045Z","title":"WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Alliance","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22442","published":"2026-03-05T05:53:41.965Z","updated":"2026-04-28T17:11:25.747Z","title":"WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"LaunchandSell","product":"Tribe","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22441","published":"2026-03-05T05:53:41.690Z","updated":"2026-04-28T17:11:17.518Z","title":"WordPress Zentrum theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Zentrum","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22440","published":"2026-03-05T05:53:41.426Z","updated":"2026-04-28T17:11:09.153Z","title":"WordPress Thecs theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"foreverpinetree","product":"Thecs","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-22439","published":"2026-03-05T05:53:41.203Z","updated":"2026-04-28T17:11:00.846Z","title":"WordPress Green Planet theme <= 1.1.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Green Planet","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22438","published":"2026-03-05T05:53:41.015Z","updated":"2026-04-28T17:10:52.452Z","title":"WordPress TheBi theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"foreverpinetree","product":"TheBi","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-22437","published":"2026-03-05T05:53:40.779Z","updated":"2026-04-28T17:10:43.919Z","title":"WordPress Playa theme <= 1.3.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Playa","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22436","published":"2026-03-05T05:53:40.548Z","updated":"2026-04-28T17:10:35.571Z","title":"WordPress Helvig theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Helvig","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22435","published":"2026-03-05T05:53:40.225Z","updated":"2026-04-28T17:10:27.329Z","title":"WordPress ElectroServ theme <= 1.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"ElectroServ","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22434","published":"2026-03-05T05:53:40.011Z","updated":"2026-04-28T17:10:18.877Z","title":"WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Crown Art","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22433","published":"2026-03-05T05:53:39.822Z","updated":"2026-04-28T17:10:10.569Z","title":"WordPress CloudMe theme <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CloudMe","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22432","published":"2026-03-05T05:53:39.607Z","updated":"2026-04-28T17:10:02.424Z","title":"WordPress Woopy theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Woopy","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22431","published":"2026-03-05T05:53:39.378Z","updated":"2026-04-28T17:09:53.697Z","title":"WordPress Wabi-Sabi theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Wabi-Sabi","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22429","published":"2026-03-05T05:53:39.199Z","updated":"2026-04-28T17:09:35.919Z","title":"WordPress Verdure theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Verdure","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22428","published":"2026-03-05T05:53:38.981Z","updated":"2026-04-28T17:09:27.440Z","title":"WordPress Tooth Fairy theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Tooth Fairy","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-22427","published":"2026-03-05T05:53:38.789Z","updated":"2026-04-28T17:09:18.542Z","title":"WordPress GoTravel theme <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"GoTravel","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22425","published":"2026-03-05T05:53:38.603Z","updated":"2026-04-28T17:09:01.681Z","title":"WordPress Sweet Jane theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Sweet Jane","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22424","published":"2026-03-05T05:53:38.378Z","updated":"2026-04-28T17:08:53.331Z","title":"WordPress Shaha theme <= 1.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Shaha","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22423","published":"2026-03-05T05:53:38.170Z","updated":"2026-04-28T17:08:44.899Z","title":"WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"SetSail","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22421","published":"2026-03-05T05:53:37.975Z","updated":"2026-04-28T17:08:27.590Z","title":"WordPress Quantum theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Quantum","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22420","published":"2026-03-05T05:53:37.779Z","updated":"2026-04-28T17:08:18.024Z","title":"WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Horizon","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22419","published":"2026-03-05T05:53:37.592Z","updated":"2026-04-28T17:08:09.512Z","title":"WordPress Honor theme <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Honor","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22418","published":"2026-03-05T05:53:37.410Z","updated":"2026-04-28T17:08:00.647Z","title":"WordPress Great Lotus theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Great Lotus","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22417","published":"2026-03-05T05:53:37.223Z","updated":"2026-04-28T17:07:53.950Z","title":"WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Wedding","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-22416","published":"2026-03-05T05:53:36.994Z","updated":"2026-04-28T17:07:42.897Z","title":"WordPress FixTeam theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"FixTeam","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22415","published":"2026-03-05T05:53:36.786Z","updated":"2026-04-28T17:07:34.483Z","title":"WordPress The Mounty theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"The Mounty","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22414","published":"2026-03-05T05:53:36.590Z","updated":"2026-04-28T17:07:24.486Z","title":"WordPress Marra theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Marra","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22413","published":"2026-03-05T05:53:36.410Z","updated":"2026-04-28T17:07:16.098Z","title":"WordPress Malgré theme <= 1.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Malgré","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22412","published":"2026-03-05T05:53:36.229Z","updated":"2026-04-28T17:07:07.740Z","title":"WordPress Eona theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Eona","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22410","published":"2026-03-05T05:53:36.038Z","updated":"2026-04-28T17:06:50.207Z","title":"WordPress Dolcino theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Dolcino","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22408","published":"2026-03-05T05:53:35.841Z","updated":"2026-04-28T16:56:53.346Z","title":"WordPress Justicia theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Justicia","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22405","published":"2026-03-05T05:53:35.640Z","updated":"2026-04-28T16:56:28.306Z","title":"WordPress Overton theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Overton","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22403","published":"2026-03-05T05:53:35.418Z","updated":"2026-04-28T16:56:11.619Z","title":"WordPress Innovio theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Innovio","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22399","published":"2026-03-05T05:53:34.776Z","updated":"2026-04-28T16:55:37.310Z","title":"WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Holmes","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22397","published":"2026-03-05T05:53:34.263Z","updated":"2026-04-28T16:55:20.836Z","title":"WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Fleur","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22395","published":"2026-03-05T05:53:34.064Z","updated":"2026-04-28T16:55:04.141Z","title":"WordPress Fiorello theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Fiorello","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22394","published":"2026-03-05T05:53:33.845Z","updated":"2026-04-28T16:54:55.263Z","title":"WordPress Evently theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Evently","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22392","published":"2026-03-05T05:53:33.656Z","updated":"2026-04-28T16:54:38.430Z","title":"WordPress Cortex theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Cortex","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22390","published":"2026-03-05T05:53:33.444Z","updated":"2026-04-28T16:54:21.317Z","title":"WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Builderall","product":"Builderall Builder for WordPress","kev":false,"epss":0.00545,"kevAdded":null},{"id":"CVE-2026-22389","published":"2026-03-05T05:53:33.113Z","updated":"2026-04-28T16:54:12.913Z","title":"WordPress Cocco theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Cocco","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22387","published":"2026-03-05T05:53:32.906Z","updated":"2026-04-28T16:53:55.592Z","title":"WordPress Aviana theme <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Aviana","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22385","published":"2026-03-05T05:53:32.704Z","updated":"2026-04-28T16:53:47.563Z","title":"WordPress Wolmart theme <= 1.9.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"don-themes","product":"Wolmart","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2025-69411","published":"2026-03-05T05:53:32.372Z","updated":"2026-04-28T21:01:54.552Z","title":"WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Robert Seyfriedsberger","product":"ionCube tester plus","kev":false,"epss":0.01743,"kevAdded":null},{"id":"CVE-2025-69343","published":"2026-03-05T05:53:32.181Z","updated":"2026-04-28T20:54:34.061Z","title":"WordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeroen Schmit","product":"Theater for WordPress","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-69340","published":"2026-03-05T05:53:32.008Z","updated":"2026-04-28T16:14:37.892Z","title":"WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"BuddhaThemes","product":"WeDesignTech Ultimate Booking Addon","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2025-69339","published":"2026-03-05T05:53:31.769Z","updated":"2026-04-28T20:54:14.921Z","title":"WordPress Molla theme <= 1.5.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"don-themes","product":"Molla","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-69338","published":"2026-03-05T05:53:31.406Z","updated":"2026-04-28T20:54:06.365Z","title":"WordPress Riode Core plugin <= 1.6.26 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"don-themes","product":"Riode Core","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-69090","published":"2026-03-05T05:53:31.140Z","updated":"2026-04-28T20:41:57.076Z","title":"WordPress Remons theme <= 1.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"Remons","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-68555","published":"2026-03-05T05:53:30.942Z","updated":"2026-04-28T20:02:04.337Z","title":"WordPress Nutrie theme < 2.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Nutrie","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-68554","published":"2026-03-05T05:53:30.741Z","updated":"2026-04-28T20:01:55.199Z","title":"WordPress Keenarch theme < 2.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Keenarch","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-68553","published":"2026-03-05T05:53:30.558Z","updated":"2026-04-28T20:01:45.918Z","title":"WordPress Lendiz theme < 2.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Lendiz","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2025-68515","published":"2026-03-05T05:53:30.344Z","updated":"2026-04-29T09:51:56.604Z","title":"WordPress WP Booking System plugin <= 2.0.19.12 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Roland Murg","product":"WP Booking System","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-54001","published":"2026-03-05T05:53:29.753Z","updated":"2026-04-28T18:44:51.756Z","title":"WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Classter","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2025-53335","published":"2026-03-05T05:53:29.472Z","updated":"2026-04-28T19:12:49.642Z","title":"WordPress Berger theme <= 1.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Berger","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-28138","published":"2026-02-26T08:33:37.089Z","updated":"2026-04-28T16:15:09.459Z","title":"WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2026-28136","published":"2026-02-26T08:33:36.839Z","updated":"2026-04-28T16:15:09.344Z","title":"WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"VeronaLabs","product":"WP SMS","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-28132","published":"2026-02-26T08:33:36.653Z","updated":"2026-04-28T16:15:09.150Z","title":"WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"villatheme","product":"WooCommerce Photo Reviews","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-28131","published":"2026-02-26T08:33:36.436Z","updated":"2026-04-28T16:15:09.215Z","title":"WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-28083","published":"2026-02-26T08:33:36.172Z","updated":"2026-04-28T16:15:07.092Z","title":"WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UX-themes","product":"Flatsome","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-3075","published":"2026-02-23T20:48:13.276Z","updated":"2026-04-28T16:15:09.450Z","title":"WordPress Simple Ajax Chat plugin <= 20251121 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jeff Starr","product":"Simple Ajax Chat","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-27072","published":"2026-02-20T15:47:09.356Z","updated":"2026-04-28T16:15:01.074Z","title":"WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PixelYourSite","product":"PixelYourSite – Your smart PIXEL (TAG) Manager","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-24959","published":"2026-02-20T15:47:09.159Z","updated":"2026-04-28T16:14:51.842Z","title":"WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-24956","published":"2026-02-20T15:47:08.982Z","updated":"2026-04-28T16:14:51.877Z","title":"WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shahjada","product":"Download Manager Addons for Elementor","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-24955","published":"2026-02-20T15:47:08.808Z","updated":"2026-04-28T16:14:51.787Z","title":"WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fox-themes","product":"Whizz Plugins","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-24953","published":"2026-02-20T15:47:08.637Z","updated":"2026-04-28T16:14:51.277Z","title":"WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-24950","published":"2026-02-20T15:47:08.471Z","updated":"2026-04-28T16:14:51.219Z","title":"WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"themeplugs","product":"Authorsy","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-24949","published":"2026-02-20T15:47:08.290Z","updated":"2026-04-28T16:14:51.260Z","title":"WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"PhotoMe","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-24948","published":"2026-02-20T15:47:08.086Z","updated":"2026-04-28T16:14:51.242Z","title":"WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fox-themes","product":"Reflector","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-24946","published":"2026-02-20T15:47:07.869Z","updated":"2026-04-28T16:14:51.257Z","title":"WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tychesoftwares","product":"Print Invoice & Delivery Notes for WooCommerce","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-24944","published":"2026-02-20T15:47:07.681Z","updated":"2026-04-28T17:44:25.298Z","title":"WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Subscribe2","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-24943","published":"2026-02-20T15:47:07.483Z","updated":"2026-04-28T16:14:51.159Z","title":"WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Conference","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-24941","published":"2026-02-20T15:47:07.258Z","updated":"2026-04-28T16:14:50.960Z","title":"WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-22384","published":"2026-02-20T15:47:07.059Z","updated":"2026-04-28T16:53:38.560Z","title":"WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"leafcolor","product":"Applay - Shortcodes","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-22383","published":"2026-02-20T15:47:06.889Z","updated":"2026-04-28T16:53:30.297Z","title":"WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Mikado-Themes","product":"PawFriends - Pet Shop and Veterinary WordPress Theme","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-22381","published":"2026-02-20T15:47:06.708Z","updated":"2026-04-28T16:53:13.228Z","title":"WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"PawFriends - Pet Shop and Veterinary WordPress Theme","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22380","published":"2026-02-20T15:47:06.532Z","updated":"2026-04-28T16:53:05.111Z","title":"WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"UnlimHost","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22379","published":"2026-02-20T15:47:06.345Z","updated":"2026-04-28T16:52:56.318Z","title":"WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Netmix","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-22378","published":"2026-02-20T15:47:06.131Z","updated":"2026-04-28T16:52:47.573Z","title":"WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Blabber","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22377","published":"2026-02-20T15:47:05.960Z","updated":"2026-04-28T16:52:39.152Z","title":"WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Saveo","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22376","published":"2026-02-20T15:47:05.786Z","updated":"2026-04-28T16:52:30.706Z","title":"WordPress Parkivia theme <= 1.1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Parkivia","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2026-22375","published":"2026-02-20T15:47:05.586Z","updated":"2026-04-28T16:52:22.545Z","title":"WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Impacto Patronus","kev":false,"epss":0.00531,"kevAdded":null},{"id":"CVE-2026-22374","published":"2026-02-20T15:47:05.388Z","updated":"2026-04-28T16:52:13.999Z","title":"WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Zio Alberto","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22373","published":"2026-02-20T15:47:05.132Z","updated":"2026-04-28T16:52:05.010Z","title":"WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Fooddy","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-22372","published":"2026-02-20T15:47:04.323Z","updated":"2026-04-28T16:51:56.626Z","title":"WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Isida","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-22371","published":"2026-02-20T15:47:04.076Z","updated":"2026-04-28T16:51:48.269Z","title":"WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Gustavo","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-22370","published":"2026-02-20T15:47:03.894Z","updated":"2026-04-28T16:51:39.914Z","title":"WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Marveland","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22369","published":"2026-02-20T15:47:03.701Z","updated":"2026-04-28T16:51:31.489Z","title":"WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Ironfit","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-22368","published":"2026-02-20T15:47:03.522Z","updated":"2026-04-28T16:51:23.605Z","title":"WordPress Redy theme <= 1.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Redy","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22367","published":"2026-02-20T15:47:03.323Z","updated":"2026-04-28T16:50:02.872Z","title":"WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Coworking","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2026-22366","published":"2026-02-20T15:47:03.079Z","updated":"2026-04-28T16:49:53.970Z","title":"WordPress Jude theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Jude","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-22365","published":"2026-02-20T15:47:02.847Z","updated":"2026-04-28T16:49:45.051Z","title":"WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Soleng","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22364","published":"2026-02-20T15:47:02.663Z","updated":"2026-04-28T16:49:36.578Z","title":"WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"SevenTrees","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22363","published":"2026-02-20T15:47:02.437Z","updated":"2026-04-28T16:49:28.328Z","title":"WordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Rhodos","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-22362","published":"2026-02-20T15:47:02.172Z","updated":"2026-04-28T16:49:19.714Z","title":"WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Photolia","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-22361","published":"2026-02-20T15:47:01.916Z","updated":"2026-04-28T16:49:11.243Z","title":"WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"A-Mart","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-22357","published":"2026-02-20T15:47:01.629Z","updated":"2026-04-28T16:48:46.225Z","title":"WordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spencer Haws","product":"Link Whisper Free","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-22356","published":"2026-02-20T15:47:01.362Z","updated":"2026-11-03T22:13:21.656Z","title":"WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Automattic","product":"Jetpack CRM","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-22354","published":"2026-02-20T15:47:01.099Z","updated":"2026-04-28T16:48:20.045Z","title":"WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Dotstore","product":"Woocommerce Category Banner Management","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-22352","published":"2026-02-20T15:47:00.914Z","updated":"2026-04-28T16:48:04.130Z","title":"WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PersianScript","product":"Persian Woocommerce SMS","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-22351","published":"2026-02-20T15:47:00.722Z","updated":"2026-04-28T16:47:54.145Z","title":"WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Marcus (aka @msykes)","product":"WP FullCalendar","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-22350","published":"2026-02-20T15:47:00.543Z","updated":"2026-04-28T16:47:45.754Z","title":"WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"add-ons.org","product":"PDF for Elementor Forms + Drag And Drop Template Builder","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-22346","published":"2026-02-20T15:47:00.213Z","updated":"2026-04-28T16:47:12.263Z","title":"WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"A WP Life","product":"Slider Responsive Slideshow – Image slider, Gallery slideshow","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-22345","published":"2026-02-20T15:46:59.892Z","updated":"2026-04-28T16:47:03.594Z","title":"WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"A WP Life","product":"Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-22344","published":"2026-02-20T15:46:59.662Z","updated":"2026-04-28T16:46:55.185Z","title":"WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"FiveStar","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-22341","published":"2026-02-20T15:46:59.242Z","updated":"2026-04-28T16:46:46.228Z","title":"WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability","severity":"MEDIUM","score":6.7,"vendor":"Case-Themes","product":"Booked","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2025-69410","published":"2026-02-20T15:46:59.059Z","updated":"2026-04-28T21:01:43.654Z","title":"WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Belletrist","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69409","published":"2026-02-20T15:46:58.882Z","updated":"2026-04-28T21:01:33.546Z","title":"WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"PJ | Life & Business Coaching","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69408","published":"2026-02-20T15:46:58.713Z","updated":"2026-04-28T21:01:23.257Z","title":"WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"HealthFirst","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69407","published":"2026-02-20T15:46:58.538Z","updated":"2026-04-28T21:01:12.190Z","title":"WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Struktur","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69406","published":"2026-02-20T15:46:58.338Z","updated":"2026-04-28T21:01:01.875Z","title":"WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"FreightCo","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69405","published":"2026-02-20T15:46:58.121Z","updated":"2026-04-28T21:00:51.555Z","title":"WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Lorem Ipsum | Books & Media Store","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69404","published":"2026-02-20T15:46:57.893Z","updated":"2026-04-28T21:00:42.344Z","title":"WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Extreme Store","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69403","published":"2026-02-20T15:46:57.715Z","updated":"2026-04-28T21:00:32.060Z","title":"WordPress Bravis Addons plugin <= 1.3.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Bravis-Themes","product":"Bravis Addons","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-69402","published":"2026-02-20T15:46:57.536Z","updated":"2026-04-28T21:00:22.984Z","title":"WordPress R&F theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"R&F","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2025-69401","published":"2026-02-20T15:46:57.345Z","updated":"2026-04-28T16:14:40.161Z","title":"WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability","severity":"HIGH","score":7.5,"vendor":"mdalabar","product":"WooODT Lite","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-69400","published":"2026-02-20T15:46:57.137Z","updated":"2026-04-28T21:00:12.779Z","title":"WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Yokoo","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69399","published":"2026-02-20T15:46:56.948Z","updated":"2026-04-28T20:59:56.755Z","title":"WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Cobble","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69398","published":"2026-02-20T15:46:56.752Z","updated":"2026-04-28T20:59:46.156Z","title":"WordPress Plank theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Plank","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69397","published":"2026-02-20T15:46:56.567Z","updated":"2026-04-28T20:59:35.767Z","title":"WordPress Tint theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Tint","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69396","published":"2026-02-20T15:46:56.394Z","updated":"2026-04-28T20:59:25.851Z","title":"WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Splendour","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69395","published":"2026-02-20T15:46:56.223Z","updated":"2026-04-28T20:59:15.275Z","title":"WordPress Gable theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Gable","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2025-69394","published":"2026-02-20T15:46:56.050Z","updated":"2026-04-28T16:14:40.031Z","title":"WordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"cnvrse","product":"Cnvrse","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-69393","published":"2026-02-20T15:46:55.856Z","updated":"2026-04-28T16:14:40.076Z","title":"WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Jthemes","product":"Exzo","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2025-69392","published":"2026-02-20T15:46:55.677Z","updated":"2026-04-28T20:59:05.734Z","title":"WordPress iMoney plugin <= 0.36 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"itex","product":"iMoney","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69391","published":"2026-02-20T15:46:55.498Z","updated":"2026-04-28T20:58:54.623Z","title":"WordPress Diamond theme <= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GT3themes","product":"Diamond","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69390","published":"2026-02-20T15:46:55.327Z","updated":"2026-04-28T20:58:45.857Z","title":"WordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themebon","product":"Business Template Blocks for WPBakery (Visual Composer) Page Builder","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-69389","published":"2026-02-20T15:46:55.128Z","updated":"2026-04-28T20:58:35.068Z","title":"WordPress Visitor Maps Extended Referer Field plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hugh Mungus","product":"Visitor Maps Extended Referer Field","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69388","published":"2026-02-20T15:46:54.922Z","updated":"2026-04-28T20:58:26.209Z","title":"WordPress Cliengo – Chatbot plugin <= 3.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"cliengo","product":"Cliengo – Chatbot","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-69387","published":"2026-02-20T15:46:54.745Z","updated":"2026-04-28T20:58:15.855Z","title":"WordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"whatwouldjessedo","product":"Simple Retail Menus","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2025-69386","published":"2026-02-20T15:46:54.554Z","updated":"2026-04-28T20:58:07.545Z","title":"WordPress RVCFDI para Woocommerce plugin <= 8.1.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"realvirtualmx","product":"RVCFDI para Woocommerce","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-69385","published":"2026-02-20T15:46:54.361Z","updated":"2026-04-28T16:14:39.774Z","title":"WordPress Cartify - WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AgniHD","product":"Cartify - WooCommerce Gutenberg WordPress Theme","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-69384","published":"2026-02-20T15:46:54.106Z","updated":"2026-04-28T20:57:56.874Z","title":"WordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdiscover","product":"Timeline Event History","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69383","published":"2026-02-20T15:46:53.941Z","updated":"2026-04-28T20:57:47.752Z","title":"WordPress WP shop plugin <= 2.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Agence web Eoxia - Montpellier","product":"WP shop","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2025-69382","published":"2026-02-20T15:46:53.765Z","updated":"2026-04-28T20:57:36.447Z","title":"WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themesflat","product":"Themesflat Elementor","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69381","published":"2026-02-20T15:46:53.591Z","updated":"2026-04-28T20:57:25.741Z","title":"WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"vanquish","product":"WooCommerce Bulk Product Editor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-69380","published":"2026-02-20T15:46:53.401Z","updated":"2026-04-28T20:57:15.359Z","title":"WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"vanquish","product":"Upload Files Anywhere","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2025-69379","published":"2026-02-20T15:46:53.230Z","updated":"2026-04-28T20:57:05.997Z","title":"WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"vanquish","product":"Upload Files Anywhere","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-69378","published":"2026-02-20T15:46:53.046Z","updated":"2026-04-28T16:14:39.701Z","title":"WordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"XforWooCommerce","product":"Product Filter for WooCommerce","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-69377","published":"2026-02-20T15:46:52.641Z","updated":"2026-04-28T20:56:54.569Z","title":"WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"vanquish","product":"User Extra Fields","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2025-69376","published":"2026-02-20T15:46:52.242Z","updated":"2026-04-28T20:56:44.706Z","title":"WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"vanquish","product":"User Extra Fields","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2025-69375","published":"2026-02-20T15:46:52.069Z","updated":"2026-04-28T20:56:34.719Z","title":"WordPress Portfolio Builder plugin <= 1.2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SolverWp","product":"Portfolio Builder","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2025-69374","published":"2026-02-20T15:46:51.890Z","updated":"2026-04-28T20:56:24.847Z","title":"WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SolverWp","product":"Eleblog – Elementor Blog And Magazine Addons","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2025-69373","published":"2026-02-20T15:46:51.695Z","updated":"2026-04-28T16:14:39.622Z","title":"WordPress VidoRev theme <= 2.9.9.9.9.9.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"beeteam368","product":"VidoRev","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-69372","published":"2026-02-20T15:46:51.523Z","updated":"2026-04-28T20:56:16.296Z","title":"WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"SevenHills","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2025-69371","published":"2026-02-20T15:46:51.329Z","updated":"2026-04-28T20:56:07.012Z","title":"WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"KindlyCare","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2025-69370","published":"2026-02-20T15:46:51.123Z","updated":"2026-04-28T20:55:57.311Z","title":"WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Capella","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69368","published":"2026-02-20T15:46:50.944Z","updated":"2026-04-28T20:55:48.498Z","title":"WordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GT3themes","product":"SOHO - Photography WordPress Theme","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-69367","published":"2026-02-20T15:46:50.750Z","updated":"2026-04-28T20:55:38.303Z","title":"WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GT3themes","product":"Oyster - Photography WordPress Theme","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-69366","published":"2026-02-20T15:46:50.573Z","updated":"2026-04-28T20:55:30.633Z","title":"WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Emerce Core","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-69365","published":"2026-02-20T15:46:50.375Z","updated":"2026-04-28T20:55:20.611Z","title":"WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Uroan Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69337","published":"2026-02-20T15:46:50.197Z","updated":"2026-04-28T20:53:55.871Z","title":"WordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"don-themes","product":"Wolmart Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69330","published":"2026-02-20T15:46:50.026Z","updated":"2026-04-28T20:53:18.731Z","title":"WordPress Prestige theme < 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jthemes","product":"Prestige","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69329","published":"2026-02-20T15:46:49.874Z","updated":"2026-04-28T20:53:08.499Z","title":"WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Jthemes","product":"Prestige","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69328","published":"2026-02-20T15:46:49.714Z","updated":"2026-04-28T20:52:57.341Z","title":"WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-69326","published":"2026-02-20T15:46:49.532Z","updated":"2026-04-28T20:52:47.770Z","title":"WordPress NEX-Forms plugin <= 9.1.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-69325","published":"2026-02-20T15:46:49.332Z","updated":"2026-04-28T20:52:37.195Z","title":"WordPress Primer MyData for Woocommerce plugin <= 4.2.8 - Path Traversal vulnerability","severity":"MEDIUM","score":5.3,"vendor":"primersoftware","product":"Primer MyData for Woocommerce","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-69324","published":"2026-02-20T15:46:49.111Z","updated":"2026-04-28T20:52:27.961Z","title":"WordPress NEX-Forms plugin <= 9.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-69323","published":"2026-02-20T15:46:48.922Z","updated":"2026-04-28T20:52:17.090Z","title":"WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"Slimstat Analytics","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-69322","published":"2026-02-20T15:46:48.754Z","updated":"2026-04-28T20:52:07.917Z","title":"WordPress PeakShops theme < 1.5.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"fuelthemes","product":"PeakShops","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-69310","published":"2026-02-20T15:46:48.517Z","updated":"2026-04-28T20:47:52.641Z","title":"WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Woodly Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69309","published":"2026-02-20T15:46:48.321Z","updated":"2026-04-28T20:47:42.255Z","title":"WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Saasplate Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69308","published":"2026-02-20T15:46:48.088Z","updated":"2026-04-28T20:47:32.253Z","title":"WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Nestbyte Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69307","published":"2026-02-20T15:46:47.896Z","updated":"2026-04-28T20:47:22.608Z","title":"WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Medinik Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69306","published":"2026-02-20T15:46:47.710Z","updated":"2026-04-28T20:47:12.777Z","title":"WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Electio Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-69305","published":"2026-02-20T15:46:47.544Z","updated":"2026-04-28T20:47:02.640Z","title":"WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Crete Core","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-69304","published":"2026-02-20T15:46:47.349Z","updated":"2026-04-28T20:46:53.269Z","title":"WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Allmart","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2025-69303","published":"2026-02-20T15:46:47.100Z","updated":"2026-04-28T16:14:37.084Z","title":"WordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"modeltheme","product":"ModelTheme Framework","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-69302","published":"2026-02-20T15:46:46.906Z","updated":"2026-04-28T20:46:42.748Z","title":"WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"DesignThemes Core Features","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-69301","published":"2026-02-20T15:46:46.725Z","updated":"2026-04-28T20:46:33.634Z","title":"WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"PhotoMe","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-69299","published":"2026-02-20T15:46:46.533Z","updated":"2026-04-28T20:46:23.309Z","title":"WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Laborator","product":"Oxygen","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69298","published":"2026-02-20T15:46:46.307Z","updated":"2026-04-28T16:14:36.876Z","title":"WordPress Gauge theme <= 6.56.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"GhostPool","product":"Gauge","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-69297","published":"2026-02-20T15:46:46.098Z","updated":"2026-04-28T20:46:13.989Z","title":"WordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"GhostPool","product":"Aardvark Plugin","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-69296","published":"2026-02-20T15:46:45.930Z","updated":"2026-04-28T20:46:04.037Z","title":"WordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GhostPool","product":"Aardvark","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-69295","published":"2026-02-20T15:46:45.751Z","updated":"2026-04-28T20:45:54.858Z","title":"WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Coven Core","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2025-69294","published":"2026-02-20T15:46:45.572Z","updated":"2026-04-28T20:45:43.314Z","title":"WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"fuelthemes","product":"PeakShops","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-69063","published":"2026-02-20T15:46:45.384Z","updated":"2026-04-28T16:14:35.569Z","title":"WordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.6,"vendor":"Saad Iqbal","product":"New User Approve","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-69011","published":"2026-02-20T15:46:45.000Z","updated":"2026-04-28T20:32:43.247Z","title":"WordPress Cool Tag Cloud plugin <= 2.29 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPKube","product":"Cool Tag Cloud","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68895","published":"2026-02-20T15:46:44.814Z","updated":"2026-04-28T20:07:14.275Z","title":"WordPress AhaChat Messenger Marketing plugin <= 1.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ahachat","product":"AhaChat Messenger Marketing","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2025-68880","published":"2026-02-20T15:46:44.624Z","updated":"2026-04-28T20:06:01.640Z","title":"WordPress Simple Archive Generator plugin <= 5.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"peterwsterling","product":"Simple Archive Generator","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68863","published":"2026-02-20T15:46:44.401Z","updated":"2026-04-28T20:04:56.251Z","title":"WordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Zack Katz","product":"iContact for Gravity Forms","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-68862","published":"2026-02-20T15:46:44.189Z","updated":"2026-04-28T20:04:47.214Z","title":"WordPress Woo File Dropzone plugin <= 1.1.7 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Murtaza Bhurgri","product":"Woo File Dropzone","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-68856","published":"2026-02-20T15:46:44.011Z","updated":"2026-04-28T20:04:10.724Z","title":"WordPress Mopinion Feedback Form plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"keeswolters","product":"Mopinion Feedback Form","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-68855","published":"2026-02-20T15:46:43.816Z","updated":"2026-04-29T09:51:56.564Z","title":"WordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"themeglow","product":"JobBoard Job listing","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-68854","published":"2026-02-20T15:46:43.644Z","updated":"2026-04-28T20:04:02.621Z","title":"WordPress ID Arrays plugin <= 2.1.2 - POST-Based Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"harman79","product":"ID Arrays","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-68853","published":"2026-02-20T15:46:43.488Z","updated":"2026-04-28T16:14:31.716Z","title":"WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Kleor","product":"Contact Manager","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-68852","published":"2026-02-20T15:46:43.282Z","updated":"2026-04-28T16:14:31.798Z","title":"WordPress Court Reservation plugin <= 1.10.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"webmuehle","product":"Court Reservation","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-68848","published":"2026-02-20T15:46:43.083Z","updated":"2026-04-28T20:03:44.081Z","title":"WordPress amr cron manager plugin <= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"anmari","product":"amr cron manager","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68847","published":"2026-02-20T15:46:42.884Z","updated":"2026-04-28T20:03:35.017Z","title":"WordPress iSape plugin <= 0.72 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"itex","product":"iSape","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68846","published":"2026-02-20T15:46:42.712Z","updated":"2026-04-28T20:03:26.267Z","title":"WordPress Asynchronous Javascript plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Paris Holley","product":"Asynchronous Javascript","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68845","published":"2026-02-20T15:46:42.521Z","updated":"2026-04-28T20:03:16.966Z","title":"WordPress eDS Responsive Menu plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"aThemeArt Translations","product":"eDS Responsive Menu","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68844","published":"2026-02-20T15:46:42.323Z","updated":"2026-04-28T20:03:07.484Z","title":"WordPress Membee Login plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"DaleAB","product":"Membee Login","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-68843","published":"2026-02-20T15:46:42.104Z","updated":"2026-04-28T20:02:58.822Z","title":"WordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bas Schuiling","product":"FeedWordPress Advanced Filters","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-68842","published":"2026-02-20T15:46:41.871Z","updated":"2026-04-28T20:02:49.836Z","title":"WordPress Widget Logic Visual plugin <= 1.52 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"totalbounty","product":"Widget Logic Visual","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-68841","published":"2026-02-20T15:46:41.702Z","updated":"2026-04-28T20:02:40.704Z","title":"WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Themepul","product":"TopperPack – Complete Elementor Addons, Theme & CPT Builder","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-68837","published":"2026-02-20T15:46:41.507Z","updated":"2026-04-28T16:14:31.735Z","title":"WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ELEXtensions","product":"ELEX WordPress HelpDesk & Customer Ticketing System","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-68834","published":"2026-02-20T15:46:41.323Z","updated":"2026-04-28T16:14:31.350Z","title":"WordPress Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Saiful Islam","product":"Sync Master Sheet – Product Sync with Google Sheet for WooCommerce","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-68564","published":"2026-02-20T15:46:41.136Z","updated":"2026-04-28T16:14:30.399Z","title":"WordPress Sendy plugin <= 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sendy","product":"Sendy","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-68552","published":"2026-02-20T15:46:40.954Z","updated":"2026-04-28T16:14:30.210Z","title":"WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"WebCodingPlace","product":"WooCommerce Coming Soon Product with Countdown","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-68549","published":"2026-02-20T15:46:40.793Z","updated":"2026-04-28T20:01:36.353Z","title":"WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Wiguard","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-68545","published":"2026-02-20T15:46:40.615Z","updated":"2026-04-28T16:14:30.118Z","title":"WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Nika","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-68543","published":"2026-02-20T15:46:40.451Z","updated":"2026-04-28T20:01:26.897Z","title":"WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Diza","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2025-68542","published":"2026-02-20T15:46:40.232Z","updated":"2026-04-28T20:01:17.928Z","title":"WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vgdevsolutions","product":"Checkout Gateway for IRIS","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68541","published":"2026-02-20T15:46:40.047Z","updated":"2026-04-28T20:01:08.511Z","title":"WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Ippsum","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-68539","published":"2026-02-20T15:46:39.873Z","updated":"2026-04-28T20:00:58.575Z","title":"WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Fana","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-68536","published":"2026-02-20T15:46:39.679Z","updated":"2026-04-28T20:00:39.300Z","title":"WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Zota","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-68534","published":"2026-02-20T15:46:39.366Z","updated":"2026-04-28T16:14:29.944Z","title":"WordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"add-ons.org","product":"PDF for WPForms","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-68531","published":"2026-02-20T15:46:39.192Z","updated":"2026-04-28T20:00:30.218Z","title":"WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"modeltheme","product":"ModelTheme Addons for WPBakery and Elementor","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-68526","published":"2026-02-20T15:46:39.001Z","updated":"2026-04-28T20:00:20.623Z","title":"WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"A WP Life","product":"Modal Popup Box","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-68514","published":"2026-02-20T15:46:38.821Z","updated":"2026-04-29T09:51:56.748Z","title":"WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2025-68501","published":"2026-02-20T15:46:38.572Z","updated":"2026-04-28T19:59:44.638Z","title":"WordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mollie","product":"Mollie Payments for WooCommerce","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68495","published":"2026-02-20T15:46:38.333Z","updated":"2026-04-28T19:59:35.697Z","title":"WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68069","published":"2026-02-20T15:46:38.064Z","updated":"2026-04-28T16:14:28.215Z","title":"WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-68051","published":"2026-02-20T15:46:37.798Z","updated":"2026-04-28T16:14:27.678Z","title":"WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Shiprocket","product":"Shiprocket","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-68050","published":"2026-02-20T15:46:37.392Z","updated":"2026-04-28T19:57:17.186Z","title":"WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leadpages","product":"Leadpages","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-68048","published":"2026-02-20T15:46:37.159Z","updated":"2026-04-28T19:57:08.170Z","title":"WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"XLPlugins","product":"NextMove Lite","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-68043","published":"2026-02-20T15:46:36.994Z","updated":"2026-04-28T19:56:40.610Z","title":"WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"LottieFiles","product":"LottieFiles","kev":false,"epss":0.00637,"kevAdded":null},{"id":"CVE-2025-68042","published":"2026-02-20T15:46:36.826Z","updated":"2026-04-28T19:56:30.949Z","title":"WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Travelpayouts","product":"Travelpayouts","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-68037","published":"2026-02-20T15:46:36.647Z","updated":"2026-04-29T09:51:56.151Z","title":"WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Atlas Gondal","product":"Export Media URLs","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-68032","published":"2026-02-20T15:46:36.477Z","updated":"2026-04-28T16:14:27.001Z","title":"WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Brains","product":"Advanced WC Analytics","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-68031","published":"2026-02-20T15:46:36.305Z","updated":"2026-04-28T19:55:59.045Z","title":"WordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"faraz sms","product":"افزونه پیامک حرفه ای فراز اس ام اس","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68028","published":"2026-02-20T15:46:36.112Z","updated":"2026-04-28T16:14:26.793Z","title":"WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Brains","product":"GA4WP: Google Analytics for WordPress","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68026","published":"2026-02-20T15:46:35.938Z","updated":"2026-04-28T19:55:30.587Z","title":"WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Niaj Morshed","product":"LC Wizard","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68025","published":"2026-02-20T15:46:35.764Z","updated":"2026-04-28T16:14:26.687Z","title":"WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Addonify","product":"Addonify Floating Cart For WooCommerce","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68024","published":"2026-02-20T15:46:35.579Z","updated":"2026-04-28T19:55:21.612Z","title":"WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Addonify","product":"Addonify – WooCommerce Wishlist","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68023","published":"2026-02-20T15:46:35.312Z","updated":"2026-04-28T16:14:26.560Z","title":"WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Addonify","product":"Addonify – Compare Products For WooCommerce","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-68022","published":"2026-02-20T15:46:34.974Z","updated":"2026-04-28T16:14:26.504Z","title":"WordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"soporteblue","product":"Plugin BlueX for WooCommerce","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-68021","published":"2026-02-20T15:46:34.400Z","updated":"2026-04-28T16:14:26.559Z","title":"WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ConveyThis","product":"ConveyThis","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-68005","published":"2026-02-20T15:46:34.209Z","updated":"2026-04-28T16:14:25.848Z","title":"WordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themewant","product":"Easy Hotel Booking","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-68002","published":"2026-02-20T15:46:34.046Z","updated":"2026-04-28T19:43:30.702Z","title":"WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"100plugins","product":"Open User Map","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2025-68000","published":"2026-02-20T15:46:33.875Z","updated":"2026-04-28T16:14:25.337Z","title":"WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Testimonial Slider","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-67998","published":"2026-02-20T15:46:33.699Z","updated":"2026-04-28T19:33:24.535Z","title":"WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"kamleshyadav","product":"Miraculous Elementor","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-67997","published":"2026-02-20T15:46:33.519Z","updated":"2026-04-28T19:33:15.534Z","title":"WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Travelicious","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-67996","published":"2026-02-20T15:46:33.328Z","updated":"2026-04-28T19:33:05.319Z","title":"WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Nestin","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-67995","published":"2026-02-20T15:46:33.136Z","updated":"2026-04-28T19:32:56.132Z","title":"WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"LoftOcean","product":"PatioTime","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2025-67994","published":"2026-02-20T15:46:32.934Z","updated":"2026-04-28T16:14:25.529Z","title":"WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"YayCommerce","product":"YayCurrency","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-67993","published":"2026-02-20T15:46:32.736Z","updated":"2026-04-28T19:32:47.032Z","title":"WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-67992","published":"2026-02-20T15:46:32.513Z","updated":"2026-04-28T19:32:37.512Z","title":"WordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"LoftOcean","product":"PatioTime","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2025-67991","published":"2026-02-20T15:46:32.315Z","updated":"2026-04-28T19:32:25.716Z","title":"WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"vanquish","product":"User Extra Fields","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-67990","published":"2026-02-20T15:46:32.120Z","updated":"2026-04-28T19:32:16.461Z","title":"WordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"GMap Targeting","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-67988","published":"2026-02-20T15:46:31.946Z","updated":"2026-04-28T19:32:07.360Z","title":"WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"LoftOcean","product":"CozyStay","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2025-67987","published":"2026-02-20T15:46:31.764Z","updated":"2026-04-28T19:31:57.133Z","title":"WordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2025-67984","published":"2026-02-20T15:46:31.564Z","updated":"2026-04-28T19:31:48.014Z","title":"WordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"calliko","product":"NPS computy","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-67982","published":"2026-02-20T15:46:31.376Z","updated":"2026-04-28T19:31:29.538Z","title":"WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Urna","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2025-67981","published":"2026-02-20T15:46:31.208Z","updated":"2026-04-28T19:31:20.332Z","title":"WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Besa","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2025-67980","published":"2026-02-20T15:46:31.029Z","updated":"2026-04-28T19:31:10.802Z","title":"WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Hara","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2025-67979","published":"2026-02-20T15:46:30.861Z","updated":"2026-04-28T19:31:01.604Z","title":"WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WesternDeal","product":"WPForms Google Sheet Connector","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-67978","published":"2026-02-20T15:46:30.665Z","updated":"2026-04-28T19:30:51.843Z","title":"WordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FixBD","product":"Educare","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-67977","published":"2026-02-20T15:46:30.439Z","updated":"2026-04-28T16:14:24.968Z","title":"WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"VillaTheme","product":"HAPPY","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-67975","published":"2026-02-20T15:46:30.134Z","updated":"2026-04-28T16:14:25.021Z","title":"WordPress aDirectory plugin <= 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aDirectory","product":"aDirectory","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-67974","published":"2026-02-20T15:46:29.701Z","updated":"2026-04-28T16:14:24.981Z","title":"WordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Legal Pages","product":"WPLegalPages","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-67973","published":"2026-02-20T15:46:29.373Z","updated":"2026-04-28T16:14:24.956Z","title":"WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-67972","published":"2026-02-20T15:46:29.103Z","updated":"2026-05-21T08:26:38.169Z","title":"WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Zoho Mail","product":"Zoho ZeptoMail","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-67971","published":"2026-02-20T15:46:28.917Z","updated":"2026-04-28T19:30:23.755Z","title":"WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"FluentCart","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-67970","published":"2026-02-20T15:46:28.741Z","updated":"2026-04-28T16:14:24.929Z","title":"WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"vertim","product":"Schedula","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2025-67969","published":"2026-02-20T15:46:28.574Z","updated":"2026-04-29T09:51:55.945Z","title":"WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"knitpay","product":"UPI QR Code Payment Gateway for WooCommerce","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-67624","published":"2026-02-20T15:46:28.340Z","updated":"2026-04-28T16:14:22.848Z","title":"WordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arya Dhiratara","product":"Optimize More! – Images","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-67547","published":"2026-02-20T15:46:27.909Z","updated":"2026-04-28T16:14:20.538Z","title":"WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"uixthemes","product":"Konte","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-60183","published":"2026-02-20T15:46:27.695Z","updated":"2026-04-28T18:39:42.969Z","title":"WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"silence","product":"Silencesoft RSS Reader","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-60087","published":"2026-02-20T15:46:27.515Z","updated":"2026-04-28T18:37:31.618Z","title":"WordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Nenad Obradovic","product":"Extensive VC Addons for WPBakery page builder","kev":false,"epss":0.00658,"kevAdded":null},{"id":"CVE-2025-53237","published":"2026-02-20T15:46:27.310Z","updated":"2026-04-28T19:12:19.056Z","title":"WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Soflyy","product":"WP Wizard Cloak","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-53233","published":"2026-02-20T15:46:27.120Z","updated":"2026-04-28T19:11:47.346Z","title":"WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"RylanH","product":"Storyform","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-53231","published":"2026-02-20T15:46:26.944Z","updated":"2026-04-28T19:11:36.173Z","title":"WordPress Easy Taxonomy Images plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdevstudio","product":"Easy Taxonomy Images","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2025-53228","published":"2026-02-20T15:46:26.768Z","updated":"2026-04-28T19:11:13.746Z","title":"WordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"jezza101","product":"bbpress Simple Advert Units","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2025-53217","published":"2026-02-20T15:46:26.588Z","updated":"2026-04-28T16:13:20.862Z","title":"WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability","severity":"HIGH","score":7.6,"vendor":"staviravn","product":"AIO WP Builder","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-52744","published":"2026-02-20T15:46:26.398Z","updated":"2026-04-28T16:13:17.985Z","title":"WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.7,"vendor":"inpersttion","product":"Inpersttion For Theme","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2024-56208","published":"2026-02-20T15:46:26.166Z","updated":"2026-04-28T16:10:55.181Z","title":"WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"desertthemes","product":"NewsMash","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2024-54222","published":"2026-02-20T15:46:25.825Z","updated":"2026-04-28T16:10:47.966Z","title":"WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Seraphinite Solutions","product":"Seraphinite Accelerator","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2024-52387","published":"2026-02-20T15:46:25.639Z","updated":"2026-04-28T16:10:40.830Z","title":"WordPress  Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Liton Arefin","product":"Master Addons for Elementor","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2024-51915","published":"2026-02-20T15:46:25.475Z","updated":"2026-04-28T16:10:39.487Z","title":"WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LiteSpeed Technologies","product":"LiteSpeed Cache","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2024-50555","published":"2026-02-20T15:46:25.284Z","updated":"2026-04-28T16:10:32.037Z","title":"WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2024-50452","published":"2026-02-20T15:46:25.053Z","updated":"2026-04-28T16:10:29.086Z","title":"WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"Nexter Blocks","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2024-43228","published":"2026-02-20T15:46:24.859Z","updated":"2026-04-28T16:10:09.878Z","title":"WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SecuPress","product":"SecuPress Free","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2024-34438","published":"2026-02-20T15:46:24.610Z","updated":"2026-04-28T16:09:48.906Z","title":"WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Anssi Laitila","product":"Shared Files","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-27440","published":"2026-02-19T20:35:42.839Z","updated":"2026-04-28T16:15:03.440Z","title":"WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-27387","published":"2026-02-19T20:35:42.604Z","updated":"2026-04-28T16:15:02.889Z","title":"WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-27368","published":"2026-02-19T20:35:42.391Z","updated":"2026-04-28T16:15:02.356Z","title":"WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SeedProd","product":"Coming Soon Page, Under Construction & Maintenance Mode by SeedProd","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-27360","published":"2026-02-19T20:35:42.196Z","updated":"2026-04-28T16:15:02.268Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-27343","published":"2026-02-19T20:35:41.998Z","updated":"2026-04-28T16:15:02.098Z","title":"WordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"VanKarWai","product":"Airtifact","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2026-27328","published":"2026-02-19T20:35:41.705Z","updated":"2026-04-28T16:15:01.804Z","title":"WordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DevsBlink","product":"EduBlink","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-27327","published":"2026-02-19T20:35:41.377Z","updated":"2026-04-28T16:15:01.805Z","title":"WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"YayCommerce","product":"YayMail","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-27094","published":"2026-02-19T08:27:11.985Z","updated":"2026-04-28T16:15:01.746Z","title":"WordPress CoBlocks plugin <= 3.1.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GoDaddy","product":"CoBlocks","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27092","published":"2026-02-19T08:27:11.805Z","updated":"2026-04-28T16:15:01.646Z","title":"WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-27090","published":"2026-02-19T08:27:11.584Z","updated":"2026-04-28T16:15:01.674Z","title":"WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Moose","product":"Kenta Companion","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-27074","published":"2026-02-19T08:27:11.377Z","updated":"2026-04-28T16:15:01.107Z","title":"WordPress Shortcoder plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vaakash","product":"Shortcoder","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27069","published":"2026-02-19T08:27:11.180Z","updated":"2026-04-28T16:15:00.799Z","title":"WordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Soledad","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27059","published":"2026-02-19T08:27:10.820Z","updated":"2026-04-28T16:15:00.988Z","title":"WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Recipe","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27058","published":"2026-02-19T08:27:10.631Z","updated":"2026-04-28T16:15:00.830Z","title":"WordPress Penci Podcast plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Podcast","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27057","published":"2026-02-19T08:27:10.448Z","updated":"2026-04-28T16:15:00.928Z","title":"WordPress Penci Filter Everything plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Filter Everything","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-27055","published":"2026-02-19T08:27:09.973Z","updated":"2026-04-28T16:15:00.531Z","title":"WordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PenciDesign","product":"Penci AI SmartContent Creator","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-27052","published":"2026-02-19T08:27:09.802Z","updated":"2026-04-28T16:15:00.961Z","title":"WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"villatheme","product":"Sales Countdown Timer for WooCommerce and WordPress","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-27050","published":"2026-02-19T08:27:09.603Z","updated":"2026-04-28T16:14:59.935Z","title":"WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"RealPress","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-27042","published":"2026-02-19T08:27:09.364Z","updated":"2026-04-28T16:14:59.685Z","title":"WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"NotificationX","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-25473","published":"2026-02-19T08:27:09.151Z","updated":"2026-04-28T16:14:59.639Z","title":"WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"AA-Team","product":"WZone","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-25472","published":"2026-02-19T08:27:08.959Z","updated":"2026-04-28T16:14:59.682Z","title":"WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-25463","published":"2026-02-19T08:27:08.751Z","updated":"2026-04-28T16:14:59.391Z","title":"WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WpEstate","product":"Wpresidence Core","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-25459","published":"2026-02-19T08:27:08.568Z","updated":"2026-04-28T16:14:59.340Z","title":"WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"uixthemes","product":"Sober","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-25453","published":"2026-02-19T08:27:08.389Z","updated":"2026-04-28T16:14:59.222Z","title":"WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mdempfle","product":"Advanced iFrame","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-25451","published":"2026-02-19T08:27:08.216Z","updated":"2026-04-28T16:14:59.214Z","title":"WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-25441","published":"2026-02-19T08:27:08.043Z","updated":"2026-04-28T16:14:59.041Z","title":"WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"varunvairavanlc","product":"LeadConnector","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-25432","published":"2026-02-19T08:27:07.843Z","updated":"2026-04-28T16:14:58.666Z","title":"WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"omnipressteam","product":"Omnipress","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-25428","published":"2026-02-19T08:27:07.662Z","updated":"2026-04-28T16:14:58.461Z","title":"WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"totalsoft","product":"TS Poll","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-25423","published":"2026-02-19T08:27:07.440Z","updated":"2026-04-28T16:14:58.617Z","title":"WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability","severity":"LOW","score":3.8,"vendor":"creativeinteractivemedia","product":"Real 3D FlipBook","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-25422","published":"2026-02-19T08:27:07.187Z","updated":"2026-04-28T16:14:58.667Z","title":"WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Themes4WP","product":"Popularis Extra","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-25420","published":"2026-02-19T08:27:06.988Z","updated":"2026-04-28T16:14:58.454Z","title":"WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"MailerLite","product":"MailerLite","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-25419","published":"2026-02-19T08:27:06.818Z","updated":"2026-04-28T16:14:58.592Z","title":"WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"flycart","product":"UpsellWP","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-25418","published":"2026-02-19T08:27:06.644Z","updated":"2026-04-28T16:14:58.487Z","title":"WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Bit Apps","product":"Bit Form","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-25416","published":"2026-02-19T08:27:06.461Z","updated":"2026-04-28T16:14:58.616Z","title":"WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25415","published":"2026-02-19T08:27:06.273Z","updated":"2026-04-28T16:14:58.537Z","title":"WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iqonicdesign","product":"WPBookit Pro","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25411","published":"2026-02-19T08:27:05.876Z","updated":"2026-04-28T16:14:58.148Z","title":"WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themastercut","product":"Revision Manager TMC","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-25410","published":"2026-02-19T08:27:05.666Z","updated":"2026-04-28T16:14:58.465Z","title":"WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tstephenson","product":"WP-CORS","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25409","published":"2026-02-19T08:27:05.400Z","updated":"2026-04-28T16:14:58.299Z","title":"WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"crgeary","product":"JAMstack Deployments","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25408","published":"2026-02-19T08:27:05.163Z","updated":"2026-04-28T16:14:58.476Z","title":"WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginRx","product":"Broken Link Notifier","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-25407","published":"2026-02-19T08:27:04.641Z","updated":"2026-04-28T16:14:58.334Z","title":"WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cookiebot","product":"Cookiebot","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-25404","published":"2026-02-19T08:27:04.284Z","updated":"2026-04-28T16:14:58.267Z","title":"WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Automattic","product":"WP Job Manager","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25402","published":"2026-02-19T08:27:04.069Z","updated":"2026-04-28T16:14:57.677Z","title":"WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"echoplugins","product":"Knowledge Base for Documentation, FAQs with AI Assistance","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25399","published":"2026-02-19T08:27:03.896Z","updated":"2026-04-28T16:14:57.647Z","title":"WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CryoutCreations","product":"Serious Slider","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-25395","published":"2026-02-19T08:27:03.709Z","updated":"2026-04-28T16:14:57.629Z","title":"WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ikreatethemes","product":"Business Roy","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-25394","published":"2026-02-19T08:27:03.524Z","updated":"2026-04-28T16:14:57.629Z","title":"WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sparklewpthemes","product":"Fitness FSE","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25393","published":"2026-02-19T08:27:03.097Z","updated":"2026-04-28T16:14:57.665Z","title":"WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sparklewpthemes","product":"Hello FSE","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25392","published":"2026-02-19T08:27:02.858Z","updated":"2026-04-28T16:14:57.539Z","title":"WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"KaizenCoders","product":"Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-25391","published":"2026-02-19T08:27:02.677Z","updated":"2026-04-28T16:14:57.622Z","title":"WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Grids","product":"WP Wand","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-25389","published":"2026-02-19T08:27:02.493Z","updated":"2026-04-28T16:14:57.654Z","title":"WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-25388","published":"2026-02-19T08:27:02.280Z","updated":"2026-04-28T16:14:57.628Z","title":"WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"scripteo","product":"Ads Pro","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-25387","published":"2026-02-19T08:27:02.035Z","updated":"2026-04-28T16:14:57.464Z","title":"WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Elementor","product":"Image Optimizer by Elementor","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-25386","published":"2026-02-19T08:27:01.724Z","updated":"2026-04-28T16:14:57.369Z","title":"WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Elementor","product":"Ally","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25385","published":"2026-02-19T08:27:01.504Z","updated":"2026-04-28T16:14:57.389Z","title":"WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"KaizenCoders","product":"URL Shortify","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-25384","published":"2026-02-19T08:27:01.252Z","updated":"2026-04-28T16:14:57.339Z","title":"WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Lab","product":"WP-Lister Lite for eBay","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25378","published":"2026-02-19T08:27:01.027Z","updated":"2026-04-28T16:14:56.972Z","title":"WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Nelio Software","product":"Nelio AB Testing","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-25375","published":"2026-02-19T08:27:00.855Z","updated":"2026-04-28T16:14:56.996Z","title":"WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-25374","published":"2026-02-19T08:27:00.661Z","updated":"2026-04-28T16:14:56.976Z","title":"WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raratheme","product":"Spa and Salon","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-25372","published":"2026-02-19T08:27:00.488Z","updated":"2026-04-28T16:14:56.924Z","title":"WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kodezen LLC","product":"Academy LMS","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-25370","published":"2026-02-19T08:27:00.225Z","updated":"2026-04-28T16:14:56.930Z","title":"WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25368","published":"2026-02-19T08:26:59.947Z","updated":"2026-04-28T16:14:56.896Z","title":"WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Calculated Fields Form","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-25367","published":"2026-02-19T08:26:59.651Z","updated":"2026-04-28T16:14:56.930Z","title":"WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NooTheme","product":"CitiLights","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-25364","published":"2026-02-19T08:26:59.312Z","updated":"2026-04-28T16:14:56.851Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25363","published":"2026-02-19T08:26:59.110Z","updated":"2026-04-28T16:14:56.713Z","title":"WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"FooPlugins","product":"FooGallery","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25362","published":"2026-02-19T08:26:58.927Z","updated":"2026-04-28T16:14:56.643Z","title":"WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"FooPlugins","product":"FooGallery","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-25348","published":"2026-02-19T08:26:58.744Z","updated":"2026-04-28T16:14:56.364Z","title":"WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"alttextai","product":"Download Alt Text AI","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-25343","published":"2026-02-19T08:26:58.554Z","updated":"2026-04-28T16:14:55.836Z","title":"WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"VeronaLabs","product":"WP SMS","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-25338","published":"2026-02-19T08:26:58.376Z","updated":"2026-04-28T16:14:55.849Z","title":"WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"AI ChatBot with ChatGPT and Content Generator by AYS","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25337","published":"2026-02-19T08:26:58.204Z","updated":"2026-04-28T16:14:55.828Z","title":"WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpcoachify","product":"Coachify","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-25336","published":"2026-02-19T08:26:57.889Z","updated":"2026-04-28T16:14:55.697Z","title":"WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpcoachify","product":"Coachify","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-25335","published":"2026-02-19T08:26:57.707Z","updated":"2026-04-28T16:14:55.765Z","title":"WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Secure Copy Content Protection and Content Locking","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-25333","published":"2026-02-19T08:26:57.514Z","updated":"2026-04-28T16:14:55.774Z","title":"WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"peregrinethemes","product":"Shopwell","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25332","published":"2026-02-19T08:26:57.298Z","updated":"2026-04-28T16:14:55.675Z","title":"WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fahad Mahmood","product":"Endless Posts Navigation","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-25331","published":"2026-02-19T08:26:57.085Z","updated":"2026-04-28T16:14:55.538Z","title":"WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-25330","published":"2026-02-19T08:26:56.890Z","updated":"2026-04-28T16:14:55.292Z","title":"WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25329","published":"2026-02-19T08:26:56.704Z","updated":"2026-04-28T16:14:55.549Z","title":"WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25326","published":"2026-02-19T08:26:56.504Z","updated":"2026-04-28T16:14:55.554Z","title":"WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"cmsmasters","product":"CMSMasters Content Composer","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-25325","published":"2026-02-19T08:26:56.293Z","updated":"2026-04-28T16:14:54.890Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"rtCamp","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-25324","published":"2026-02-19T08:26:56.072Z","updated":"2026-04-28T16:14:54.899Z","title":"WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-25323","published":"2026-02-19T08:26:55.891Z","updated":"2026-04-28T16:14:54.877Z","title":"WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"MiKa","product":"OSM","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-25322","published":"2026-02-19T08:26:55.709Z","updated":"2026-04-28T16:14:54.821Z","title":"WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-25321","published":"2026-02-19T08:26:55.525Z","updated":"2026-04-28T16:14:54.916Z","title":"WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25320","published":"2026-02-19T08:26:55.350Z","updated":"2026-04-28T16:14:54.889Z","title":"WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cool Plugins","product":"Elementor Contact Form DB","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-25319","published":"2026-02-19T08:26:55.141Z","updated":"2026-04-28T16:14:54.796Z","title":"WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpzita","product":"Zita Elementor Site Library","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-25318","published":"2026-02-19T08:26:54.880Z","updated":"2026-04-28T16:14:54.811Z","title":"WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wisernotify team","product":"WiserReview Product Reviews for WooCommerce","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25316","published":"2026-02-19T08:26:54.560Z","updated":"2026-04-28T16:14:54.727Z","title":"WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2026-25315","published":"2026-02-19T08:26:54.349Z","updated":"2026-04-28T16:14:54.794Z","title":"WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"hcaptcha","product":"hCaptcha for WP","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-25314","published":"2026-02-19T08:26:54.126Z","updated":"2026-04-28T16:14:54.599Z","title":"WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"TOP Table Of Contents","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25313","published":"2026-02-19T08:26:53.940Z","updated":"2026-04-28T16:14:54.620Z","title":"WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjahan Jewel","product":"FluentForm","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25311","published":"2026-02-19T08:26:53.773Z","updated":"2026-04-28T16:14:54.725Z","title":"WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"10up","product":"Autoshare for Twitter","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-25310","published":"2026-02-19T08:26:53.599Z","updated":"2026-04-28T16:14:54.726Z","title":"WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Alobaidi","product":"Extend Link","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-25308","published":"2026-02-19T08:26:53.408Z","updated":"2026-04-28T16:14:54.724Z","title":"WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25307","published":"2026-02-19T08:26:53.190Z","updated":"2026-04-28T16:14:54.778Z","title":"WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"8theme","product":"XStore Core","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-25305","published":"2026-02-19T08:26:52.704Z","updated":"2026-04-28T16:14:54.312Z","title":"WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-25008","published":"2026-02-19T08:26:52.281Z","updated":"2026-04-28T16:14:53.276Z","title":"WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjahan Jewel","product":"Ninja Tables","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-25006","published":"2026-02-19T08:26:52.080Z","updated":"2026-04-28T16:14:53.207Z","title":"WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-25005","published":"2026-02-19T08:26:51.878Z","updated":"2026-04-28T16:14:53.250Z","title":"WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-25004","published":"2026-02-19T08:26:51.689Z","updated":"2026-04-28T16:14:53.062Z","title":"WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CreativeMindsSolutions","product":"CM Business Directory","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-25003","published":"2026-02-19T08:26:51.515Z","updated":"2026-04-28T16:14:53.181Z","title":"WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"madalin.ungureanu","product":"Client Portal","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-25000","published":"2026-02-19T08:26:51.332Z","updated":"2026-04-28T16:14:52.865Z","title":"WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kraft Plugins","product":"Wheel of Life","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-24999","published":"2026-02-19T08:26:51.141Z","updated":"2026-04-28T16:14:52.851Z","title":"WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Alma","product":"Alma","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-24392","published":"2026-02-19T08:26:50.918Z","updated":"2026-04-28T16:14:48.632Z","title":"WordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Nabil Lemsieh","product":"HurryTimer","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-24375","published":"2026-02-19T08:26:50.736Z","updated":"2026-04-28T16:14:48.126Z","title":"WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Swings","product":"Ultimate Gift Cards For WooCommerce","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-23805","published":"2026-02-19T08:26:50.551Z","updated":"2026-04-28T16:14:47.291Z","title":"WordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Yoren Chang","product":"Media Search Enhanced","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-23804","published":"2026-02-19T08:26:50.356Z","updated":"2026-04-28T16:14:47.286Z","title":"WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"BBR Plugins","product":"Better Business Reviews","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-23803","published":"2026-02-19T08:26:50.148Z","updated":"2026-04-28T16:14:47.229Z","title":"WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Burhan Nasir","product":"Smart Auto Upload Images","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-23549","published":"2026-02-19T08:26:49.962Z","updated":"2026-04-28T16:14:46.842Z","title":"WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-23548","published":"2026-02-19T08:26:49.731Z","updated":"2026-04-28T16:14:46.769Z","title":"WordPress DirectoryPress plugin <= 3.6.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-23547","published":"2026-02-19T08:26:49.398Z","updated":"2026-04-28T16:14:46.775Z","title":"WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"cmsmasters","product":"CMSMasters Content Composer","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-23545","published":"2026-02-19T08:26:49.211Z","updated":"2026-04-28T16:14:46.767Z","title":"WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aruba.it Dev","product":"Aruba HiSpeed Cache","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-23544","published":"2026-02-19T08:26:49.016Z","updated":"2026-04-28T16:14:46.777Z","title":"WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"codetipi","product":"Valenti","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-23543","published":"2026-02-19T08:26:48.831Z","updated":"2026-04-28T16:14:46.698Z","title":"WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-23542","published":"2026-02-19T08:26:48.592Z","updated":"2026-04-28T16:14:46.771Z","title":"WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-23541","published":"2026-02-19T08:26:48.368Z","updated":"2026-04-28T16:14:46.701Z","title":"WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-22422","published":"2026-02-19T08:26:48.111Z","updated":"2026-04-28T17:08:36.498Z","title":"WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpeverest","product":"Everest Forms","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-22333","published":"2026-02-19T08:26:47.849Z","updated":"2026-04-28T16:46:37.968Z","title":"WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":7.2,"vendor":"YITHEMES","product":"YITH WooCommerce Compare","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2026-27056","published":"2026-02-19T08:20:33.197Z","updated":"2026-04-28T16:15:00.906Z","title":"WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StellarWP","product":"iThemes Sync","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2024-31118","published":"2026-02-17T15:04:26.093Z","updated":"2026-04-28T16:09:28.508Z","title":"WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Smartypants","product":"SP Project & Document Manager","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2022-41650","published":"2026-02-17T14:56:33.641Z","updated":"2026-04-28T16:07:49.664Z","title":"WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Paul","product":"Custom Content by Country (by Shield Security)","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-25036","published":"2026-02-03T14:08:41.927Z","updated":"2026-04-28T16:14:54.268Z","title":"WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-25028","published":"2026-02-03T14:08:41.754Z","updated":"2026-04-28T16:14:54.204Z","title":"WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Element Invader","product":"ElementInvader Addons for Elementor","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-25027","published":"2026-02-03T14:08:41.567Z","updated":"2026-04-28T16:14:54.200Z","title":"WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeMove","product":"Unicamp","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-25024","published":"2026-02-03T14:08:41.391Z","updated":"2026-04-28T16:14:54.205Z","title":"WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Blair Williams","product":"ThirstyAffiliates","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-25023","published":"2026-02-03T14:08:40.899Z","updated":"2026-04-28T16:14:54.023Z","title":"WordPress Run Contests, Raffles, and Giveaways with ContestsWP plugin <= 2.0.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mdedev","product":"Run Contests, Raffles, and Giveaways with ContestsWP","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-25022","published":"2026-02-03T14:08:40.657Z","updated":"2026-04-28T16:14:54.084Z","title":"WordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-25021","published":"2026-02-03T14:08:40.392Z","updated":"2026-04-28T16:14:54.203Z","title":"WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mizan Themes","product":"Mizan Demo Importer","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-25020","published":"2026-02-03T14:08:39.869Z","updated":"2026-04-28T16:14:53.964Z","title":"WordPress WP Sync for Notion plugin <= 1.7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP connect","product":"WP Sync for Notion","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-25019","published":"2026-02-03T14:08:39.681Z","updated":"2026-04-28T16:14:53.979Z","title":"WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-25016","published":"2026-02-03T14:08:39.471Z","updated":"2026-04-28T16:14:53.454Z","title":"WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nelio Software","product":"Nelio Popups","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-25015","published":"2026-02-03T14:08:39.297Z","updated":"2026-04-28T16:14:53.665Z","title":"WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-25014","published":"2026-02-03T14:08:39.117Z","updated":"2026-04-28T16:14:53.615Z","title":"WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themelooks","product":"Enter Addons","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-25012","published":"2026-02-03T14:08:38.953Z","updated":"2026-04-28T16:14:53.731Z","title":"WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"gfazioli","product":"WP Bannerize Pro","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-25011","published":"2026-02-03T14:08:38.782Z","updated":"2026-04-28T16:14:53.291Z","title":"WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Northern Beaches Websites","product":"WP Custom Admin Interface","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-25010","published":"2026-02-03T14:08:38.599Z","updated":"2026-04-28T16:14:53.281Z","title":"WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ILLID","product":"Share This Image","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24998","published":"2026-02-03T14:08:38.085Z","updated":"2026-04-28T16:14:52.960Z","title":"WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Hustle","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24997","published":"2026-02-03T14:08:37.755Z","updated":"2026-04-28T16:14:53.263Z","title":"WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wired Impact","product":"Wired Impact Volunteer Management","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24996","published":"2026-02-03T14:08:37.567Z","updated":"2026-04-28T16:14:52.969Z","title":"WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpelemento","product":"WPElemento Importer","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-24995","published":"2026-02-03T14:08:37.390Z","updated":"2026-04-28T16:14:52.812Z","title":"WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Iulia Cazan","product":"Latest Post Shortcode","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-24994","published":"2026-02-03T14:08:37.221Z","updated":"2026-04-28T16:14:52.997Z","title":"WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-24992","published":"2026-02-03T14:08:37.058Z","updated":"2026-04-28T16:14:52.779Z","title":"WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFactory","product":"Advanced WooCommerce Product Sales Reporting","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24991","published":"2026-02-03T14:08:36.896Z","updated":"2026-04-28T16:14:52.757Z","title":"WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"HT Plugins","product":"Extensions For CF7","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-24990","published":"2026-02-03T14:08:36.720Z","updated":"2026-04-28T16:14:52.938Z","title":"WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Fahad Mahmood","product":"WP Docs","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-24988","published":"2026-02-03T14:08:36.560Z","updated":"2026-04-28T16:14:52.531Z","title":"WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brian Hogg","product":"The Events Calendar Shortcode & Block","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-24986","published":"2026-02-03T14:08:36.383Z","updated":"2026-04-28T16:14:52.533Z","title":"WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wp.insider","product":"Simple Membership WP user Import","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-24985","published":"2026-02-03T14:08:36.187Z","updated":"2026-04-28T16:14:52.531Z","title":"WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability","severity":"MEDIUM","score":4.3,"vendor":"approveme","product":"WP Forms Signature Contract Add-On","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24984","published":"2026-02-03T14:08:35.984Z","updated":"2026-04-28T16:14:52.567Z","title":"WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brecht","product":"Visual Link Preview","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-24982","published":"2026-02-03T14:08:35.807Z","updated":"2026-04-28T16:14:52.596Z","title":"WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-24967","published":"2026-02-03T14:08:35.587Z","updated":"2026-04-28T16:14:52.119Z","title":"WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ameliabooking","product":"Amelia","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-24966","published":"2026-02-03T14:08:35.401Z","updated":"2026-04-28T16:14:52.279Z","title":"WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Copyscape","product":"Copyscape Premium","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-24965","published":"2026-02-03T14:08:35.219Z","updated":"2026-04-28T16:14:51.954Z","title":"WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24962","published":"2026-02-03T14:08:35.015Z","updated":"2026-04-28T16:14:51.935Z","title":"WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"Sigmize","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-24961","published":"2026-02-03T14:08:34.791Z","updated":"2026-04-28T16:14:52.194Z","title":"WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Blog","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-24958","published":"2026-02-03T14:08:34.584Z","updated":"2026-04-28T16:14:51.923Z","title":"WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-24957","published":"2026-02-03T14:08:34.412Z","updated":"2026-04-28T16:14:51.903Z","title":"WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-24954","published":"2026-02-03T14:08:34.208Z","updated":"2026-04-28T16:14:51.930Z","title":"WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-24952","published":"2026-02-03T14:08:34.011Z","updated":"2026-04-28T16:14:51.252Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-24951","published":"2026-02-03T14:08:33.829Z","updated":"2026-04-28T16:14:51.254Z","title":"WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24947","published":"2026-02-03T14:08:33.637Z","updated":"2026-04-28T16:14:51.242Z","title":"WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24945","published":"2026-02-03T14:08:33.446Z","updated":"2026-04-28T16:14:51.251Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-24942","published":"2026-02-03T14:08:33.242Z","updated":"2026-04-28T16:14:50.970Z","title":"WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-24940","published":"2026-02-03T14:08:32.886Z","updated":"2026-04-28T16:14:50.958Z","title":"WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themefic","product":"Travelfic Toolkit","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24939","published":"2026-02-03T14:08:32.513Z","updated":"2026-04-28T16:14:51.243Z","title":"WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24938","published":"2026-02-03T14:08:32.191Z","updated":"2026-04-28T16:14:50.970Z","title":"WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ajay","product":"Better Search","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2024-54263","published":"2026-02-02T09:11:13.486Z","updated":"2026-04-28T16:10:48.550Z","title":"WordPress Spirit Framework plugin <= 1.2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Talemy","product":"Spirit Framework","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-24636","published":"2026-01-23T14:29:09.318Z","updated":"2026-04-28T16:14:50.847Z","title":"WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"Sugar Calendar (Lite)","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24635","published":"2026-01-23T14:29:09.152Z","updated":"2026-04-28T16:14:50.927Z","title":"WordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"DevsBlink","product":"EduBlink Core","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-24634","published":"2026-01-23T14:29:08.973Z","updated":"2026-04-28T16:14:50.936Z","title":"WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Rustaurius","product":"Ultimate Reviews","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-24633","published":"2026-01-23T14:29:08.810Z","updated":"2026-04-28T16:14:51.181Z","title":"WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Passionate Brains","product":"Add Expires Headers & Optimized Minify","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-24632","published":"2026-01-23T14:29:08.647Z","updated":"2026-04-28T16:14:50.927Z","title":"WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"jagdish1o1","product":"Delay Redirects","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-24631","published":"2026-01-23T14:29:08.452Z","updated":"2026-04-28T16:14:50.698Z","title":"WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Rosebud","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24630","published":"2026-01-23T14:29:08.236Z","updated":"2026-04-28T16:14:50.686Z","title":"WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Design","product":"Stylish Cost Calculator","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-24629","published":"2026-01-23T14:29:08.053Z","updated":"2026-04-28T16:14:50.641Z","title":"WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ability, Inc","product":"Web Accessibility with Max Access","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-24627","published":"2026-01-23T14:29:07.850Z","updated":"2026-04-28T16:14:50.801Z","title":"WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Trusona","product":"Trusona for WordPress","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-24626","published":"2026-01-23T14:29:07.664Z","updated":"2026-04-28T16:14:50.656Z","title":"WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"LogicHunt","product":"Logo Slider","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-24625","published":"2026-01-23T14:29:07.478Z","updated":"2026-04-28T16:14:50.636Z","title":"WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Imaginate Solutions","product":"File Uploads Addon for WooCommerce","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-24624","published":"2026-01-23T14:29:07.293Z","updated":"2026-04-28T16:14:50.671Z","title":"WordPress Neoforum plugin <= 1.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"saeros1984","product":"Neoforum","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2026-24623","published":"2026-01-23T14:29:07.026Z","updated":"2026-04-28T16:14:50.802Z","title":"WordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"saeros1984","product":"Neoforum","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-24622","published":"2026-01-23T14:29:06.858Z","updated":"2026-04-28T16:14:50.669Z","title":"WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Sergiy Dzysyak","product":"Suggestion Toolkit","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-24621","published":"2026-01-23T14:29:06.520Z","updated":"2026-04-28T16:14:50.383Z","title":"WordPress Terms descriptions plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Vladimir Statsenko","product":"Terms descriptions","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-24620","published":"2026-01-23T14:29:06.060Z","updated":"2026-04-28T16:14:50.380Z","title":"WordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"PluginOps","product":"Landing Page Builder","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-24619","published":"2026-01-23T14:29:05.887Z","updated":"2026-04-28T16:14:50.406Z","title":"WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PopCash","product":"PopCash.Net Code Integration Tool","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24617","published":"2026-01-23T14:29:05.696Z","updated":"2026-04-28T16:14:50.395Z","title":"WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Daniel Iser","product":"Easy Modal","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-24616","published":"2026-01-23T14:29:05.461Z","updated":"2026-04-28T16:14:50.395Z","title":"WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Damian","product":"WP Popups","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-24615","published":"2026-01-23T14:29:05.288Z","updated":"2026-04-28T16:14:50.391Z","title":"WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Cream Magazine","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24614","published":"2026-01-23T14:29:05.119Z","updated":"2026-04-28T16:14:50.425Z","title":"WordPress Flex QR Code Generator plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Devsbrain","product":"Flex QR Code Generator","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-24613","published":"2026-01-23T14:29:04.954Z","updated":"2026-04-28T16:14:50.380Z","title":"WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ecwid by Lightspeed Ecommerce Shopping Cart","product":"Ecwid Shopping Cart","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-24612","published":"2026-01-23T14:29:04.803Z","updated":"2026-04-28T16:14:50.347Z","title":"WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Orchid Store","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24609","published":"2026-01-23T14:29:04.648Z","updated":"2026-04-28T16:14:50.325Z","title":"WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Elated-Themes","product":"Laurent","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-24608","published":"2026-01-23T14:29:04.452Z","updated":"2026-04-28T16:14:50.235Z","title":"WordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Elated-Themes","product":"Laurent Core","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-24607","published":"2026-01-23T14:29:04.281Z","updated":"2026-04-28T16:14:50.304Z","title":"WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wptravelengine","product":"Travel Monster","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-24606","published":"2026-01-23T14:29:04.107Z","updated":"2026-04-28T16:14:50.315Z","title":"WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Web Impian","product":"Bayarcash WooCommerce","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-24605","published":"2026-01-23T14:29:03.924Z","updated":"2026-04-28T16:14:50.172Z","title":"WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"pencilwp","product":"X Addons for Elementor","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-24604","published":"2026-01-23T14:29:03.770Z","updated":"2026-04-28T16:14:50.330Z","title":"WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Simple GDPR Cookie Compliance","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-24603","published":"2026-01-23T14:29:03.593Z","updated":"2026-04-28T16:14:50.344Z","title":"WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Universal Google Adsense and Ads manager","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-24601","published":"2026-01-23T14:29:03.210Z","updated":"2026-04-28T16:14:50.176Z","title":"WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Pay Writer","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-24600","published":"2026-01-23T14:29:02.944Z","updated":"2026-04-28T16:14:50.188Z","title":"WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Review","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-24599","published":"2026-01-23T14:29:02.765Z","updated":"2026-04-28T16:14:50.164Z","title":"WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"XLPlugins","product":"NextMove Lite","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-24598","published":"2026-01-23T14:29:02.568Z","updated":"2026-04-28T16:14:50.338Z","title":"WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bestwebsoft","product":"Multilanguage by BestWebSoft","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-24596","published":"2026-01-23T14:29:02.365Z","updated":"2026-04-28T16:14:49.801Z","title":"WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"marynixie","product":"Related Posts Thumbnails Plugin for WordPress","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-24595","published":"2026-01-23T14:29:01.997Z","updated":"2026-04-28T16:14:49.757Z","title":"WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"zohocrm","product":"Zoho CRM Lead Magnet","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-24594","published":"2026-01-23T14:29:01.518Z","updated":"2026-04-28T16:14:49.763Z","title":"WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"livemesh","product":"Livemesh Addons for WPBakery Page Builder","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-24593","published":"2026-01-23T14:29:01.171Z","updated":"2026-04-28T16:14:49.785Z","title":"WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Strategy11 Team","product":"AWP Classifieds","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-24591","published":"2026-01-23T14:29:00.969Z","updated":"2026-04-28T16:14:49.787Z","title":"WordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"yasir129","product":"Turn Yoast SEO FAQ Block to Accordion","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-24589","published":"2026-01-23T14:29:00.794Z","updated":"2026-04-28T16:14:49.736Z","title":"WordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cargus eCommerce","product":"Cargus","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-24588","published":"2026-01-23T14:29:00.620Z","updated":"2026-04-28T16:14:49.801Z","title":"WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"topdevs","product":"Smart Product Viewer","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-24587","published":"2026-01-23T14:29:00.239Z","updated":"2026-04-28T16:14:49.802Z","title":"WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"kutsy","product":"AJAX Hits Counter + Popular Posts Widget","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-24585","published":"2026-01-23T14:28:59.828Z","updated":"2026-04-28T16:14:49.765Z","title":"WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hyyan Abo Fakher","product":"Hyyan WooCommerce Polylang Integration","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-24584","published":"2026-01-23T14:28:59.642Z","updated":"2026-04-28T16:14:49.758Z","title":"WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themeum","product":"Tutor LMS BunnyNet Integration","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-24583","published":"2026-01-23T14:28:59.442Z","updated":"2026-04-28T16:14:49.751Z","title":"WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sumup","product":"SumUp Payment Gateway For WooCommerce","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-24581","published":"2026-01-23T14:28:59.230Z","updated":"2026-04-28T16:14:49.797Z","title":"WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Swings","product":"Points and Rewards for WooCommerce","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-24580","published":"2026-01-23T14:28:59.009Z","updated":"2026-04-28T16:14:49.744Z","title":"WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ecwid by Lightspeed Ecommerce Shopping Cart","product":"Ecwid Shopping Cart","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24579","published":"2026-01-23T14:28:58.842Z","updated":"2026-04-28T16:14:49.764Z","title":"WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"Ai Image Alt Text Generator for WP","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24578","published":"2026-01-23T14:28:58.618Z","updated":"2026-04-28T16:14:49.742Z","title":"WordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jahid Hasan","product":"Admin login URL Change","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24577","published":"2026-01-23T14:28:57.456Z","updated":"2026-04-28T16:14:49.762Z","title":"WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Genetech Products","product":"Pie Register","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-24576","published":"2026-01-23T14:28:57.282Z","updated":"2026-04-28T16:14:49.786Z","title":"WordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"COP","product":"UX Flat","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-24572","published":"2026-01-23T14:28:57.109Z","updated":"2026-04-28T16:14:49.763Z","title":"WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Nelio Software","product":"Nelio Content","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-24571","published":"2026-01-23T14:28:56.952Z","updated":"2026-04-28T16:14:49.711Z","title":"WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"boxnow","product":"BOX NOW Delivery","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24570","published":"2026-01-23T14:28:56.795Z","updated":"2026-04-28T16:14:49.800Z","title":"WordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WisdmLabs","product":"Edwiser Bridge","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-24569","published":"2026-01-23T14:28:56.622Z","updated":"2026-04-28T16:14:49.341Z","title":"WordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sully","product":"Media Library File Size","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24568","published":"2026-01-23T14:28:56.433Z","updated":"2026-04-28T16:14:49.315Z","title":"WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Travel","product":"WP Travel","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-24567","published":"2026-01-23T14:28:56.196Z","updated":"2026-04-28T16:14:49.298Z","title":"WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"briarinc","product":"Anything Order by Terms","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-24566","published":"2026-01-23T14:28:56.024Z","updated":"2026-04-28T16:14:49.334Z","title":"WordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iNET","product":"iNET Webkit","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-24565","published":"2026-01-23T14:28:55.844Z","updated":"2026-04-28T16:14:49.310Z","title":"WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Accordion","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-24564","published":"2026-01-23T14:28:55.667Z","updated":"2026-04-28T16:14:49.316Z","title":"WordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Israpil","product":"Textmetrics","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-24563","published":"2026-01-23T14:28:55.472Z","updated":"2026-04-28T16:14:49.327Z","title":"WordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ashan Perera","product":"LifePress","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24562","published":"2026-01-23T14:28:55.304Z","updated":"2026-04-28T16:14:49.318Z","title":"WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ryviu","product":"Ryviu – Product Reviews for WooCommerce","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-24561","published":"2026-01-23T14:28:55.132Z","updated":"2026-04-28T16:14:49.311Z","title":"WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-24560","published":"2026-01-23T14:28:54.961Z","updated":"2026-04-28T16:14:49.311Z","title":"WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Cloudinary","product":"Cloudinary","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-24559","published":"2026-01-23T14:28:54.762Z","updated":"2026-04-28T16:14:49.295Z","title":"WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CRM Perks","product":"Integration for Contact Form 7 HubSpot","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-24558","published":"2026-01-23T14:28:54.415Z","updated":"2026-04-28T16:14:49.328Z","title":"WordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"antoniobg","product":"ABG Rich Pins","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-24557","published":"2026-01-23T14:28:54.087Z","updated":"2026-04-28T16:14:49.316Z","title":"WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WEN Solutions","product":"Contact Form 7 GetResponse Extension","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-24556","published":"2026-01-23T14:28:53.780Z","updated":"2026-04-28T16:14:49.082Z","title":"WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdive","product":"ElementCamp","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-24555","published":"2026-01-23T14:28:53.602Z","updated":"2026-04-28T16:14:49.081Z","title":"WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"artplacer","product":"ArtPlacer Widget","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-24553","published":"2026-01-23T14:28:53.445Z","updated":"2026-04-28T16:14:49.201Z","title":"WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dotstore","product":"Fraud Prevention For Woocommerce","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-24551","published":"2026-01-23T14:28:53.243Z","updated":"2026-04-28T16:14:49.243Z","title":"WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"monetagwp","product":"Monetag Official Plugin","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-24550","published":"2026-01-23T14:28:53.038Z","updated":"2026-04-28T16:14:49.088Z","title":"WordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaira","product":"Blockons","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-24549","published":"2026-01-23T14:28:52.855Z","updated":"2026-04-28T16:14:49.105Z","title":"WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-24548","published":"2026-01-23T14:28:52.689Z","updated":"2026-04-28T16:14:49.120Z","title":"WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"princeahmed","product":"Radio Player","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-24544","published":"2026-01-23T14:28:52.527Z","updated":"2026-04-28T16:14:49.112Z","title":"WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Harmonic Design","product":"HD Quiz","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24543","published":"2026-01-23T14:28:52.349Z","updated":"2026-04-28T16:14:48.901Z","title":"WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Horea Radu","product":"Materialis Companion","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24542","published":"2026-01-23T14:28:52.180Z","updated":"2026-04-28T16:14:48.889Z","title":"WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"John James Jacoby","product":"WP Term Order","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-24541","published":"2026-01-23T14:28:52.011Z","updated":"2026-04-28T16:14:48.874Z","title":"WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mkscripts","product":"Download After Email","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-24540","published":"2026-01-23T14:28:51.836Z","updated":"2026-04-28T16:14:48.837Z","title":"WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"princeahmed","product":"Integrate Google Drive","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-24539","published":"2026-01-23T14:28:51.673Z","updated":"2026-04-28T16:14:48.808Z","title":"WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ABCdatos","product":"Protección de datos – RGPD","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-24538","published":"2026-01-23T14:28:51.465Z","updated":"2026-04-28T16:14:48.823Z","title":"WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"omnipressteam","product":"Omnipress","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-24536","published":"2026-01-23T14:28:51.281Z","updated":"2026-04-28T16:14:48.790Z","title":"WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"webpushr","product":"Webpushr","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-24535","published":"2026-01-23T14:28:51.072Z","updated":"2026-04-28T16:14:48.760Z","title":"WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"webdevstudios","product":"Automatic Featured Images from Videos","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-24534","published":"2026-01-23T14:28:50.880Z","updated":"2026-04-28T16:14:48.792Z","title":"WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"uPress","product":"Booter","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-24532","published":"2026-01-23T14:28:50.669Z","updated":"2026-04-28T16:14:48.776Z","title":"WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SiteLock","product":"SiteLock Security – WP Hardening, Login Security & Malware Scans","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-24531","published":"2026-01-23T14:28:50.369Z","updated":"2026-11-03T22:13:22.072Z","title":"WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Prowess","kev":false,"epss":0.00547,"kevAdded":null},{"id":"CVE-2026-24530","published":"2026-01-23T14:28:50.001Z","updated":"2026-04-28T16:14:48.746Z","title":"WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sheepfish","product":"WebP Conversion","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-24529","published":"2026-01-23T14:28:49.756Z","updated":"2026-04-28T16:14:48.775Z","title":"WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Alejandro","product":"Quick Restaurant Reservations","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-24528","published":"2026-01-23T14:28:49.493Z","updated":"2026-04-28T16:14:48.717Z","title":"WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pixelgrade","product":"Nova Blocks","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-24526","published":"2026-01-23T14:28:49.302Z","updated":"2026-04-28T16:14:48.806Z","title":"WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Steve Truman","product":"Email Inquiry & Cart Options for WooCommerce","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-24525","published":"2026-01-23T14:28:49.126Z","updated":"2026-04-28T16:14:48.792Z","title":"WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CloudPanel","product":"CLP Varnish Cache","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-24524","published":"2026-01-23T14:28:48.944Z","updated":"2026-04-28T16:14:48.764Z","title":"WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Essekia","product":"Tablesome","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-24523","published":"2026-01-23T14:28:48.770Z","updated":"2026-04-28T16:14:48.745Z","title":"WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Marcus (aka @msykes)","product":"WP FullCalendar","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-24522","published":"2026-01-23T14:28:48.570Z","updated":"2026-04-28T16:14:48.774Z","title":"WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"MyThemeShop","product":"WP Subscribe","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24521","published":"2026-01-23T14:28:48.396Z","updated":"2026-04-28T16:14:48.734Z","title":"WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Timur Kamaev","product":"Kama Thumbnail","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-22359","published":"2026-01-22T16:56:49.215Z","updated":"2026-04-28T17:48:30.424Z","title":"WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AA-Team","product":"Wordpress Movies Bulk Importer","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-24390","published":"2026-01-22T16:52:48.114Z","updated":"2026-04-28T16:14:48.603Z","title":"WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"QantumThemes","product":"Kentha Elementor Widgets","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-24389","published":"2026-01-22T16:52:47.889Z","updated":"2026-04-28T16:14:48.526Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-24388","published":"2026-01-22T16:52:47.690Z","updated":"2026-04-28T16:14:48.555Z","title":"WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ludwig You","product":"WPMasterToolKit","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24387","published":"2026-01-22T16:52:47.509Z","updated":"2026-04-28T16:14:48.457Z","title":"WordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arul Prasad J","product":"WP Quick Post Duplicator","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-24386","published":"2026-01-22T16:52:47.316Z","updated":"2026-04-28T16:14:48.526Z","title":"WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Element Invader","product":"Element Invader – Template Kits for Elementor","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-24384","published":"2026-01-22T16:52:47.121Z","updated":"2026-04-28T16:14:48.376Z","title":"WordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"launchinteractive","product":"Merge + Minify + Refresh","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-24383","published":"2026-01-22T16:52:46.919Z","updated":"2026-04-28T16:14:48.420Z","title":"WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-24381","published":"2026-01-22T16:52:46.716Z","updated":"2026-04-28T16:14:48.377Z","title":"WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"PhotoMe","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-24380","published":"2026-01-22T16:52:46.530Z","updated":"2026-11-03T22:13:21.932Z","title":"WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-24379","published":"2026-01-22T16:52:46.322Z","updated":"2026-04-28T16:14:48.377Z","title":"WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-24377","published":"2026-01-22T16:52:46.045Z","updated":"2026-04-28T16:14:48.306Z","title":"WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"POSIMYTH","product":"Nexter Blocks","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-24374","published":"2026-01-22T16:52:45.846Z","updated":"2026-04-28T16:14:47.968Z","title":"WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-24371","published":"2026-01-22T16:52:45.641Z","updated":"2026-04-28T16:14:47.894Z","title":"WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bookingalgorithms","product":"BA Book Everything","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-24368","published":"2026-01-22T16:52:45.439Z","updated":"2026-09-01T14:42:05.574Z","title":"WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeOne","product":"The Grid","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-24367","published":"2026-01-22T16:52:45.218Z","updated":"2026-04-28T16:14:48.277Z","title":"WordPress Traveler theme < 3.2.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-24366","published":"2026-01-22T16:52:44.884Z","updated":"2026-04-28T16:14:47.996Z","title":"WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITHEMES","product":"YITH WooCommerce Request A Quote","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-24365","published":"2026-01-22T16:52:44.706Z","updated":"2026-04-28T16:14:47.927Z","title":"WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"storeapps","product":"Stock Manager for WooCommerce","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-24361","published":"2026-01-22T16:52:44.475Z","updated":"2026-04-28T16:14:48.025Z","title":"WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThimPress","product":"LearnPress – Course Review","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-24360","published":"2026-01-22T16:52:44.261Z","updated":"2026-04-28T16:14:47.972Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-24358","published":"2026-01-22T16:52:44.066Z","updated":"2026-04-28T16:14:47.844Z","title":"WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-24357","published":"2026-01-22T16:52:43.886Z","updated":"2026-04-28T16:14:47.734Z","title":"WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brecht","product":"WP Recipe Maker","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-24356","published":"2026-01-22T16:52:43.691Z","updated":"2026-04-28T16:14:47.473Z","title":"WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Roxnor","product":"GetGenie","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-24355","published":"2026-01-22T16:52:43.498Z","updated":"2026-04-28T16:14:47.314Z","title":"WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"favethemes","product":"Houzez Theme - Functionality","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-24354","published":"2026-01-22T16:52:43.319Z","updated":"2026-04-28T16:14:47.300Z","title":"WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Shortcodes & Performance","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-24353","published":"2026-01-22T16:52:43.122Z","updated":"2026-04-28T16:14:47.666Z","title":"WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-23978","published":"2026-01-22T16:52:42.908Z","updated":"2026-04-28T16:14:47.274Z","title":"WordPress Gyan Elements plugin <= 2.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Softwebmedia","product":"Gyan Elements","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-23976","published":"2026-01-22T16:52:42.701Z","updated":"2026-04-28T16:14:47.335Z","title":"WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-23975","published":"2026-01-22T16:52:42.488Z","updated":"2026-04-28T16:14:47.308Z","title":"WordPress Golo theme < 1.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-23974","published":"2026-01-22T16:52:42.305Z","updated":"2026-04-28T16:14:47.515Z","title":"WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-22483","published":"2026-01-22T16:52:42.093Z","updated":"2026-04-28T17:19:27.863Z","title":"WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"winkm89","product":"teachPress","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-22482","published":"2026-01-22T16:52:41.909Z","updated":"2026-04-28T17:19:18.930Z","title":"WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"wbolt.com","product":"IMGspider","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-22481","published":"2026-01-22T16:52:41.710Z","updated":"2026-04-28T17:19:10.174Z","title":"WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rasedul Haque Rumi","product":"BD Courier Order Ratio Checker","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-22472","published":"2026-01-22T16:52:41.505Z","updated":"2026-04-28T17:17:52.350Z","title":"WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"hassantafreshi","product":"Easy Form Builder","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-22470","published":"2026-01-22T16:52:41.313Z","updated":"2026-04-28T17:17:35.626Z","title":"WordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"FireStorm Plugins","product":"FireStorm Professional Real Estate","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-22469","published":"2026-01-22T16:52:41.116Z","updated":"2026-04-28T17:17:26.457Z","title":"WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mwtemplates","product":"DeepDigital","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-22468","published":"2026-01-22T16:52:40.915Z","updated":"2026-04-28T17:17:18.192Z","title":"WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AbsolutePlugins","product":"Absolute Addons For Elementor","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-22466","published":"2026-01-22T16:52:40.713Z","updated":"2026-04-28T17:17:01.031Z","title":"WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Chandni Patel","product":"WP MapIt","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-22464","published":"2026-01-22T16:52:40.530Z","updated":"2026-04-28T17:16:43.111Z","title":"WordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-22463","published":"2026-01-22T16:52:40.304Z","updated":"2026-04-28T17:16:34.713Z","title":"WordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Micro.company","product":"Form to Chat App","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-22462","published":"2026-01-22T16:52:40.088Z","updated":"2026-04-28T17:16:26.368Z","title":"WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"richardevcom","product":"Add Polylang support for Customizer","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-22461","published":"2026-01-22T16:52:39.747Z","updated":"2026-04-28T17:16:18.129Z","title":"WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebAppick","product":"CTX Feed","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-22458","published":"2026-01-22T16:52:39.562Z","updated":"2026-04-28T17:15:52.793Z","title":"WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mikado-Themes","product":"Wanderland","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-22450","published":"2026-01-22T16:52:39.366Z","updated":"2026-04-28T17:14:43.580Z","title":"WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Select-Themes","product":"Don Peppe","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-22447","published":"2026-01-22T16:52:39.172Z","updated":"2026-04-28T17:11:59.335Z","title":"WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Select-Themes","product":"Prowess","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-22445","published":"2026-01-22T16:52:38.969Z","updated":"2026-04-28T17:11:42.507Z","title":"WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Proptech Plugin","product":"Apimo Connector","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-22430","published":"2026-01-22T16:52:38.780Z","updated":"2026-04-28T17:09:45.319Z","title":"WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Verdure","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22426","published":"2026-01-22T16:52:38.525Z","updated":"2026-04-28T17:09:10.045Z","title":"WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Elated-Themes","product":"Sweet Jane","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22411","published":"2026-01-22T16:52:38.328Z","updated":"2026-04-28T17:06:59.157Z","title":"WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Dolcino","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22409","published":"2026-01-22T16:52:38.126Z","updated":"2026-04-28T17:06:41.310Z","title":"WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Justicia","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22407","published":"2026-01-22T16:52:37.888Z","updated":"2026-04-28T16:56:45.316Z","title":"WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Roam","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22406","published":"2026-01-22T16:52:37.692Z","updated":"2026-04-28T16:56:36.673Z","title":"WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Overton","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22404","published":"2026-01-22T16:52:37.468Z","updated":"2026-04-28T16:56:20.045Z","title":"WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Innovio","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-22402","published":"2026-01-22T16:52:37.280Z","updated":"2026-04-28T16:56:03.378Z","title":"WordPress Triply theme <= 2.4.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"pavothemes","product":"Triply","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-22401","published":"2026-01-22T16:52:37.071Z","updated":"2026-04-28T16:55:54.530Z","title":"WordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"pavothemes","product":"Freshio","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-22400","published":"2026-01-22T16:52:36.847Z","updated":"2026-04-28T16:55:45.839Z","title":"WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Holmes","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22398","published":"2026-01-22T16:52:36.563Z","updated":"2026-04-28T16:55:29.002Z","title":"WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Fleur","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22396","published":"2026-01-22T16:52:36.370Z","updated":"2026-04-28T16:55:12.594Z","title":"WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Fiorello","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22393","published":"2026-01-22T16:52:36.166Z","updated":"2026-04-28T16:54:47.000Z","title":"WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Curly","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22391","published":"2026-01-22T16:52:35.937Z","updated":"2026-04-28T16:54:29.740Z","title":"WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Cocco","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-22388","published":"2026-01-22T16:52:35.756Z","updated":"2026-04-28T16:54:03.994Z","title":"WordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Imran Emu","product":"Owl Carousel WP","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-22382","published":"2026-01-22T16:52:35.559Z","updated":"2026-04-28T16:53:22.017Z","title":"WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"PawFriends - Pet Shop and Veterinary WordPress Theme","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-22360","published":"2026-01-22T16:52:35.360Z","updated":"2026-04-28T16:49:02.797Z","title":"WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AA-Team","product":"SearchAzon","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-22358","published":"2026-01-22T16:52:34.992Z","updated":"2026-04-28T16:48:54.545Z","title":"WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SmartDataSoft","product":"Electrician - Electrical Service WordPress","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-22355","published":"2026-01-22T16:52:34.792Z","updated":"2026-04-28T16:48:28.925Z","title":"WordPress Simple XML Sitemap plugin <= 1.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"gregmolnar","product":"Simple XML Sitemap","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-22353","published":"2026-01-22T16:52:34.577Z","updated":"2026-04-28T16:48:11.190Z","title":"WordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"winkm89","product":"teachPress","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-22349","published":"2026-01-22T16:52:34.382Z","updated":"2026-04-28T16:47:37.572Z","title":"WordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"linux4me2","product":"Menu In Post","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-22348","published":"2026-01-22T16:52:34.203Z","updated":"2026-04-28T16:47:29.076Z","title":"WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tasos Fel","product":"Civic Cookie Control","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-22347","published":"2026-01-22T16:52:34.003Z","updated":"2026-04-28T16:47:20.626Z","title":"WordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"subhansanjaya","product":"Carousel Horizontal Posts Content Slider","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-69321","published":"2026-01-22T16:52:33.817Z","updated":"2026-04-28T20:51:57.888Z","title":"WordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Spa","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-69320","published":"2026-01-22T16:52:33.616Z","updated":"2026-04-28T20:51:30.261Z","title":"WordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Magazine","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69319","published":"2026-01-22T16:52:33.399Z","updated":"2026-04-28T20:49:04.980Z","title":"WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.5,"vendor":"Beaver Builder","product":"Beaver Builder","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-69318","published":"2026-01-22T16:52:33.213Z","updated":"2026-04-28T20:48:54.270Z","title":"WordPress JobWP plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hossni Mubarak","product":"JobWP","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69317","published":"2026-01-22T16:52:33.014Z","updated":"2026-04-28T16:14:37.310Z","title":"WordPress CarSpot theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"CarSpot","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69316","published":"2026-01-22T16:52:32.711Z","updated":"2026-04-28T16:14:37.549Z","title":"WordPress TableOn plugin <= 1.0.4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69315","published":"2026-01-22T16:52:32.496Z","updated":"2026-04-28T20:48:45.320Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-69314","published":"2026-01-22T16:52:32.306Z","updated":"2026-04-28T20:48:34.624Z","title":"WordPress Werkstatt theme < 4.8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"fuelthemes","product":"Werkstatt","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69313","published":"2026-01-22T16:52:32.119Z","updated":"2026-04-28T20:48:25.367Z","title":"WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPXPO","product":"PostX","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-69312","published":"2026-01-22T16:52:31.919Z","updated":"2026-04-28T20:48:14.819Z","title":"WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-69311","published":"2026-01-22T16:52:31.715Z","updated":"2026-04-28T20:48:04.512Z","title":"WordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Broadstreet","product":"Broadstreet Ads","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-69300","published":"2026-01-22T16:52:31.523Z","updated":"2026-04-28T16:14:37.046Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-69293","published":"2026-01-22T16:52:31.224Z","updated":"2026-04-28T20:45:32.987Z","title":"WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"Final User","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-69292","published":"2026-01-22T16:52:30.940Z","updated":"2026-04-28T20:45:22.845Z","title":"WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"WP Membership","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-69193","published":"2026-01-22T16:52:30.754Z","updated":"2026-04-28T20:45:12.104Z","title":"WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"WP Membership","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69192","published":"2026-01-22T16:52:30.539Z","updated":"2026-04-28T20:45:02.695Z","title":"WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Real Estate Pro","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69191","published":"2026-01-22T16:52:30.343Z","updated":"2026-04-28T20:44:52.399Z","title":"WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"ListingHub","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69190","published":"2026-01-22T16:52:30.107Z","updated":"2026-04-28T20:44:42.997Z","title":"WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Listihub","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69188","published":"2026-01-22T16:52:29.873Z","updated":"2026-04-28T20:44:31.475Z","title":"WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"fitness-trainer","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69187","published":"2026-01-22T16:52:29.619Z","updated":"2026-04-28T20:44:22.595Z","title":"WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Final User","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69186","published":"2026-01-22T16:52:29.403Z","updated":"2026-04-28T20:44:12.143Z","title":"WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Hospital Doctor Directory","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69185","published":"2026-01-22T16:52:29.210Z","updated":"2026-04-28T20:44:02.617Z","title":"WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Hotel Listing","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69184","published":"2026-01-22T16:52:29.027Z","updated":"2026-04-28T20:43:52.334Z","title":"WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Institutions Directory","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69183","published":"2026-01-22T16:52:28.822Z","updated":"2026-04-28T20:43:42.039Z","title":"WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"Hospital Doctor Directory","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2025-69182","published":"2026-01-22T16:52:28.620Z","updated":"2026-04-28T20:43:30.662Z","title":"WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"Institutions Directory","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2025-69181","published":"2026-01-22T16:52:28.414Z","updated":"2026-04-28T20:43:20.812Z","title":"WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"e-plugins","product":"Lawyer Directory","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-69180","published":"2026-01-22T16:52:28.160Z","updated":"2026-04-28T16:14:36.611Z","title":"WordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"themepassion","product":"Ultra Portfolio","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-69102","published":"2026-01-22T16:52:27.736Z","updated":"2026-04-28T20:43:09.118Z","title":"WordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Boopathi Rajan","product":"WP Test Email","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-69101","published":"2026-01-22T16:52:27.433Z","updated":"2026-04-28T20:42:58.087Z","title":"WordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2025-69100","published":"2026-01-22T16:52:27.045Z","updated":"2026-04-28T20:42:48.280Z","title":"WordPress North theme <= 5.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"fuelthemes","product":"North","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-69099","published":"2026-01-22T16:52:26.676Z","updated":"2026-04-28T20:42:37.629Z","title":"WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"fuelthemes","product":"North","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-69098","published":"2026-01-22T16:52:26.420Z","updated":"2026-04-28T16:14:36.586Z","title":"WordPress Hide My WP plugin <= 6.2.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpWave","product":"Hide My WP","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69097","published":"2026-01-22T16:52:26.228Z","updated":"2026-04-28T16:14:36.552Z","title":"WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00531,"kevAdded":null},{"id":"CVE-2025-69095","published":"2026-01-22T16:52:26.044Z","updated":"2026-04-28T16:14:36.503Z","title":"WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"designthemes","product":"Reservation Plugin","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-69079","published":"2026-01-22T16:52:25.835Z","updated":"2026-04-28T20:41:27.552Z","title":"WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Sound | Musical Instruments Online Store","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-69078","published":"2026-01-22T16:52:25.630Z","updated":"2026-04-28T20:41:16.969Z","title":"WordPress Malta theme <= 1.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Malta","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69077","published":"2026-01-22T16:52:25.403Z","updated":"2026-04-28T20:41:07.241Z","title":"WordPress Hobo theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Hobo","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69076","published":"2026-01-22T16:52:25.218Z","updated":"2026-04-28T20:40:55.972Z","title":"WordPress Modern Housewife theme <= 1.0.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Modern Housewife","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69075","published":"2026-01-22T16:52:25.004Z","updated":"2026-04-28T20:40:45.508Z","title":"WordPress Yolox theme <= 1.0.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Yolox","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69074","published":"2026-01-22T16:52:24.806Z","updated":"2026-04-28T16:14:36.009Z","title":"WordPress Pearson Specter theme <= 1.11.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Pearson Specter","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69073","published":"2026-01-22T16:52:24.584Z","updated":"2026-04-28T20:39:41.194Z","title":"WordPress Piqes theme <= 1.0.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Piqes","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69072","published":"2026-01-22T16:52:24.382Z","updated":"2026-04-28T20:39:29.801Z","title":"WordPress Prider theme <= 1.1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Prider","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69071","published":"2026-01-22T16:52:24.186Z","updated":"2026-04-28T20:39:20.338Z","title":"WordPress TanTum theme <= 1.1.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"TanTum","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69070","published":"2026-01-22T16:52:23.978Z","updated":"2026-04-28T20:39:09.498Z","title":"WordPress Tornados theme <= 2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Tornados","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69068","published":"2026-01-22T16:52:23.772Z","updated":"2026-04-28T20:39:00.772Z","title":"WordPress Muji theme <= 1.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Muji","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69067","published":"2026-01-22T16:52:23.509Z","updated":"2026-04-28T20:38:50.185Z","title":"WordPress Tails theme <= 1.4.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Tails","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69066","published":"2026-01-22T16:52:23.315Z","updated":"2026-04-28T20:38:40.579Z","title":"WordPress Indoor Plants theme <= 1.2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Indoor Plants","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69065","published":"2026-01-22T16:52:23.109Z","updated":"2026-04-28T20:38:30.650Z","title":"WordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Snow Mountain","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69064","published":"2026-01-22T16:52:22.874Z","updated":"2026-04-28T20:38:21.628Z","title":"WordPress Pets Land theme <= 1.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Pets Land","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69062","published":"2026-01-22T16:52:22.689Z","updated":"2026-04-28T20:38:10.881Z","title":"WordPress Weedles theme <= 1.1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Weedles","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69061","published":"2026-01-22T16:52:22.452Z","updated":"2026-04-28T20:38:00.531Z","title":"WordPress MoveMe theme <= 1.2.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"MoveMe","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69060","published":"2026-01-22T16:52:22.253Z","updated":"2026-04-28T20:37:49.870Z","title":"WordPress uReach theme <= 1.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"uReach","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69059","published":"2026-01-22T16:52:22.064Z","updated":"2026-04-28T20:37:40.263Z","title":"WordPress DiveIt theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"DiveIt","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69058","published":"2026-01-22T16:52:21.863Z","updated":"2026-04-28T20:37:29.734Z","title":"WordPress PartyMaker theme <= 1.1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"PartyMaker","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69057","published":"2026-01-22T16:52:21.683Z","updated":"2026-04-28T20:37:19.844Z","title":"WordPress Eldon theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Eldon","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69056","published":"2026-01-22T16:52:21.460Z","updated":"2026-04-28T20:37:09.740Z","title":"WordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"Hotel Listing","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69055","published":"2026-01-22T16:52:21.243Z","updated":"2026-04-28T20:36:59.088Z","title":"WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SeaTheme","product":"BM Content Builder","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-69054","published":"2026-01-22T16:52:20.929Z","updated":"2026-04-28T20:36:49.619Z","title":"WordPress Super Logos Showcase plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"highwarden","product":"Super Logos Showcase","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69053","published":"2026-01-22T16:52:20.738Z","updated":"2026-04-28T20:36:39.043Z","title":"WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69052","published":"2026-01-22T16:52:20.494Z","updated":"2026-04-28T20:36:29.868Z","title":"WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"FmeAddons","product":"Registration & Login with Mobile Phone Number for WooCommerce","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-69051","published":"2026-01-22T16:52:20.254Z","updated":"2026-04-28T20:36:18.569Z","title":"WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CridioStudio","product":"ListingPro Reviews","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-69050","published":"2026-01-22T16:52:20.020Z","updated":"2026-04-28T20:36:08.919Z","title":"WordPress Overworld theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Overworld","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69049","published":"2026-01-22T16:52:19.830Z","updated":"2026-04-28T20:35:57.560Z","title":"WordPress Töbel theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Töbel","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69048","published":"2026-01-22T16:52:19.621Z","updated":"2026-04-28T20:35:48.667Z","title":"WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69047","published":"2026-01-22T16:52:19.420Z","updated":"2026-04-28T20:35:37.613Z","title":"WordPress MaxShop theme <= 3.6.20 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"magentech","product":"MaxShop","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69046","published":"2026-01-22T16:52:19.210Z","updated":"2026-04-28T20:35:28.212Z","title":"WordPress iRecco Core plugin <= 1.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"iRecco Core","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69045","published":"2026-01-22T16:52:19.002Z","updated":"2026-04-28T20:35:17.822Z","title":"WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"FooEvents","product":"FooEvents for WooCommerce","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-69044","published":"2026-01-22T16:52:18.806Z","updated":"2026-04-28T20:35:07.791Z","title":"WordPress Vango theme <= 1.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Vango","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69043","published":"2026-01-22T16:52:18.567Z","updated":"2026-04-28T16:14:35.625Z","title":"WordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Rashy","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69042","published":"2026-01-22T16:52:18.326Z","updated":"2026-04-28T16:14:35.158Z","title":"WordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Lindo","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69041","published":"2026-01-22T16:52:18.140Z","updated":"2026-04-28T20:34:56.823Z","title":"WordPress Dekoro theme <= 1.0.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Dekoro","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69040","published":"2026-01-22T16:52:17.934Z","updated":"2026-04-28T16:14:35.003Z","title":"WordPress Bfres theme <= 1.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Bfres","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69039","published":"2026-01-22T16:52:17.742Z","updated":"2026-04-28T16:14:35.055Z","title":"WordPress Bailly theme <= 1.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Bailly","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-69038","published":"2026-01-22T16:52:17.563Z","updated":"2026-04-28T20:34:46.569Z","title":"WordPress Hyori theme <= 1.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Hyori","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69037","published":"2026-01-22T16:52:17.366Z","updated":"2026-04-28T20:34:36.907Z","title":"WordPress Pippo theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Pippo","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69036","published":"2026-01-22T16:52:17.168Z","updated":"2026-04-28T20:34:26.227Z","title":"WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"strongholdthemes","product":"Tech Life CPT","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-69035","published":"2026-01-22T16:52:16.979Z","updated":"2026-10-26T15:25:25.233Z","title":"WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Strongholdthemes","product":"Dental Care CPT","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-69005","published":"2026-01-22T16:52:16.776Z","updated":"2026-04-28T20:31:46.774Z","title":"WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Search & Go","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69004","published":"2026-01-22T16:52:16.561Z","updated":"2026-04-28T20:31:33.085Z","title":"WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"XpeedStudio","product":"Bajaar - Highly Customizable WooCommerce WordPress Theme","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69003","published":"2026-01-22T16:52:16.345Z","updated":"2026-04-28T20:31:21.645Z","title":"WordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QantumThemes","product":"KenthaRadio","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-69002","published":"2026-01-22T16:52:16.108Z","updated":"2026-04-28T20:29:55.725Z","title":"WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"OneLife","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-69001","published":"2026-01-22T16:52:15.923Z","updated":"2026-04-28T20:29:45.901Z","title":"WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shahjahan Jewel","product":"FluentForm","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-68999","published":"2026-01-22T16:52:15.685Z","updated":"2026-04-28T16:14:33.851Z","title":"WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"HappyMonster","product":"Happy Addons for Elementor","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-68986","published":"2026-01-22T16:52:15.450Z","updated":"2026-04-28T20:13:10.222Z","title":"WordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Miion","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2025-68913","published":"2026-01-22T16:52:15.263Z","updated":"2026-04-28T20:08:56.666Z","title":"WordPress Miion theme <= 1.2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"zozothemes","product":"Miion","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-68912","published":"2026-01-22T16:52:15.047Z","updated":"2026-04-28T16:14:33.446Z","title":"WordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Harmonic Design","product":"HDForms","kev":false,"epss":0.00641,"kevAdded":null},{"id":"CVE-2025-68911","published":"2026-01-22T16:52:14.813Z","updated":"2026-04-28T16:14:33.356Z","title":"WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"solacewp","product":"Solace","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-68910","published":"2026-01-22T16:52:14.569Z","updated":"2026-04-28T20:08:46.896Z","title":"WordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"blazethemes","product":"Blogzee","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2025-68909","published":"2026-01-22T16:52:14.365Z","updated":"2026-04-28T20:08:36.748Z","title":"WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"blazethemes","product":"Blogistic","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2025-68908","published":"2026-01-22T16:52:14.157Z","updated":"2026-04-28T16:14:33.311Z","title":"WordPress Barberry theme <= 2.9.9.87 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"temash","product":"Barberry","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2025-68907","published":"2026-01-22T16:52:13.949Z","updated":"2026-04-28T16:14:33.277Z","title":"WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2025-68906","published":"2026-01-22T16:52:13.768Z","updated":"2026-04-28T20:08:27.886Z","title":"WordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jegtheme","product":"JNews - Video","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68905","published":"2026-01-22T16:52:13.550Z","updated":"2026-04-28T20:08:18.631Z","title":"WordPress JNews - Pay Writer plugin <= 11.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"jegtheme","product":"JNews - Pay Writer","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-68904","published":"2026-01-22T16:52:13.348Z","updated":"2026-04-28T20:08:09.698Z","title":"WordPress JNews - Frontend Submit plugin <= 11.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jegtheme","product":"JNews - Frontend Submit","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-68903","published":"2026-01-22T16:52:13.150Z","updated":"2026-04-28T20:08:00.236Z","title":"WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"AivahThemes","product":"Anona","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-68902","published":"2026-01-22T16:52:12.937Z","updated":"2026-04-28T16:14:32.689Z","title":"WordPress Anona theme <= 8.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"AivahThemes","product":"Anona","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2025-68901","published":"2026-01-22T16:52:12.738Z","updated":"2026-04-28T16:14:32.370Z","title":"WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"AivahThemes","product":"Anona","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-68900","published":"2026-01-22T16:52:12.531Z","updated":"2026-05-08T12:14:13.616Z","title":"WordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kriesi","product":"Enfold","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-68899","published":"2026-01-22T16:52:12.326Z","updated":"2026-04-28T20:07:42.014Z","title":"WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Vivagh","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-68898","published":"2026-01-22T16:52:12.134Z","updated":"2026-04-28T20:07:32.851Z","title":"WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.8,"vendor":"cjjparadoxmax","product":"Synergy Project Manager","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-68896","published":"2026-01-22T16:52:11.918Z","updated":"2026-04-28T20:07:23.583Z","title":"WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vrpr","product":"WDV One Page Docs","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-68894","published":"2026-01-22T16:52:11.717Z","updated":"2026-04-28T20:07:04.757Z","title":"WordPress ShoutOut plugin <= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"shoutoutglobal","product":"ShoutOut","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68884","published":"2026-01-22T16:52:11.504Z","updated":"2026-04-28T20:06:29.640Z","title":"WordPress WP Simple Redirect plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arevico","product":"WP Simple Redirect","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68883","published":"2026-01-22T16:52:11.325Z","updated":"2026-04-28T20:06:20.252Z","title":"WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"extremeidea","product":"bidorbuy Store Integrator","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68882","published":"2026-01-22T16:52:11.129Z","updated":"2026-04-28T16:14:32.333Z","title":"WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Scalenut","product":"Scalenut","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-68881","published":"2026-01-22T16:52:10.921Z","updated":"2026-04-28T20:06:11.202Z","title":"WordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Saad Iqbal","product":"AppExperts","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-68871","published":"2026-01-22T16:52:10.736Z","updated":"2026-04-28T20:05:33.858Z","title":"WordPress Dooodl plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"noCreativity","product":"Dooodl","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-68869","published":"2026-01-22T16:52:10.526Z","updated":"2026-04-28T20:05:24.890Z","title":"WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"LazyCoders LLC","product":"LazyTasks","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2025-68866","published":"2026-01-22T16:52:10.347Z","updated":"2026-04-28T20:05:06.356Z","title":"WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"woofer696","product":"Dinatur","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-68864","published":"2026-01-22T16:52:10.147Z","updated":"2026-04-29T14:32:38.383Z","title":"WordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-68859","published":"2026-01-22T16:52:09.950Z","updated":"2026-04-28T20:04:38.642Z","title":"WordPress Syntax Highlighter Compress plugin <= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"agmorpheus","product":"Syntax Highlighter Compress","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68858","published":"2026-01-22T16:52:09.772Z","updated":"2026-04-28T20:04:28.823Z","title":"WordPress wpCAS plugin <= 1.07 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Casey Bisson","product":"wpCAS","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-68857","published":"2026-01-22T16:52:09.575Z","updated":"2026-04-28T20:04:19.633Z","title":"WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ichurakov","product":"Paid Downloads","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-68849","published":"2026-01-22T16:52:09.375Z","updated":"2026-04-28T20:03:53.880Z","title":"WordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Frank Corso","product":"Quote Master","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-68839","published":"2026-01-22T16:52:09.179Z","updated":"2026-04-28T20:02:31.767Z","title":"WordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Remi Corson","product":"Easy Theme Options","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68838","published":"2026-01-22T16:52:08.981Z","updated":"2026-04-28T20:02:23.245Z","title":"WordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"expresstechsoftware","product":"MemberPress Discord Addon","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-68835","published":"2026-01-22T16:52:08.783Z","updated":"2026-04-28T20:02:13.578Z","title":"WordPress Ravpage plugin <= 2.33 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"matiskiba","product":"Ravpage","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68558","published":"2026-01-22T16:52:08.541Z","updated":"2026-04-28T16:14:30.364Z","title":"WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"averta","product":"Depicter Slider","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-68538","published":"2026-01-22T16:52:08.348Z","updated":"2026-04-28T20:00:48.840Z","title":"WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Craft","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-68520","published":"2026-01-22T16:52:08.148Z","updated":"2026-04-28T20:00:11.710Z","title":"WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"DotLife","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-68518","published":"2026-01-22T16:52:07.893Z","updated":"2026-04-28T20:00:05.912Z","title":"WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Hoteller","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-68510","published":"2026-01-22T16:52:07.647Z","updated":"2026-04-28T19:59:53.707Z","title":"WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-68507","published":"2026-01-22T16:52:07.377Z","updated":"2026-04-28T16:14:29.087Z","title":"WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Icegram","product":"Icegram","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-68073","published":"2026-01-22T16:52:07.197Z","updated":"2026-04-28T16:14:28.281Z","title":"WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ninja Team","product":"GDPR CCPA Compliance Support","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-68072","published":"2026-01-22T16:52:06.979Z","updated":"2026-04-28T19:58:03.481Z","title":"WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Merv Barrett","product":"Easy Property Listings","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2025-68059","published":"2026-01-22T16:52:06.756Z","updated":"2026-04-28T16:14:27.936Z","title":"WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"e-plugins","product":"Hotel Listing","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68058","published":"2026-01-22T16:52:06.554Z","updated":"2026-04-28T16:14:27.820Z","title":"WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"e-plugins","product":"Institutions Directory","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-68057","published":"2026-01-22T16:52:06.352Z","updated":"2026-04-28T16:14:27.857Z","title":"WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"e-plugins","product":"Hospital Doctor Directory","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68047","published":"2026-01-22T16:52:06.124Z","updated":"2026-04-28T19:56:58.706Z","title":"WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2025-68046","published":"2026-01-22T16:52:05.895Z","updated":"2026-04-28T19:56:49.668Z","title":"WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeHunk","product":"Contact Form & Lead Form Elementor Builder","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-68041","published":"2026-01-22T16:52:05.698Z","updated":"2026-04-28T19:56:21.136Z","title":"WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codisto","product":"Omnichannel for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68039","published":"2026-01-22T16:52:05.483Z","updated":"2026-04-28T16:14:27.657Z","title":"WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chris Simmons","product":"WP BackItUp","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-68035","published":"2026-01-22T16:52:05.252Z","updated":"2026-04-28T19:56:09.865Z","title":"WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"tabbyai","product":"Tabby Checkout","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-68034","published":"2026-01-22T16:52:05.046Z","updated":"2026-04-28T16:14:27.026Z","title":"WordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CleverReach®","product":"CleverReach® WP","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-68030","published":"2026-01-22T16:52:04.821Z","updated":"2026-04-28T19:55:49.913Z","title":"WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Messiah","product":"Frontis Blocks","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-68027","published":"2026-01-22T16:52:04.595Z","updated":"2026-04-28T19:55:40.115Z","title":"WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability","severity":"HIGH","score":7.3,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-68020","published":"2026-01-22T16:52:04.392Z","updated":"2026-04-28T16:14:26.513Z","title":"WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WANotifier","product":"Notifier","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-68019","published":"2026-01-22T16:52:04.172Z","updated":"2026-04-28T19:55:11.961Z","title":"WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"cleverplugins","product":"SEO Booster","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-68018","published":"2026-01-22T16:52:03.969Z","updated":"2026-04-28T19:55:02.697Z","title":"WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.4,"vendor":"StackWC","product":"Order Listener for WooCommerce","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-68017","published":"2026-01-22T16:52:03.768Z","updated":"2026-04-28T16:14:26.457Z","title":"WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"Antideo","product":"Antideo Email Validator","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-68016","published":"2026-01-22T16:52:03.497Z","updated":"2026-04-29T09:51:56.529Z","title":"WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Onepay Sri Lanka","product":"onepay Payment Gateway For WooCommerce","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-68015","published":"2026-01-22T16:52:03.228Z","updated":"2026-04-28T19:54:52.096Z","title":"WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9,"vendor":"Vollstart","product":"Event Tickets with Ticket Scanner","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-68013","published":"2026-01-22T16:52:02.860Z","updated":"2026-04-28T16:14:26.436Z","title":"WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"cardpaysolutions","product":"Payment Gateway Authorize.Net CIM for WooCommerce","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-68012","published":"2026-01-22T16:52:02.470Z","updated":"2026-04-28T19:54:42.973Z","title":"WordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dmytro Shteflyuk","product":"CodeColorer","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-68011","published":"2026-01-22T16:52:02.251Z","updated":"2026-04-28T19:54:33.956Z","title":"WordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GLS","product":"GLS Shipping for WooCommerce","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-68010","published":"2026-01-22T16:52:01.876Z","updated":"2026-04-28T19:54:24.299Z","title":"WordPress Netgsm plugin <= 2.9.63 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"netgsm","product":"Netgsm","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-68009","published":"2026-01-22T16:52:01.425Z","updated":"2026-04-28T16:14:26.532Z","title":"WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Codeless","product":"Slider Templates","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-68008","published":"2026-01-22T16:52:01.084Z","updated":"2026-04-28T19:54:14.574Z","title":"WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mndpsingh287","product":"WP Mail","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-68007","published":"2026-01-22T16:52:00.859Z","updated":"2026-04-28T16:14:25.834Z","title":"WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Event Espresso","product":"Event Espresso 4 Decaf","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-68006","published":"2026-01-22T16:52:00.634Z","updated":"2026-04-28T19:54:05.543Z","title":"WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Deetronix","product":"Booking Ultra Pro","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-68004","published":"2026-01-22T16:51:59.864Z","updated":"2026-04-28T19:52:43.998Z","title":"WordPress My Post Order plugin <= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kapil Chugh","product":"My Post Order","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68003","published":"2026-01-22T16:51:59.522Z","updated":"2026-04-28T16:14:25.698Z","title":"WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"renatoatshown","product":"Shown Connector","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-68001","published":"2026-01-22T16:51:59.247Z","updated":"2026-04-28T16:14:25.927Z","title":"WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"garidium","product":"g-FFL Checkout","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2025-67968","published":"2026-01-22T16:51:58.994Z","updated":"2026-04-28T19:30:14.671Z","title":"WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"InspiryThemes","product":"Real Homes CRM","kev":false,"epss":0.00568,"kevAdded":null},{"id":"CVE-2025-67967","published":"2026-01-22T16:51:58.716Z","updated":"2026-04-28T19:30:05.845Z","title":"WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"e-plugins","product":"Lawyer Directory","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-67966","published":"2026-01-22T16:51:58.463Z","updated":"2026-04-28T19:29:55.987Z","title":"WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"Lawyer Directory","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-67964","published":"2026-01-22T16:51:58.200Z","updated":"2026-04-28T19:29:46.952Z","title":"WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"favethemes","product":"Homey Core","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-67963","published":"2026-01-22T16:51:58.001Z","updated":"2026-04-28T19:29:35.262Z","title":"WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"ovatheme","product":"Movie Booking","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2025-67961","published":"2026-01-22T16:51:57.784Z","updated":"2026-04-28T19:29:26.112Z","title":"WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Marco van Wieren","product":"WPO365","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-67960","published":"2026-01-22T16:51:57.383Z","updated":"2026-04-28T19:29:16.296Z","title":"WordPress WorkScout-Core plugin <= 1.7.06 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"purethemes","product":"WorkScout-Core","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67959","published":"2026-01-22T16:51:57.097Z","updated":"2026-04-28T19:29:07.180Z","title":"WordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"purethemes","product":"WorkScout","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67958","published":"2026-01-22T16:51:56.847Z","updated":"2026-04-28T16:14:24.709Z","title":"WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Taxcloud","product":"TaxCloud for WooCommerce","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-67957","published":"2026-01-22T16:51:56.573Z","updated":"2026-04-28T19:28:56.570Z","title":"WordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"TangibleWP","product":"Listivo Core","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-67956","published":"2026-01-22T16:51:56.303Z","updated":"2026-04-29T09:51:55.997Z","title":"WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-67955","published":"2026-01-22T16:51:56.033Z","updated":"2026-04-28T16:14:24.631Z","title":"WordPress MyHome Core plugin <= 4.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"TangibleWP","product":"MyHome Core","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-67954","published":"2026-01-22T16:51:55.753Z","updated":"2026-04-28T19:28:47.509Z","title":"WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-67953","published":"2026-01-22T16:51:55.517Z","updated":"2026-04-28T19:28:38.155Z","title":"WordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-67952","published":"2026-01-22T16:51:55.230Z","updated":"2026-04-28T19:28:29.069Z","title":"WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Tour","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67949","published":"2026-01-22T16:51:54.975Z","updated":"2026-04-28T19:28:10.753Z","title":"WordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designingmedia","product":"Hostiko","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67947","published":"2026-01-22T16:51:54.712Z","updated":"2026-04-28T19:27:51.653Z","title":"WordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"AdForest Elementor","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67946","published":"2026-01-22T16:51:54.507Z","updated":"2026-04-28T19:27:42.343Z","title":"WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-67945","published":"2026-01-22T16:51:54.311Z","updated":"2026-04-28T16:14:24.292Z","title":"WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"MailerLite","product":"MailerLite – WooCommerce integration","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-67944","published":"2026-01-22T16:51:54.109Z","updated":"2026-04-28T16:14:24.474Z","title":"WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Nelio Software","product":"Nelio AB Testing","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-67943","published":"2026-01-22T16:51:53.901Z","updated":"2026-04-28T19:27:33.399Z","title":"WordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67942","published":"2026-01-22T16:51:53.698Z","updated":"2026-04-28T16:14:24.496Z","title":"WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"peachpayments","product":"Peach Payments Gateway","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2025-67941","published":"2026-01-22T16:51:53.511Z","updated":"2026-04-28T19:27:24.453Z","title":"WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"The Aisle","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-67940","published":"2026-01-22T16:51:53.314Z","updated":"2026-04-28T19:27:15.571Z","title":"WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Powerlift","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-67939","published":"2026-01-22T16:51:53.120Z","updated":"2026-04-28T16:14:24.312Z","title":"WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2025-67938","published":"2026-01-22T16:51:52.931Z","updated":"2026-04-28T19:27:06.915Z","title":"WordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Biagiotti","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2025-67923","published":"2026-01-22T16:51:52.714Z","updated":"2026-04-28T19:26:28.518Z","title":"WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-67626","published":"2026-01-22T16:51:52.454Z","updated":"2026-04-28T19:26:00.244Z","title":"WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Angel Costa","product":"WP SEO Search","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-67620","published":"2026-01-22T16:51:52.273Z","updated":"2026-04-28T19:25:50.487Z","title":"WordPress Anon theme <= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CleverSoft","product":"Anon","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-67619","published":"2026-01-22T16:51:52.055Z","updated":"2026-04-28T19:25:40.409Z","title":"WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Kids Heaven","kev":false,"epss":0.00737,"kevAdded":null},{"id":"CVE-2025-67617","published":"2026-01-22T16:51:51.873Z","updated":"2026-04-28T19:25:31.454Z","title":"WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"Consult Aid","kev":false,"epss":0.00802,"kevAdded":null},{"id":"CVE-2025-67616","published":"2026-01-22T16:51:51.660Z","updated":"2026-04-28T19:25:22.664Z","title":"WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"Mella","kev":false,"epss":0.00677,"kevAdded":null},{"id":"CVE-2025-67615","published":"2026-01-22T16:51:51.412Z","updated":"2026-04-28T19:25:12.989Z","title":"WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"bslthemes","product":"Myour","kev":false,"epss":0.00677,"kevAdded":null},{"id":"CVE-2025-67614","published":"2026-01-22T16:51:51.190Z","updated":"2026-04-28T19:25:03.511Z","title":"WordPress TheNa theme <= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"foreverpinetree","product":"TheNa","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-66143","published":"2026-01-22T16:51:50.950Z","updated":"2026-04-28T19:09:34.627Z","title":"WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Crumber","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-66142","published":"2026-01-22T16:51:50.767Z","updated":"2026-04-28T16:14:17.852Z","title":"WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Comparimager for Elementor","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-66141","published":"2026-01-22T16:51:50.559Z","updated":"2026-04-28T16:14:17.895Z","title":"WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Scroller","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-66140","published":"2026-01-22T16:51:50.335Z","updated":"2026-04-28T19:09:23.515Z","title":"WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Uper for Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-66139","published":"2026-01-22T16:51:50.099Z","updated":"2026-04-28T16:14:17.850Z","title":"WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Audier For Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-66138","published":"2026-01-22T16:51:49.895Z","updated":"2026-04-28T16:14:17.730Z","title":"WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Motionger for Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-66137","published":"2026-01-22T16:51:49.716Z","updated":"2026-04-28T16:14:17.738Z","title":"WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Searcher for Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-66136","published":"2026-01-22T16:51:49.525Z","updated":"2026-04-28T16:14:17.738Z","title":"WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Carter for Elementor","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-66135","published":"2026-01-22T16:51:49.343Z","updated":"2026-04-28T16:14:17.760Z","title":"WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Imager for Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-64252","published":"2026-01-22T16:51:49.141Z","updated":"2026-04-28T18:27:38.261Z","title":"WordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Marco Milesi","product":"ANAC XML Viewer","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-63051","published":"2026-01-22T16:51:48.772Z","updated":"2026-04-28T19:35:33.524Z","title":"WordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sizam","product":"REHub Framework","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-63026","published":"2026-01-22T16:51:48.574Z","updated":"2026-04-28T16:14:08.901Z","title":"WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGoods","product":"Grand Restaurant Theme Elements for Elementor","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-63019","published":"2026-01-22T16:51:48.371Z","updated":"2026-04-28T16:14:08.649Z","title":"WordPress Cookies and Content Security Policy plugin <= 2.34 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Johan Jonk Stenström","product":"Cookies and Content Security Policy","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-63018","published":"2026-01-22T16:51:48.143Z","updated":"2026-04-28T16:14:08.705Z","title":"WordPress Bard theme <= 2.229 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wproyal","product":"Bard","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-63017","published":"2026-01-22T16:51:47.887Z","updated":"2026-04-28T19:34:09.821Z","title":"WordPress WerkStatt plugin plugin <= 1.6.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"fuelthemes","product":"WerkStatt Plugin","kev":false,"epss":0.00578,"kevAdded":null},{"id":"CVE-2025-62754","published":"2026-01-22T16:51:47.669Z","updated":"2026-04-28T16:14:04.062Z","title":"WordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kapil Paul","product":"Payment Gateway bKash for WC","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-62741","published":"2026-01-22T16:51:47.324Z","updated":"2026-04-28T16:14:03.808Z","title":"WordPress Pool Services theme <= 3.3 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SmartDataSoft","product":"Pool Services","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-62106","published":"2026-01-22T16:51:47.046Z","updated":"2026-04-28T16:14:01.751Z","title":"WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mario Peshev","product":"WP-CRM System","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-62077","published":"2026-01-22T16:51:46.837Z","updated":"2026-04-28T18:53:40.146Z","title":"WordPress Affiliate Link Tracker plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SEOSEON EUROPE S.L","product":"Affiliate Link Tracker","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-62056","published":"2026-01-22T16:51:46.647Z","updated":"2026-04-28T18:51:43.572Z","title":"WordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"blazethemes","product":"News Event","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2025-62050","published":"2026-01-22T16:51:46.432Z","updated":"2026-04-28T18:51:12.029Z","title":"WordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"blazethemes","product":"Blogmatic","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2025-5805","published":"2026-01-22T16:51:46.213Z","updated":"2026-04-28T16:13:41.541Z","title":"WordPress Electron theme <= 1.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ninetheme","product":"Electron","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-54003","published":"2026-01-22T16:51:45.965Z","updated":"2026-04-28T16:13:28.293Z","title":"WordPress Depot theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Depot","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-54002","published":"2026-01-22T16:51:45.705Z","updated":"2026-04-28T16:13:28.500Z","title":"WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jthemes","product":"xSmart","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-53240","published":"2026-01-22T16:51:45.463Z","updated":"2026-04-28T16:13:21.689Z","title":"WordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"adamlabs","product":"WordPress Photo Gallery","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-52762","published":"2026-01-22T16:51:45.234Z","updated":"2026-04-28T16:13:18.619Z","title":"WordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"flexostudio","product":"flexo-posts-manager","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-52746","published":"2026-01-22T16:51:44.944Z","updated":"2026-04-28T16:13:18.297Z","title":"WordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ayecode","product":"Restaurante","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-50007","published":"2026-01-22T16:51:44.750Z","updated":"2026-04-28T18:22:28.972Z","title":"WordPress xSmart theme <= 1.2.9.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Jthemes","product":"xSmart","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-50006","published":"2026-01-22T16:51:44.554Z","updated":"2026-04-28T16:13:15.890Z","title":"WordPress xSmart theme <= 1.2.9.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jthemes","product":"xSmart","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-50005","published":"2026-01-22T16:51:44.352Z","updated":"2026-04-28T16:13:15.858Z","title":"WordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-50004","published":"2026-01-22T16:51:44.164Z","updated":"2026-04-28T16:13:15.821Z","title":"WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"artbees","product":"JupiterX Core","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-50003","published":"2026-01-22T16:51:43.965Z","updated":"2026-04-28T16:13:15.818Z","title":"WordPress Amuli theme <= 2.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Amuli","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-50002","published":"2026-01-22T16:51:43.748Z","updated":"2026-04-28T16:13:15.836Z","title":"WordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Farost","product":"Energia","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-49994","published":"2026-01-22T16:51:43.534Z","updated":"2026-04-28T16:13:15.653Z","title":"WordPress Athens theme <= 1.1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"Athens","kev":false,"epss":0.00623,"kevAdded":null},{"id":"CVE-2025-49375","published":"2026-01-22T16:51:43.324Z","updated":"2026-04-28T16:13:02.680Z","title":"WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"cozythemes","product":"HomeLancer","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-49336","published":"2026-01-22T16:51:43.131Z","updated":"2026-04-28T16:13:01.070Z","title":"WordPress Pondol BBS plugin <= 1.1.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"pondol","product":"Pondol BBS","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-49249","published":"2026-01-22T16:51:42.924Z","updated":"2026-04-28T16:12:58.958Z","title":"WordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ApusTheme","product":"Drone","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-49066","published":"2026-01-22T16:51:42.708Z","updated":"2026-04-28T16:12:58.616Z","title":"WordPress Accordion Slider PRO plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Accordion Slider PRO","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-49055","published":"2026-01-22T16:51:42.502Z","updated":"2026-04-28T16:12:58.147Z","title":"WordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"kamleshyadav","product":"WP Lead Capturing Pages","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-49050","published":"2026-01-22T16:51:42.307Z","updated":"2026-04-28T16:12:57.947Z","title":"WordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"kamleshyadav","product":"WP Lead Capturing Pages","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2025-49049","published":"2026-01-22T16:51:42.095Z","updated":"2026-04-28T16:12:57.957Z","title":"WordPress DZS Video Gallery plugin <= 12.39 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ZoomIt","product":"DZS Video Gallery","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-49046","published":"2026-01-22T16:51:41.898Z","updated":"2026-04-28T16:12:57.887Z","title":"WordPress xPromoter plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"xPromoter","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-49045","published":"2026-01-22T16:51:41.709Z","updated":"2026-04-28T16:12:58.046Z","title":"WordPress Super Interactive Maps plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"highwarden","product":"Super Interactive Maps","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-49043","published":"2026-01-22T16:51:41.498Z","updated":"2026-04-28T16:12:57.902Z","title":"WordPress Magic Responsive Slider and Carousel WordPress plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Magic Responsive Slider and Carousel WordPress","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-48094","published":"2026-01-22T16:51:41.292Z","updated":"2026-04-28T16:12:51.075Z","title":"WordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Magic Slider","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-47666","published":"2026-01-22T16:51:41.086Z","updated":"2026-04-28T16:12:48.890Z","title":"WordPress Image&Video FullScreen Background plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Image&Video FullScreen Background","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-47600","published":"2026-01-22T16:51:40.856Z","updated":"2026-04-28T16:12:46.944Z","title":"WordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"xtemos","product":"WoodMart","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-47555","published":"2026-01-22T16:51:40.623Z","updated":"2026-04-28T16:12:45.379Z","title":"WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"LOW","score":3.8,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-47500","published":"2026-01-22T16:51:40.419Z","updated":"2026-04-28T16:12:43.075Z","title":"WordPress Stackable plugin <= 3.19.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Benjamin Intal","product":"Stackable","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-47474","published":"2026-01-22T16:51:39.883Z","updated":"2026-04-28T16:12:42.125Z","title":"WordPress Anarkali theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Ninetheme","product":"Anarkali","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2025-32123","published":"2026-01-22T16:51:39.313Z","updated":"2026-04-28T16:12:16.772Z","title":"WordPress HTML5 Video Player with Playlist & Multiple Skins plugin <= 5.3.5  - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"HTML5 Video Player with Playlist & Multiple Skins","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-31413","published":"2026-01-22T16:51:38.938Z","updated":"2026-04-28T16:12:06.898Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bdthemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-27005","published":"2026-01-22T16:51:38.527Z","updated":"2026-04-28T16:11:46.289Z","title":"WordPress HTML5 Video Player plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"HTML5 Video Player","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-23800","published":"2026-01-16T20:40:13.232Z","updated":"2026-04-28T16:14:47.248Z","title":"WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":10,"vendor":null,"product":"Modular DS","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-23550","published":"2026-01-14T08:44:25.503Z","updated":"2026-04-28T16:14:46.839Z","title":"WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":10,"vendor":"Modular DS","product":"Modular DS","kev":false,"epss":0.21393,"kevAdded":null},{"id":"CVE-2026-22486","published":"2026-01-08T16:46:02.803Z","updated":"2026-04-29T14:32:17.887Z","title":"WordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Re Gallery","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-22487","published":"2026-01-08T16:37:41.558Z","updated":"2026-04-28T16:14:45.585Z","title":"WordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"baqend","product":"Speed Kit","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-22488","published":"2026-01-08T16:35:04.136Z","updated":"2026-04-28T16:14:46.240Z","title":"WordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"IdeaBox Creations","product":"Dashboard Welcome for Beaver Builder","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-22489","published":"2026-01-08T16:33:34.393Z","updated":"2026-04-28T16:14:45.546Z","title":"WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wptexture","product":"Image Slider Slideshow","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-22490","published":"2026-01-08T16:24:37.839Z","updated":"2026-04-28T16:14:45.598Z","title":"WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"niklaslindemann","product":"Bulk Landing Page Creator for WordPress LPagery","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-22492","published":"2026-01-08T16:23:26.291Z","updated":"2026-04-28T16:14:46.205Z","title":"WordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nawawi Jamili","product":"Docket Cache","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-22517","published":"2026-01-08T16:22:10.370Z","updated":"2026-04-28T16:14:46.501Z","title":"WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Passionate Brains","product":"GA4WP: Google Analytics for WordPress","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-22518","published":"2026-01-08T16:21:08.373Z","updated":"2026-04-28T16:14:46.679Z","title":"WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pencilwp","product":"X Addons for Elementor","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-22519","published":"2026-01-08T16:19:54.708Z","updated":"2026-04-28T16:14:46.727Z","title":"WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BuddyDev","product":"MediaPress","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-22521","published":"2026-01-08T16:18:28.700Z","updated":"2026-04-28T16:14:46.676Z","title":"WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"G5Theme","product":"Handmade Framework","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-22522","published":"2026-01-08T16:17:02.773Z","updated":"2026-04-28T16:14:46.686Z","title":"WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Munir Kamal","product":"Block Slider","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-0676","published":"2026-01-08T09:17:55.655Z","updated":"2026-04-28T17:24:16.799Z","title":"WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"G5Theme","product":"Zorka","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-0674","published":"2026-01-08T09:17:55.119Z","updated":"2026-05-11T12:55:14.980Z","title":"WordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Campaign Monitor","product":"Campaign Monitor for WordPress","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-69169","published":"2026-01-08T09:17:54.850Z","updated":"2026-04-28T16:14:36.714Z","title":"WordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Noor Alam","product":"Easy Media Download","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-68892","published":"2026-01-08T09:17:54.424Z","updated":"2026-04-28T16:14:32.721Z","title":"WordPress Scroll rss excerpt plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gopiplus@hotmail.com","product":"Scroll rss excerpt","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68891","published":"2026-01-08T09:17:54.250Z","updated":"2026-04-28T20:06:55.617Z","title":"WordPress WP App Bar plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ryan Sutana","product":"WP App Bar","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68890","published":"2026-01-08T09:17:54.055Z","updated":"2026-04-28T16:14:32.752Z","title":"WordPress e-shops plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hands01","product":"e-shops","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68889","published":"2026-01-08T09:17:53.868Z","updated":"2026-04-28T20:06:47.108Z","title":"WordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pinpoll","product":"Pinpoll","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-68887","published":"2026-01-08T09:17:53.686Z","updated":"2026-04-28T20:06:38.306Z","title":"WordPress WP-BusinessDirectory plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CMSJunkie - WordPress Business Directory Plugins","product":"WP-BusinessDirectory","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-68875","published":"2026-01-08T09:17:52.299Z","updated":"2026-04-28T16:14:32.134Z","title":"WordPress Flaming Password Reset plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jcaruso001","product":"Flaming Password Reset","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-68874","published":"2026-01-08T09:17:52.109Z","updated":"2026-04-28T20:05:52.622Z","title":"WordPress Visitor Stats Widget plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shahjada","product":"Visitor Stats Widget","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68873","published":"2026-01-08T09:17:51.924Z","updated":"2026-04-28T20:05:43.486Z","title":"WordPress PRIMER by chloédigital plugin <= 1.0.25 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"chloédigital","product":"PRIMER by chloédigital","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68867","published":"2026-01-08T09:17:51.313Z","updated":"2026-04-28T20:05:15.715Z","title":"WordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"anibalwainstein","product":"Effect Maker","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-67937","published":"2026-01-08T09:17:50.059Z","updated":"2026-04-28T19:26:57.219Z","title":"WordPress Hendon theme < 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Hendon","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-67936","published":"2026-01-08T09:17:49.863Z","updated":"2026-04-28T19:26:48.530Z","title":"WordPress Curly theme < 3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Curly","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-67935","published":"2026-01-08T09:17:49.646Z","updated":"2026-04-28T19:26:37.751Z","title":"WordPress Optimize theme < 2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Optimize","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-67934","published":"2026-01-08T09:17:49.408Z","updated":"2026-04-28T16:14:24.212Z","title":"WordPress Wellspring theme < 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Wellspring","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-67933","published":"2026-01-08T09:17:49.199Z","updated":"2026-04-28T16:14:24.130Z","title":"WordPress Taskbuilder plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-67932","published":"2026-01-08T09:17:49.010Z","updated":"2026-04-28T16:14:23.618Z","title":"WordPress Listeo Core plugin < 2.0.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"purethemes","product":"Listeo Core","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-67931","published":"2026-01-08T09:17:48.784Z","updated":"2026-04-29T09:51:56.049Z","title":"WordPress BulletProof Security plugin <= 6.9 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"AITpro","product":"BulletProof Security","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-67930","published":"2026-01-08T09:17:48.582Z","updated":"2026-04-28T16:14:23.760Z","title":"WordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Vernon Systems Limited","product":"eHive Search","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67928","published":"2026-01-08T09:17:48.385Z","updated":"2026-04-28T16:14:23.643Z","title":"WordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"themesuite","product":"Automotive Listings","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-67927","published":"2026-01-08T09:17:48.182Z","updated":"2026-04-28T16:14:24.026Z","title":"WordPress Link Whisper Free plugin <= 0.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spencer Haws","product":"Link Whisper Free","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67926","published":"2026-01-08T09:17:47.946Z","updated":"2026-04-28T16:14:24.155Z","title":"WordPress Fluent Support plugin <= 1.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shahjahan Jewel","product":"Fluent Support","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-67925","published":"2026-01-08T09:17:47.720Z","updated":"2026-04-28T16:14:23.786Z","title":"WordPress Corpkit theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"zozothemes","product":"Corpkit","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-67924","published":"2026-01-08T09:17:47.419Z","updated":"2026-04-28T16:14:23.679Z","title":"WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"zozothemes","product":"Corpkit","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-67922","published":"2026-01-08T09:17:47.190Z","updated":"2026-04-28T16:14:23.535Z","title":"WordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67921","published":"2026-01-08T09:17:46.911Z","updated":"2026-04-28T16:14:23.676Z","title":"WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VanKarWai","product":"Lobo","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-67920","published":"2026-01-08T09:17:46.685Z","updated":"2026-11-04T00:14:26.954Z","title":"WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Neo Ocular","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-67919","published":"2026-01-08T09:17:46.457Z","updated":"2026-04-28T16:14:23.755Z","title":"WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WofficeIO","product":"Woffice Core","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-67918","published":"2026-01-08T09:17:45.942Z","updated":"2026-04-28T16:14:23.604Z","title":"WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WofficeIO","product":"Woffice","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67917","published":"2026-01-08T09:17:45.741Z","updated":"2026-04-28T16:14:23.576Z","title":"WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-67916","published":"2026-01-08T09:17:45.488Z","updated":"2026-04-28T16:14:23.247Z","title":"WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Astoundify","product":"Jobify","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67915","published":"2026-01-08T09:17:45.304Z","updated":"2026-04-28T16:14:23.250Z","title":"WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2025-67914","published":"2026-01-08T09:17:44.993Z","updated":"2026-04-28T16:14:22.989Z","title":"WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability","severity":"HIGH","score":7.7,"vendor":"beeteam368","product":"VidMov","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2025-67913","published":"2026-01-08T09:17:44.786Z","updated":"2026-04-28T16:14:22.994Z","title":"WordPress Aruba HiSpeed Cache plugin < 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aruba.it Dev","product":"Aruba HiSpeed Cache","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-67911","published":"2026-01-08T09:17:44.577Z","updated":"2026-04-28T19:26:10.577Z","title":"WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-67910","published":"2026-01-08T09:17:44.388Z","updated":"2026-04-28T16:14:22.923Z","title":"WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"contentstudio","product":"Contentstudio","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-27004","published":"2026-01-08T09:17:41.802Z","updated":"2026-04-28T16:11:46.300Z","title":"WordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Famous - Responsive Image And Video Grid Gallery WordPress Plugin","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-27002","published":"2026-01-08T09:17:41.443Z","updated":"2026-04-28T16:11:46.323Z","title":"WordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"CountDown With Image or Video Background","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-23993","published":"2026-01-08T09:17:41.179Z","updated":"2026-04-28T16:11:27.503Z","title":"WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RiceTheme","product":"Felan Framework","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-23504","published":"2026-01-08T09:17:40.900Z","updated":"2026-04-28T19:01:21.292Z","title":"WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"RiceTheme","product":"Felan Framework","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-22728","published":"2026-01-08T09:17:40.670Z","updated":"2026-04-28T16:11:05.683Z","title":"WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AmentoTech","product":"Workreap (theme's plugin)","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-22726","published":"2026-01-08T09:17:40.458Z","updated":"2026-04-28T16:11:05.469Z","title":"WordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"_nK","product":"nK Themes Helper","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-22725","published":"2026-01-08T09:17:39.840Z","updated":"2026-04-28T16:11:05.400Z","title":"WordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"loopus","product":"WP Virtual Assistant","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-22715","published":"2026-01-08T09:17:39.620Z","updated":"2026-04-28T16:11:05.830Z","title":"WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"loopus","product":"WP Attractive Donations System - Easy Stripe & Paypal donations","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-22713","published":"2026-01-08T09:17:39.375Z","updated":"2026-04-28T16:11:05.429Z","title":"WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"vanquish","product":"WooCommerce Orders & Customers Exporter","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-22712","published":"2026-01-08T09:17:39.147Z","updated":"2026-04-28T16:11:05.606Z","title":"WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"QantumThemes","product":"Typify","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-22708","published":"2026-01-08T09:17:38.950Z","updated":"2026-04-28T16:11:05.088Z","title":"WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Mitech","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-22707","published":"2026-01-08T09:17:38.749Z","updated":"2026-04-28T16:11:04.821Z","title":"WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Moody","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-22509","published":"2026-01-08T09:17:38.524Z","updated":"2026-04-28T16:11:00.564Z","title":"WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"TMRW-studio","product":"Atlas","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-14431","published":"2026-01-08T09:17:38.310Z","updated":"2026-04-28T16:10:57.530Z","title":"WordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"THEMELOGI","product":"Navian","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-14430","published":"2026-01-08T09:17:38.058Z","updated":"2026-04-28T16:10:57.525Z","title":"WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Brook","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-14429","published":"2026-01-08T09:17:37.834Z","updated":"2026-04-28T16:10:57.537Z","title":"WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"AeroLand","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-14360","published":"2026-01-08T09:17:37.614Z","updated":"2026-04-28T16:10:57.326Z","title":"WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Kaira","product":"Blockons","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-14359","published":"2026-01-08T09:17:37.351Z","updated":"2026-04-29T11:37:56.092Z","title":"WordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"brandexponents","product":"Oshine","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-14358","published":"2026-01-08T09:17:37.140Z","updated":"2026-04-28T16:10:57.328Z","title":"WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"sizam","product":"REHub Framework","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-13504","published":"2026-01-08T09:17:36.949Z","updated":"2026-04-28T16:10:57.468Z","title":"WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"Real Estate Pro","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-12551","published":"2026-01-08T09:17:36.759Z","updated":"2026-04-28T16:10:57.373Z","title":"WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"ListingHub","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-12550","published":"2026-01-08T09:17:36.554Z","updated":"2026-04-28T16:10:57.339Z","title":"WordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"OchaHouse","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-12549","published":"2026-01-08T09:17:36.012Z","updated":"2026-04-28T16:10:57.346Z","title":"WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"magentech","product":"Rozy - Flower Shop","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-49335","published":"2026-01-07T14:12:43.368Z","updated":"2026-05-12T01:07:58.958Z","title":"WordPress External Media plugin <= 1.0.36 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"minnur","product":"External Media","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-47552","published":"2026-01-07T12:38:11.098Z","updated":"2026-04-28T16:12:44.710Z","title":"WordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Digital zoom studio","product":"DZS Video Gallery","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-46494","published":"2026-01-07T12:37:15.790Z","updated":"2026-04-28T16:12:39.161Z","title":"WordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themesgrove","product":"WidgetKit Pro","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-46434","published":"2026-01-07T12:35:32.020Z","updated":"2026-04-29T09:51:55.897Z","title":"WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH Innovation","product":"The Plus Addons for Elementor Pro","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-46256","published":"2026-01-07T12:34:04.571Z","updated":"2026-04-28T16:12:37.074Z","title":"WordPress Advanced Database Cleaner PRO Plugin <= 3.2.10 - Limited .txt Path Traversal vulnerability","severity":"MEDIUM","score":6.4,"vendor":"SigmaPlugin","product":"Advanced Database Cleaner PRO","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-32303","published":"2026-01-07T12:32:24.259Z","updated":"2026-04-28T16:12:21.647Z","title":"WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Mojoomla","product":"WPCHURCH","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-32300","published":"2026-01-07T12:06:37.028Z","updated":"2026-04-28T16:12:21.468Z","title":"WordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Digital zoom studio","product":"DZS Video Gallery","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-31643","published":"2026-01-07T12:05:17.694Z","updated":"2026-04-28T16:12:10.926Z","title":"WordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Dasinfomedia","product":"WPCHURCH","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-69080","published":"2026-01-07T11:59:55.127Z","updated":"2026-04-28T16:14:36.169Z","title":"WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"JanStudio","product":"Gecko","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69081","published":"2026-01-07T11:56:19.363Z","updated":"2026-04-28T16:14:36.104Z","title":"WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Hope","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-69082","published":"2026-01-07T11:54:31.633Z","updated":"2026-04-28T16:14:36.129Z","title":"WordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Frenify","product":"Arlo","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-69333","published":"2026-01-07T11:52:24.090Z","updated":"2026-04-28T16:14:37.719Z","title":"WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-69344","published":"2026-01-07T11:51:22.838Z","updated":"2026-04-28T16:14:38.248Z","title":"WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themehunk","product":"Oneline Lite","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-31642","published":"2026-01-06T21:14:52.827Z","updated":"2026-04-28T16:12:10.959Z","title":"WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dasinfomedia","product":"WPCHURCH","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-31051","published":"2026-01-06T21:13:02.724Z","updated":"2026-04-28T16:12:04.281Z","title":"WordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"EngoTheme","product":"Plant - Gardening & Houseplants WordPress Theme","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-30996","published":"2026-01-06T20:56:29.336Z","updated":"2026-04-28T16:12:03.361Z","title":"Arbitrary File Upload Vulnerability in WordPress themes by Themify","severity":"CRITICAL","score":9.9,"vendor":"Themify","product":"Themify Sidepane WordPress Theme","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-30631","published":"2026-01-06T20:30:33.706Z","updated":"2026-04-28T16:11:56.543Z","title":"Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins","severity":"HIGH","score":7.1,"vendor":"AA-Team","product":"Woocommerce Sales Funnel Builder","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-29004","published":"2026-01-06T20:25:59.004Z","updated":"2026-04-28T16:11:52.852Z","title":"Privilege Escalation Vulnerability in AA-Team WordPress plugins","severity":"HIGH","score":8.8,"vendor":"AA-Team","product":"Premium Age Verification / Restriction for WordPress","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-32304","published":"2026-01-06T17:34:06.374Z","updated":"2026-04-28T16:12:21.656Z","title":"WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mojoomla","product":"WPCHURCH","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2025-39477","published":"2026-01-06T16:54:40.356Z","updated":"2026-04-28T16:12:32.433Z","title":"WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sfwebservice","product":"InWave Jobs","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2024-31088","published":"2026-01-06T16:52:53.920Z","updated":"2026-04-28T16:09:26.992Z","title":"WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPShop.ru","product":"AdsPlace'r – Ad Manager, Inserter, AdSense Ads","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2024-30547","published":"2026-01-06T16:51:31.128Z","updated":"2026-04-28T16:09:26.747Z","title":"WordPress Header Image Slider plugin <= 0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shazdeh","product":"Header Image Slider","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-47553","published":"2026-01-06T16:47:40.578Z","updated":"2026-04-28T16:12:44.752Z","title":"WordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Digital zoom studio","product":"DZS Video Gallery","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2025-69083","published":"2026-01-06T16:43:57.685Z","updated":"2026-04-28T16:14:36.055Z","title":"WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Frappé","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-69364","published":"2026-01-06T16:36:42.620Z","updated":"2026-04-28T16:14:38.858Z","title":"WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cloudways","product":"Breeze","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-69363","published":"2026-01-06T16:36:42.458Z","updated":"2026-04-28T16:14:38.764Z","title":"WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyberChimps","product":"Responsive Addons for Elementor","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-69362","published":"2026-01-06T16:36:42.232Z","updated":"2026-04-28T16:14:38.715Z","title":"WordPress UiChemy plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"POSIMYTH","product":"UiChemy","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-69361","published":"2026-01-06T16:36:42.054Z","updated":"2026-04-28T20:55:11.695Z","title":"WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"Post Expirator","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-69360","published":"2026-01-06T16:36:41.901Z","updated":"2026-04-28T20:55:02.189Z","title":"WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for WPBakery)","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69359","published":"2026-01-06T16:36:41.733Z","updated":"2026-04-28T16:14:38.782Z","title":"WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-69357","published":"2026-01-06T16:36:41.561Z","updated":"2026-04-28T20:54:53.294Z","title":"WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69356","published":"2026-01-06T16:36:41.397Z","updated":"2026-04-28T20:54:43.787Z","title":"WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-69355","published":"2026-01-06T16:36:41.230Z","updated":"2026-04-28T16:14:38.764Z","title":"WordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69354","published":"2026-01-06T16:36:41.018Z","updated":"2026-04-28T16:14:38.754Z","title":"WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BBR Plugins","product":"Better Business Reviews","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69353","published":"2026-01-06T16:36:40.850Z","updated":"2026-04-28T16:14:38.736Z","title":"WordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Proxy & VPN Blocker","product":"Proxy & VPN Blocker","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69352","published":"2026-01-06T16:36:40.651Z","updated":"2026-04-28T16:14:38.638Z","title":"WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StellarWP","product":"The Events Calendar","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-69351","published":"2026-01-06T16:36:40.416Z","updated":"2026-04-28T16:14:38.741Z","title":"WordPress Ninja Tables plugin <= 5.2.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Shahjahan Jewel","product":"Ninja Tables","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-69350","published":"2026-01-06T16:36:40.193Z","updated":"2026-04-28T16:14:38.755Z","title":"WordPress Accordion plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themepoints","product":"Accordion","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-69349","published":"2026-01-06T16:36:39.797Z","updated":"2026-04-28T16:14:38.412Z","title":"WordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Fahad Mahmood","product":"RSS Feed Widget","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-69348","published":"2026-01-06T16:36:39.616Z","updated":"2026-04-28T16:14:38.653Z","title":"WordPress The Events Calendar Countdown Addon plugin <= 1.4.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CoolHappy","product":"The Events Calendar Countdown Addon","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69346","published":"2026-01-06T16:36:39.417Z","updated":"2026-04-28T16:14:38.193Z","title":"WordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPCenter","product":"AffiliateX","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69345","published":"2026-01-06T16:36:39.258Z","updated":"2026-04-28T16:14:37.951Z","title":"WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69342","published":"2026-01-06T16:36:39.090Z","updated":"2026-04-28T20:54:24.848Z","title":"WordPress Calafate theme <= 1.7.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"VanKarWai","product":"Calafate","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-69341","published":"2026-01-06T16:36:38.896Z","updated":"2026-04-28T16:14:37.877Z","title":"WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"BuddhaThemes","product":"WeDesignTech Ultimate Booking Addon","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-69336","published":"2026-01-06T16:36:38.740Z","updated":"2026-04-28T20:53:47.170Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-69335","published":"2026-01-06T16:36:38.562Z","updated":"2026-04-28T16:14:37.807Z","title":"WordPress Team Showcase plugin <= 2.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Team Showcase","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69334","published":"2026-01-06T16:36:38.389Z","updated":"2026-04-28T20:53:36.781Z","title":"WordPress Wishlist for WooCommerce plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Wishlist for WooCommerce","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69331","published":"2026-01-06T16:36:38.222Z","updated":"2026-04-28T20:53:28.628Z","title":"WordPress Theater for WordPress plugin <= 0.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeroen Schmit","product":"Theater for WordPress","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69327","published":"2026-01-06T16:36:37.973Z","updated":"2026-04-28T16:14:37.636Z","title":"WordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"magepeopleteam","product":"Car Rental Manager","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-69084","published":"2026-01-06T16:28:38.115Z","updated":"2026-04-28T16:14:36.255Z","title":"WordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gt3themes","product":"Photo Gallery","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69085","published":"2026-01-06T16:27:11.662Z","updated":"2026-04-28T16:14:36.027Z","title":"WordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"JobBank","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69086","published":"2026-01-06T16:26:05.178Z","updated":"2026-04-28T16:14:36.239Z","title":"WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"Issabella","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-39484","published":"2026-01-05T16:53:28.100Z","updated":"2026-04-28T16:12:32.644Z","title":"WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Waituk","product":"Entrada","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-39497","published":"2026-01-05T16:51:39.889Z","updated":"2026-04-28T16:12:33.072Z","title":"WordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dokan","product":"Dokan Pro","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39561","published":"2026-01-05T16:50:25.554Z","updated":"2026-04-28T16:12:34.904Z","title":"WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marketing Fire, LLC","product":"LoginWP - Pro","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-46255","published":"2026-01-05T16:44:34.478Z","updated":"2026-04-28T16:12:37.089Z","title":"WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability","severity":"HIGH","score":7.5,"vendor":"Marketing Fire LLC","product":"LoginWP - Pro","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-53344","published":"2026-01-05T16:42:57.646Z","updated":"2026-04-28T16:13:24.311Z","title":"WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"Thim Core","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2024-53735","published":"2026-01-05T16:41:08.654Z","updated":"2026-04-28T16:10:44.646Z","title":"WordPress iPhone Webclip Manager plugin <= 0.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"corourke","product":"iPhone Webclip Manager","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2024-30516","published":"2026-01-05T16:38:43.668Z","updated":"2026-04-28T16:09:25.811Z","title":"WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability","severity":"HIGH","score":7.5,"vendor":"SaasProject","product":"Booking Package","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2024-30461","published":"2026-01-05T16:36:41.495Z","updated":"2026-04-28T16:09:24.516Z","title":"WordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Tumult Inc","product":"Tumult Hype Animations","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2024-23511","published":"2026-01-05T13:33:57.628Z","updated":"2026-04-28T16:09:09.862Z","title":"WordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-52212","published":"2026-01-05T13:32:30.854Z","updated":"2026-04-28T16:09:06.920Z","title":"WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Automattic","product":"WP Job Manager","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2023-51513","published":"2026-01-05T13:30:44.411Z","updated":"2026-04-28T16:09:03.421Z","title":"WordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"INTINITUM FORM","product":"Geo Controller","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-50897","published":"2026-01-05T13:29:13.195Z","updated":"2026-04-28T16:09:00.326Z","title":"WordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Meow Apps","product":"Media File Renamer","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2023-49186","published":"2026-01-05T13:27:52.015Z","updated":"2026-04-28T16:08:56.697Z","title":"WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KlbTheme","product":"Machic Core","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-68865","published":"2026-01-05T10:44:34.184Z","updated":"2026-04-28T16:14:32.112Z","title":"WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-68850","published":"2026-01-05T10:43:35.490Z","updated":"2026-04-29T09:51:56.662Z","title":"WordPress Sell Downloads  plugin <= 1.1.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"codepeople","product":"Sell Downloads","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-68547","published":"2026-01-05T10:42:04.269Z","updated":"2026-04-28T16:14:30.207Z","title":"WordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"wpweb","product":"Follow My Blog Post","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-68044","published":"2026-01-05T10:40:55.539Z","updated":"2026-04-28T16:14:27.592Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":8.6,"vendor":"Rustaurius","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-68033","published":"2026-01-05T10:39:01.024Z","updated":"2026-04-28T16:14:27.019Z","title":"WordPress Custom Related Posts plugin <= 1.8.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Brecht","product":"Custom Related Posts","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-68029","published":"2026-01-05T10:37:18.929Z","updated":"2026-04-29T09:56:32.090Z","title":"WordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.3,"vendor":"WP Swings","product":"Wallet System for WooCommerce","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-68014","published":"2026-01-05T10:36:24.385Z","updated":"2026-04-28T16:14:25.833Z","title":"WordPress AweBooking plugin <= 3.2.26 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"awethemes","product":"AweBooking","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-31048","published":"2026-01-05T10:27:01.221Z","updated":"2026-04-28T16:12:04.316Z","title":"WordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Themify","product":"Shopo","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2025-31047","published":"2026-01-05T10:26:04.107Z","updated":"2026-04-28T16:12:04.265Z","title":"WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"Themify","product":"Themify Edmin","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-31046","published":"2026-01-05T10:24:56.305Z","updated":"2026-04-28T16:12:04.297Z","title":"WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPvibes","product":"AnyWhere Elementor Pro","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-31044","published":"2026-01-05T10:23:17.529Z","updated":"2026-04-28T16:12:04.186Z","title":"WordPress Premium SEO Pack <= 3.3.2 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"AA-Team","product":"Premium SEO Pack","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-30633","published":"2026-01-05T10:21:09.369Z","updated":"2026-04-28T16:11:56.715Z","title":"WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"AA-Team","product":"Amazon Native Shopping Recommendations","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-69087","published":"2026-01-05T10:18:16.966Z","updated":"2026-04-28T16:14:36.245Z","title":"WordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jwsthemes","product":"FreeAgent","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-53235","published":"2025-12-31T20:11:25.669Z","updated":"2026-04-28T16:13:21.613Z","title":"WordPress Easy Social plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"osuthorpe","product":"Easy Social","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-52739","published":"2025-12-31T20:10:29.616Z","updated":"2026-04-28T16:13:17.982Z","title":"WordPress Sala theme <= 1.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Sala","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-50053","published":"2025-12-31T20:09:03.413Z","updated":"2026-04-28T16:13:17.005Z","title":"WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"nebelhorn","product":"Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-47566","published":"2025-12-31T20:07:56.919Z","updated":"2026-04-28T16:12:44.997Z","title":"WordPress ZoomSounds plugin <= 6.91 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ZoomSounds","product":"ZoomSounds","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-31054","published":"2025-12-31T20:05:20.832Z","updated":"2026-04-28T16:12:04.342Z","title":"WordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Themefy","product":"Bloggie","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2025-30628","published":"2025-12-31T20:03:50.402Z","updated":"2026-04-28T16:11:56.408Z","title":"WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"AA-Team","product":"Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-28973","published":"2025-12-31T20:02:10.769Z","updated":"2026-04-29T09:51:54.747Z","title":"WordPress Pro Bulk Watermark Plugin for WordPress <= 2.0 - Path Traversal Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AA-Team","product":"Pro Bulk Watermark Plugin for WordPress","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-28949","published":"2025-12-31T20:00:22.463Z","updated":"2026-04-28T16:11:51.525Z","title":"WordPress Mediabay - WordPress Media Library Folders <= 1.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Codedraft","product":"Mediabay - WordPress Media Library Folders","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-23757","published":"2025-12-31T19:58:33.725Z","updated":"2026-05-12T01:07:37.114Z","title":"WordPress ZD Scribd iPaper plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Proloy Chakroborty","product":"ZD Scribd iPaper","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23719","published":"2025-12-31T19:57:28.449Z","updated":"2026-05-12T01:07:45.735Z","title":"WordPress ZhinaTwitterWidget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"zckevin","product":"ZhinaTwitterWidget","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23707","published":"2025-12-31T19:56:21.648Z","updated":"2026-04-28T16:11:17.776Z","title":"WordPress En Masse plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Matamko","product":"En Masse","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23705","published":"2025-12-31T19:55:23.308Z","updated":"2026-04-28T16:11:17.759Z","title":"WordPress Zielke Design Project Gallery plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Terry Zielke","product":"Zielke Design Project Gallery","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23667","published":"2025-12-31T19:54:20.344Z","updated":"2026-04-28T16:11:16.318Z","title":"WordPress custom-post-edit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Christopher Churchill","product":"custom-post-edit","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-66144","published":"2025-12-31T19:51:58.516Z","updated":"2026-04-28T16:14:18.146Z","title":"WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Worker for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66145","published":"2025-12-31T19:51:22.621Z","updated":"2026-04-28T16:14:18.143Z","title":"WordPress Worker for WPBakery plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Worker for WPBakery","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66146","published":"2025-12-31T19:50:21.260Z","updated":"2026-04-28T16:14:18.146Z","title":"WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Logger for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66148","published":"2025-12-31T19:49:17.102Z","updated":"2026-04-28T16:14:18.064Z","title":"WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Conformer for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66149","published":"2025-12-31T18:38:14.772Z","updated":"2026-04-28T16:14:18.380Z","title":"WordPress UnGrabber plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"UnGrabber","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66150","published":"2025-12-31T18:35:57.735Z","updated":"2026-04-28T16:14:18.682Z","title":"WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Appender","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66151","published":"2025-12-31T18:32:49.483Z","updated":"2026-05-13T00:32:46.462Z","title":"WordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Countdowner for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66152","published":"2025-12-31T18:32:07.924Z","updated":"2026-04-28T16:14:18.833Z","title":"WordPress Criptopayer for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Criptopayer for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-66153","published":"2025-12-31T18:31:21.816Z","updated":"2026-04-28T16:14:18.859Z","title":"WordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Headinger for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-49355","published":"2025-12-31T17:21:50.962Z","updated":"2026-04-28T16:13:02.124Z","title":"WordPress Accessibility Press plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ikaes","product":"Accessibility Press","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-49337","published":"2025-12-31T17:21:05.083Z","updated":"2026-04-28T16:13:01.264Z","title":"WordPress Dashboard Beacon plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"janhenckens","product":"Dashboard Beacon","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-59135","published":"2025-12-31T17:20:09.618Z","updated":"2026-04-28T16:13:52.070Z","title":"WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"eleopard","product":"Behance Portfolio Manager","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-62989","published":"2025-12-31T17:19:24.282Z","updated":"2026-04-28T16:14:07.767Z","title":"WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Gora Tech","product":"Cooked","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-23608","published":"2025-12-31T17:07:06.352Z","updated":"2026-05-12T01:07:52.047Z","title":"WordPress LIVE TV plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Omar Mohamed Mohamoud","product":"LIVE TV","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-62088","published":"2025-12-31T17:04:44.038Z","updated":"2026-04-28T16:14:01.252Z","title":"WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"extendons","product":"WordPress & WooCommerce Scraper Plugin, Import Data from Any Site","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-59138","published":"2025-12-31T17:03:59.500Z","updated":"2026-04-28T16:13:52.226Z","title":"WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Jthemes","product":"Genemy","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2025-66154","published":"2025-12-31T17:01:26.537Z","updated":"2026-05-13T10:40:26.087Z","title":"WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Couponer for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66155","published":"2025-12-31T17:00:37.052Z","updated":"2026-04-28T16:14:18.971Z","title":"WordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Questionar for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66156","published":"2025-12-31T16:59:07.770Z","updated":"2026-04-28T16:14:18.864Z","title":"WordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Watcher for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66157","published":"2025-12-31T16:58:24.314Z","updated":"2026-04-28T16:14:19.078Z","title":"WordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Sliper for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66158","published":"2025-12-31T16:51:58.259Z","updated":"2026-04-28T16:14:18.861Z","title":"WordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Gmaper for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66159","published":"2025-12-31T16:51:12.320Z","updated":"2026-04-28T16:14:19.111Z","title":"WordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Walker for Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-66160","published":"2025-12-31T16:50:19.182Z","updated":"2026-04-28T16:14:18.970Z","title":"WordPress Select Graphist for Elementor\t Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Select Graphist for Elementor\t Graphist for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-63021","published":"2025-12-31T16:49:28.796Z","updated":"2026-04-28T16:14:08.686Z","title":"WordPress Valenti Engine plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codetipi","product":"Valenti Engine","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-62874","published":"2025-12-31T16:42:24.180Z","updated":"2026-04-28T16:14:04.383Z","title":"WordPress AnyComment plugin <= 0.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Alexander","product":"AnyComment","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-62099","published":"2025-12-31T16:41:35.232Z","updated":"2026-04-28T16:14:01.761Z","title":"WordPress Signature Add-On for Gravity Forms plugin <= 1.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"approveme","product":"Signature Add-On for Gravity Forms","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62101","published":"2025-12-31T16:33:19.519Z","updated":"2026-04-28T16:14:01.656Z","title":"WordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Omid Shamloo","product":"Pardakht Delkhah","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-63038","published":"2025-12-31T16:32:37.197Z","updated":"2026-04-28T16:14:09.180Z","title":"WordPress WP Custom Admin Interface plugin <= 7.40 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Northern Beaches Websites","product":"WP Custom Admin Interface","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-62078","published":"2025-12-31T16:32:00.958Z","updated":"2026-04-28T16:14:00.916Z","title":"WordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Fahad Mahmood","product":"Easy Upload Files During Checkout","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-49339","published":"2025-12-31T16:31:22.695Z","updated":"2026-04-28T16:13:01.677Z","title":"WordPress Direct Payments WP plugin <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Digages","product":"Direct Payments WP","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-49340","published":"2025-12-31T16:30:03.883Z","updated":"2026-04-28T16:13:01.829Z","title":"WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Digages","product":"Direct Payments WP","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-62083","published":"2025-12-31T16:29:16.387Z","updated":"2026-04-28T16:14:01.023Z","title":"WordPress BoomDevs WordPress Coming Soon plugin plugin <= 1.0.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"BoomDevs WordPress Coming Soon","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-62113","published":"2025-12-31T16:28:24.382Z","updated":"2026-04-28T16:14:01.751Z","title":"WordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"emendo_seb","product":"Co-marquage service-public.fr","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-62115","published":"2025-12-31T16:27:35.305Z","updated":"2026-04-28T16:14:01.810Z","title":"WordPress Hide Plugins plugin <= 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeBoy","product":"Hide Plugins","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62123","published":"2025-12-31T16:26:35.932Z","updated":"2026-04-28T16:14:02.267Z","title":"WordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"inkthemes","product":"WP Gmail SMTP","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-49352","published":"2025-12-31T16:25:44.989Z","updated":"2026-04-28T16:13:02.124Z","title":"WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"YoOhw Studio","product":"Order Cancellation & Returns for WooCommerce","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-62087","published":"2025-12-31T16:08:58.565Z","updated":"2026-05-12T01:06:52.676Z","title":"WordPress Sticky Notes for WP Dashboard plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Web Builder 143","product":"Sticky Notes for WP Dashboard","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-63040","published":"2025-12-31T16:08:18.968Z","updated":"2026-04-28T16:14:09.178Z","title":"WordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Saad Iqbal","product":"Post Snippets","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-49356","published":"2025-12-31T16:07:40.281Z","updated":"2026-04-28T16:13:02.159Z","title":"WordPress Orders Chat for WooCommerce plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mykola Lukin","product":"Orders Chat for WooCommerce","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-63004","published":"2025-12-31T16:06:59.389Z","updated":"2026-04-28T16:14:08.255Z","title":"WordPress All in One Accessibility plugin <= 1.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Skynet Technologies USA LLC","product":"All in One Accessibility","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-59130","published":"2025-12-31T16:06:06.815Z","updated":"2026-04-28T16:13:52.015Z","title":"WordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"appointify","product":"Appointify","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62130","published":"2025-12-31T16:05:22.706Z","updated":"2026-04-28T16:14:02.251Z","title":"WordPress Accordion Slider Gallery plugin <= 2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpdiscover","product":"Accordion Slider Gallery","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-62131","published":"2025-12-31T16:04:31.493Z","updated":"2026-04-28T16:14:02.265Z","title":"WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Strategy11 Team","product":"Tasty Recipes Lite","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-62132","published":"2025-12-31T16:03:41.173Z","updated":"2026-04-28T16:14:02.237Z","title":"WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Strategy11 Team","product":"Tasty Recipes Lite","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-62751","published":"2025-12-31T16:02:50.502Z","updated":"2026-04-28T16:14:03.855Z","title":"WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"extendthemes","product":"Vireo","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-62133","published":"2025-12-31T16:01:59.014Z","updated":"2026-04-28T16:14:02.292Z","title":"WordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"manidoraisamy","product":"FormFacade","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-63014","published":"2025-12-31T15:52:00.938Z","updated":"2026-04-28T16:14:08.615Z","title":"WordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Serhii Pasyuk","product":"Gmedia Photo Gallery","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62089","published":"2025-12-31T15:51:01.849Z","updated":"2026-04-28T16:14:01.408Z","title":"WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"MERGADO","product":"Mergado Pack","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62084","published":"2025-12-31T15:50:01.448Z","updated":"2026-05-12T01:06:16.274Z","title":"WordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Imdad Next Web","product":"iNext Woo Pincode Checker","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62143","published":"2025-12-31T15:49:17.340Z","updated":"2026-04-28T16:14:03.083Z","title":"WordPress Post Video Players plugin <= 1.163 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"nicashmu","product":"Post Video Players","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62148","published":"2025-12-31T15:45:54.708Z","updated":"2026-04-28T16:14:03.256Z","title":"WordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Eugen Bobrowski","product":"Robots.txt rewrite","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62080","published":"2025-12-31T15:44:45.835Z","updated":"2026-04-28T16:14:00.900Z","title":"WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Channelize.io Team","product":"Live Shopping & Shoppable Videos For WooCommerce","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62150","published":"2025-12-31T15:42:58.777Z","updated":"2026-04-28T16:14:03.732Z","title":"WordPress History Timeline plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themesawesome","product":"History Timeline","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-62154","published":"2025-12-31T15:41:50.974Z","updated":"2026-04-28T16:14:03.061Z","title":"WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"recorp","product":"AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-62114","published":"2025-12-31T15:40:07.221Z","updated":"2026-04-28T16:14:01.896Z","title":"WordPress Download Media Library plugin <= 0.2.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"marcelotorres","product":"Download Media Library","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-62116","published":"2025-12-31T15:39:13.222Z","updated":"2026-04-28T16:14:02.199Z","title":"WordPress AI Copilot plugin <= 1.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"quadlayers","product":"AI Copilot","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62122","published":"2025-12-31T15:38:08.774Z","updated":"2026-04-28T16:14:02.247Z","title":"WordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"solwininfotech","product":"Trash Duplicate and 301 Redirect","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-62079","published":"2025-12-31T15:37:27.530Z","updated":"2026-04-28T16:14:00.890Z","title":"WordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Damian","product":"WP Export Categories & Taxonomies","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-62126","published":"2025-12-31T15:36:42.037Z","updated":"2026-04-28T16:14:02.313Z","title":"WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Razvan Stanga","product":"Varnish/Nginx Proxy Caching","kev":false,"epss":0.00704,"kevAdded":null},{"id":"CVE-2025-49338","published":"2025-12-31T15:35:54.047Z","updated":"2026-04-28T16:13:01.190Z","title":"WordPress Flowbox plugin <= 1.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Flowbox","product":"Flowbox","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62747","published":"2025-12-31T15:33:59.438Z","updated":"2026-04-28T16:14:03.695Z","title":"WordPress Featured Image Generator plugin <= 1.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Aum Watcharapon","product":"Featured Image Generator","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-49334","published":"2025-12-31T15:25:23.165Z","updated":"2026-04-28T16:13:01.772Z","title":"WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Eduardo Villão","product":"MyD Delivery","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-59136","published":"2025-12-31T15:24:15.816Z","updated":"2026-04-28T16:13:52.038Z","title":"WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Efí Bank","product":"Gerencianet Oficial","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2025-62129","published":"2025-12-31T15:23:30.738Z","updated":"2026-04-28T16:14:02.252Z","title":"WordPress RestroPress plugin <= 3.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-62092","published":"2025-12-31T15:22:41.320Z","updated":"2026-04-28T16:14:01.284Z","title":"WordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wiremo","product":"Wiremo","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62755","published":"2025-12-31T15:22:00.836Z","updated":"2026-05-12T01:06:46.164Z","title":"WordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"GS Plugins","product":"GS Portfolio for Envato","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-63031","published":"2025-12-31T15:09:28.810Z","updated":"2026-10-28T13:39:33.266Z","title":"WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Grids","product":"EasyTest – Simplify A/B Testing","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62139","published":"2025-12-31T15:08:46.383Z","updated":"2026-04-28T16:14:02.950Z","title":"WordPress Terms descriptions plugin <= 3.4.10 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Vladimir Statsenko","product":"Terms descriptions","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-62141","published":"2025-12-31T15:07:45.128Z","updated":"2026-04-28T16:14:02.945Z","title":"WordPress Wawp plugin <= 4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Information Technology","product":"Wawp","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-63022","published":"2025-12-31T15:06:37.955Z","updated":"2026-04-28T16:14:08.940Z","title":"WordPress Simple Like Page plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"topdevs.net","product":"Simple Like Page","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-63016","published":"2025-12-31T15:03:53.532Z","updated":"2026-04-28T16:14:09.095Z","title":"WordPress QuadLayers TikTok Feed plugin <= 4.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"quadlayers","product":"QuadLayers TikTok Feed","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62145","published":"2025-12-31T15:01:59.749Z","updated":"2026-04-28T16:14:02.951Z","title":"WordPress DMCA Protection Badge plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NewClarity","product":"DMCA Protection Badge","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62147","published":"2025-12-31T15:01:16.790Z","updated":"2026-04-28T16:14:03.096Z","title":"WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"nikmelnik","product":"Realbig","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-62081","published":"2025-12-31T15:00:18.960Z","updated":"2026-04-28T16:14:01.140Z","title":"WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Channelize.io Team","product":"Live Shopping & Shoppable Videos For WooCommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-63053","published":"2025-12-31T14:59:09.225Z","updated":"2026-04-28T16:14:09.618Z","title":"WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liton Arefin","product":"Master Addons for Elementor","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-63001","published":"2025-12-31T14:56:30.381Z","updated":"2026-04-28T16:14:08.226Z","title":"WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-49349","published":"2025-12-31T14:48:34.082Z","updated":"2026-04-28T16:13:02.193Z","title":"WordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Reuters News Agency","product":"Reuters Direct","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62098","published":"2025-12-31T14:47:45.968Z","updated":"2026-04-28T16:14:01.718Z","title":"WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"totalsoft","product":"Portfolio Gallery","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-62091","published":"2025-12-31T14:19:32.045Z","updated":"2026-04-28T16:14:01.293Z","title":"WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Vollstart","product":"Serial Codes Generator and Validator with WooCommerce Support","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62108","published":"2025-12-31T14:18:42.155Z","updated":"2026-04-28T16:14:01.673Z","title":"WordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SaifuMak","product":"Add Custom Codes","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62888","published":"2025-12-31T14:17:55.113Z","updated":"2026-04-28T16:14:04.937Z","title":"WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Marco Milesi","product":"WP Attachments","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62117","published":"2025-12-31T13:56:26.868Z","updated":"2026-04-28T16:14:02.236Z","title":"WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Jayce53","product":"EasyIndex","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-62120","published":"2025-12-31T13:55:15.893Z","updated":"2026-04-28T16:14:02.228Z","title":"WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Rick Beckman","product":"OpenHook","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-62134","published":"2025-12-31T13:53:35.344Z","updated":"2026-05-12T01:06:38.194Z","title":"WordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"A WP Life","product":"Contact Form Widget","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-62138","published":"2025-12-31T13:51:42.207Z","updated":"2026-04-28T16:14:02.920Z","title":"WordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.4,"vendor":"cedcommerce","product":"WP Advanced PDF","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-62144","published":"2025-12-31T13:48:57.774Z","updated":"2026-04-28T16:14:02.950Z","title":"WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mohammed Kaludi","product":"Core Web Vitals & PageSpeed Booster","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-59003","published":"2025-12-31T13:46:13.364Z","updated":"2026-04-29T09:51:55.919Z","title":"WordPress ColorWay Theme <= 4.2.3 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.8,"vendor":"inkthemescom","product":"ColorWay","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-62119","published":"2025-12-31T13:43:18.136Z","updated":"2026-04-28T16:14:02.274Z","title":"WordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ViitorCloud Technologies Pvt Ltd","product":"Add Featured Image Custom Link","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-62121","published":"2025-12-31T13:39:51.761Z","updated":"2026-04-28T16:14:02.243Z","title":"WordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Imran Emu","product":"Logo Slider , Logo Carousel , Logo showcase , Client Logo","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-62124","published":"2025-12-31T13:37:53.733Z","updated":"2026-04-28T16:14:02.272Z","title":"WordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Soli","product":"WP Post Signature","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-62750","published":"2025-12-31T13:32:33.519Z","updated":"2026-04-28T16:14:03.906Z","title":"WordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Filipe Seabra","product":"WooCommerce Parcelas","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-62140","published":"2025-12-31T13:24:45.813Z","updated":"2026-04-28T16:14:03.097Z","title":"WordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"plainware","product":"Locatoraid Store Locator","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-62142","published":"2025-12-31T13:21:57.454Z","updated":"2026-04-28T16:14:02.966Z","title":"WordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"nicashmu","product":"Post Video Players","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-62149","published":"2025-12-31T13:18:40.521Z","updated":"2026-04-28T16:14:03.263Z","title":"WordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SaifuMak","product":"Add Custom Codes","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-62095","published":"2025-12-31T13:16:59.367Z","updated":"2026-04-28T16:14:01.691Z","title":"WordPress Bootstrap Modals plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"neilgee","product":"Bootstrap Modals","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-62096","published":"2025-12-31T13:12:18.482Z","updated":"2026-04-28T16:14:01.734Z","title":"WordPress Maximum Products per User for WooCommerce plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Maximum Products per User for WooCommerce","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62097","published":"2025-12-31T13:10:27.294Z","updated":"2026-04-28T16:14:01.663Z","title":"WordPress SEO Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"seothemes","product":"SEO Slider","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-63020","published":"2025-12-31T13:07:34.034Z","updated":"2026-05-12T01:07:15.115Z","title":"WordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wayne Allen","product":"Postie","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62111","published":"2025-12-31T13:05:54.784Z","updated":"2026-04-28T16:14:01.746Z","title":"WordPress Extra Shortcodes plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webvitaly","product":"Extra Shortcodes","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-49357","published":"2025-12-31T13:04:24.047Z","updated":"2026-04-28T16:13:02.111Z","title":"WordPress Audiomack plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"audiomack","product":"Audiomack","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62742","published":"2025-12-31T13:03:08.340Z","updated":"2026-04-28T16:14:03.734Z","title":"WordPress Curator.io plugin <= 1.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Curator.io","product":"Curator.io","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62118","published":"2025-12-31T12:59:08.280Z","updated":"2026-05-12T01:06:31.269Z","title":"WordPress AdWords Conversion Tracking Code plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kcseopro","product":"AdWords Conversion Tracking Code","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62990","published":"2025-12-31T12:57:22.765Z","updated":"2026-04-28T16:14:08.071Z","title":"WordPress Livemesh Addons for Beaver Builder plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"livemesh","product":"Livemesh Addons for Beaver Builder","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62125","published":"2025-12-31T12:55:50.045Z","updated":"2026-04-28T16:14:02.288Z","title":"WordPress Custom Background Changer plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Anshul Gangrade","product":"Custom Background Changer","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62743","published":"2025-12-31T12:51:39.424Z","updated":"2026-04-28T16:14:03.856Z","title":"WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"zookatron","product":"MyBookTable Bookstore","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62744","published":"2025-12-31T12:49:47.870Z","updated":"2026-05-12T01:06:23.756Z","title":"WordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chris Steman","product":"Page Title Splitter","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62748","published":"2025-12-31T12:02:49.488Z","updated":"2026-04-28T16:14:04.033Z","title":"WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Genetech Products","product":"Web and WooCommerce Addons for WPBakery Builder","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-49358","published":"2025-12-31T12:01:15.789Z","updated":"2026-04-28T16:13:02.194Z","title":"WordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ruhul Amin","product":"Content Fetcher","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-62749","published":"2025-12-31T11:59:31.689Z","updated":"2026-04-28T16:14:03.868Z","title":"WordPress User Specific Content plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bainternet","product":"User Specific Content","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-62752","published":"2025-12-31T11:57:50.214Z","updated":"2026-04-28T16:14:03.959Z","title":"WordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kalender.digital","product":"Kalender.digital","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-62135","published":"2025-12-31T11:56:24.183Z","updated":"2026-04-28T16:14:02.390Z","title":"WordPress Responsive Block Control plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"landwire","product":"Responsive Block Control","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-62756","published":"2025-12-31T11:54:40.487Z","updated":"2026-04-28T16:14:04.290Z","title":"WordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"lvaudore","product":"The Moneytizer","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-62757","published":"2025-12-31T11:53:12.910Z","updated":"2026-04-28T16:14:04.186Z","title":"WordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WebMan Design | Oliver Juhas","product":"WebMan Amplifier","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-62991","published":"2025-12-31T11:51:57.121Z","updated":"2026-04-28T16:14:08.232Z","title":"WordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"thinkupthemes","product":"Minamaze","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-63032","published":"2025-12-31T11:50:42.237Z","updated":"2026-04-28T16:14:09.142Z","title":"WordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"thinkupthemes","product":"Consulting","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-49028","published":"2025-12-31T09:05:02.812Z","updated":"2026-04-28T16:12:57.585Z","title":"WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Zoho Mail","product":"Zoho ZeptoMail","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2025-62136","published":"2025-12-31T09:00:40.532Z","updated":"2026-05-12T01:06:09.642Z","title":"WordPress Melos theme <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"thinkupthemes","product":"Melos","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62992","published":"2025-12-31T08:59:00.974Z","updated":"2026-04-28T16:14:08.172Z","title":"WordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-62137","published":"2025-12-31T08:57:17.441Z","updated":"2026-04-28T16:14:02.866Z","title":"WordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"shuttlethemes","product":"Shuttle","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-62758","published":"2025-12-31T08:55:12.187Z","updated":"2026-04-28T16:14:04.234Z","title":"WordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Funnelforms","product":"Funnelforms Free","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-62759","published":"2025-12-31T08:53:31.863Z","updated":"2026-04-28T16:14:04.340Z","title":"WordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Justin Tadlock","product":"Series","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-62760","published":"2025-12-31T08:52:04.460Z","updated":"2026-04-28T16:14:04.221Z","title":"WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BuddyDev","product":"BuddyPress Activity Shortcode","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-63000","published":"2025-12-31T08:50:23.702Z","updated":"2026-05-12T01:07:07.608Z","title":"WordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpforchurch","product":"Sermon Manager","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-62146","published":"2025-12-31T08:47:52.280Z","updated":"2026-04-28T16:14:02.935Z","title":"WordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Maksym Marko","product":"MX Time Zone Clocks","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-63005","published":"2025-12-31T08:46:02.530Z","updated":"2026-04-28T16:14:08.298Z","title":"WordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tomas","product":"WordPress Tooltips","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62761","published":"2025-12-31T08:44:22.540Z","updated":"2026-05-12T01:06:59.062Z","title":"WordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BasePress","product":"Knowledge Base documentation & wiki plugin – BasePress","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-49342","published":"2025-12-31T05:55:53.218Z","updated":"2026-05-12T01:07:30.582Z","title":"WordPress Custom Style plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"merzedes","product":"Custom Style","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49353","published":"2025-12-31T05:36:42.895Z","updated":"2026-04-28T16:13:02.165Z","title":"WordPress Noindex by Path plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Marcin Kijak","product":"Noindex by Path","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-68885","published":"2025-12-31T05:34:27.042Z","updated":"2026-04-28T16:14:32.692Z","title":"WordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"page-carbajal","product":"Custom Post Status","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49354","published":"2025-12-31T05:30:25.381Z","updated":"2026-04-28T16:13:02.096Z","title":"WordPress Recent Posts From Each Category plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mindstien Technologies","product":"Recent Posts From Each Category","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49343","published":"2025-12-31T05:28:06.720Z","updated":"2026-04-28T16:13:01.684Z","title":"WordPress Social Profilr plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"socialprofilr","product":"Social Profilr","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49344","published":"2025-12-31T05:25:58.689Z","updated":"2026-04-28T16:13:01.821Z","title":"WordPress SensitiveTagCloud plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"reneade","product":"SensitiveTagCloud","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49345","published":"2025-12-31T05:23:28.075Z","updated":"2026-04-28T16:13:01.877Z","title":"WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"mg12","product":"WP-EasyArchives","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-49346","published":"2025-12-31T04:37:01.172Z","updated":"2026-05-12T01:07:23.050Z","title":"WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"peterwsterling","product":"Simple Archive Generator","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-59137","published":"2025-12-31T04:33:22.492Z","updated":"2026-04-28T16:13:52.156Z","title":"WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"eleopard","product":"Behance Portfolio Manager","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-59131","published":"2025-12-30T22:55:32.248Z","updated":"2026-04-28T16:13:51.870Z","title":"WordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"hoernerfranz","product":"WP-CalDav2ICS","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2025-62753","published":"2025-12-30T22:37:03.420Z","updated":"2026-04-28T16:14:03.952Z","title":"WordPress MAS Videos plugin <= 1.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"MadrasThemes","product":"MAS Videos","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-59129","published":"2025-12-30T16:51:35.844Z","updated":"2026-04-28T16:13:51.380Z","title":"WordPress Appointify plugin <= 1.0.8 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"appointify","product":"Appointify","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-52835","published":"2025-12-30T16:48:13.719Z","updated":"2026-04-28T16:13:20.143Z","title":"WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"ConoHa by GMO","product":"WING WordPress Migrator","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-66103","published":"2025-12-30T16:43:38.792Z","updated":"2026-04-28T16:14:17.060Z","title":"WordPress WPCal.io plugin <= 0.9.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"revmakx","product":"WPCal.io","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-62128","published":"2025-12-30T16:23:46.871Z","updated":"2026-05-13T10:40:17.411Z","title":"WordPress SiteLock Security plugin <= 5.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SiteLock","product":"SiteLock Security – WP Hardening, Login Security & Malware Scans","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-62112","published":"2025-12-30T16:21:30.852Z","updated":"2026-04-28T16:14:01.953Z","title":"WordPress Import into Easy Property Listings plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Merv Barrett","product":"Import into Easy Property Listings","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66094","published":"2025-12-30T16:17:26.055Z","updated":"2026-04-28T16:14:16.334Z","title":"WordPress Yada Wiki plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dmccan","product":"Yada Wiki","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62746","published":"2025-12-30T16:13:59.784Z","updated":"2026-04-28T16:14:03.944Z","title":"WordPress Featured Video for WordPress – VideographyWP plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodeFlavors","product":"Featured Video for WordPress – VideographyWP","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-66080","published":"2025-12-30T16:10:40.664Z","updated":"2026-04-28T16:14:16.397Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-63027","published":"2025-12-30T16:03:32.421Z","updated":"2026-04-28T16:14:08.715Z","title":"WordPress WBC907 Core plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webcreations907","product":"WBC907 Core","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-64190","published":"2025-12-30T16:00:52.385Z","updated":"2026-04-28T16:14:10.264Z","title":"WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"8theme","product":"XStore Core","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69093","published":"2025-12-30T10:47:58.699Z","updated":"2026-04-28T20:42:28.016Z","title":"WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdesk","product":"ShopMagic","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-69092","published":"2025-12-30T10:47:58.488Z","updated":"2026-04-28T20:42:17.147Z","title":"WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-69091","published":"2025-12-30T10:47:58.298Z","updated":"2026-04-28T20:42:08.631Z","title":"WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kraft Plugins","product":"Demo Importer Plus","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69089","published":"2025-12-30T10:47:58.084Z","updated":"2026-04-28T20:41:47.920Z","title":"WordPress Auto Listings plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"autolistings","product":"Auto Listings","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-69088","published":"2025-12-30T10:47:57.866Z","updated":"2026-04-28T20:41:37.013Z","title":"WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vidish","product":"Combo Offers WooCommerce","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-69034","published":"2025-12-30T10:47:57.680Z","updated":"2026-04-28T16:14:35.040Z","title":"WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Lekker","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-69033","published":"2025-12-30T10:47:57.477Z","updated":"2026-04-28T20:34:06.260Z","title":"WordPress Blog Filter plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"A WP Life","product":"Blog Filter","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-69032","published":"2025-12-30T10:47:57.290Z","updated":"2026-04-28T16:14:34.872Z","title":"WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"FiveStar","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-69031","published":"2025-12-30T10:47:57.098Z","updated":"2026-04-28T16:14:34.952Z","title":"WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Skywarrior","product":"Arcane","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-69030","published":"2025-12-30T10:47:56.911Z","updated":"2026-04-28T16:14:34.790Z","title":"WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Backpack Traveler","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-69029","published":"2025-12-30T10:47:56.721Z","updated":"2026-04-28T16:14:34.907Z","title":"WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Select-Themes","product":"Struktur","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-69028","published":"2025-12-30T10:47:56.532Z","updated":"2026-04-28T20:33:56.672Z","title":"WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BoldGrid","product":"weForms","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-69027","published":"2025-12-30T10:47:56.343Z","updated":"2026-04-28T16:14:34.495Z","title":"WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"tychesoftwares","product":"Product Delivery Date for WooCommerce – Lite","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-69026","published":"2025-12-30T10:47:56.141Z","updated":"2026-04-28T16:14:34.481Z","title":"WordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Roxnor","product":"PopupKit","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-69025","published":"2025-12-30T10:47:55.921Z","updated":"2026-04-28T20:33:46.355Z","title":"WordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Aethonic","product":"Poptics","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-69024","published":"2025-12-30T10:47:55.715Z","updated":"2026-04-28T16:14:34.654Z","title":"WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bizswoop","product":"BizPrint","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-69023","published":"2025-12-30T10:47:55.530Z","updated":"2026-04-28T20:33:36.855Z","title":"WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Marketing Fire","product":"Discussion Board","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-69022","published":"2025-12-30T10:47:55.337Z","updated":"2026-04-28T16:14:34.406Z","title":"WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Weblizar - WordPress Themes & Plugin","product":"HR Management Lite","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-69021","published":"2025-12-30T10:47:55.134Z","updated":"2026-04-28T16:14:34.427Z","title":"WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ays Pro","product":"Popup box","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-69020","published":"2025-12-30T10:47:54.856Z","updated":"2026-04-28T20:33:25.693Z","title":"WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69019","published":"2025-12-30T10:47:54.668Z","updated":"2026-04-28T20:33:17.764Z","title":"WordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FlippingBook","product":"FlippingBook","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-69018","published":"2025-12-30T10:47:54.463Z","updated":"2026-04-28T20:33:04.219Z","title":"WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shamalli","product":"Web Directory Free","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69017","published":"2025-12-30T10:47:54.276Z","updated":"2026-04-28T16:14:34.519Z","title":"WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-69016","published":"2025-12-30T10:47:54.087Z","updated":"2026-10-07T14:58:27.244Z","title":"WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Averta LTD","product":"Shortcodes and extra features for Phlox theme","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-69015","published":"2025-12-30T10:47:53.892Z","updated":"2026-04-28T16:14:34.426Z","title":"WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability","severity":"LOW","score":3.8,"vendor":"Automattic","product":"Crowdsignal Forms","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-69014","published":"2025-12-30T10:47:53.707Z","updated":"2026-04-28T16:14:34.221Z","title":"WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-69013","published":"2025-12-30T10:47:53.465Z","updated":"2026-04-28T16:14:34.274Z","title":"WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"jetmonsters","product":"Stratum","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-69012","published":"2025-12-30T10:47:53.274Z","updated":"2026-04-28T16:14:34.195Z","title":"WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stephen Harris","product":"Event Organiser","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-69010","published":"2025-12-30T10:47:53.090Z","updated":"2026-04-28T20:32:32.666Z","title":"WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themebeez","product":"Themebeez Toolkit","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-69009","published":"2025-12-30T10:47:52.874Z","updated":"2026-04-28T16:14:34.032Z","title":"WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kamleshyadav","product":"Medicalequipment","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-69008","published":"2025-12-30T10:47:52.689Z","updated":"2026-04-28T20:32:23.396Z","title":"WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Inboxify","product":"Inboxify Sign Up Form","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-69007","published":"2025-12-30T10:47:52.485Z","updated":"2026-04-28T20:32:11.261Z","title":"WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"OTWthemes","product":"Popping Sidebars and Widgets Light","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-69006","published":"2025-12-30T10:47:52.307Z","updated":"2026-04-28T20:31:59.007Z","title":"WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Atte Moisio","product":"AM Events","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68998","published":"2025-12-30T10:47:52.118Z","updated":"2026-04-28T16:14:33.847Z","title":"WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Heateor Support","product":"Heateor Social Login","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-68997","published":"2025-12-30T10:47:51.914Z","updated":"2026-04-28T20:13:29.020Z","title":"WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-68996","published":"2025-12-30T10:47:51.680Z","updated":"2026-04-28T16:14:33.815Z","title":"WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"WebCodingPlace","product":"Responsive Posts Carousel Pro","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-68995","published":"2025-12-30T10:47:51.492Z","updated":"2026-04-28T16:14:33.810Z","title":"WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Premio","product":"My Sticky Elements","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-68994","published":"2025-12-30T10:47:51.296Z","updated":"2026-04-28T16:14:33.761Z","title":"WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"XforWooCommerce","product":"Product Loops for WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-68993","published":"2025-12-30T10:47:51.107Z","updated":"2026-04-28T16:14:33.764Z","title":"WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"XforWooCommerce","product":"Share, Print and PDF Products for WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-68992","published":"2025-12-30T10:47:50.920Z","updated":"2026-04-28T20:13:19.462Z","title":"WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xenioushk","product":"BWL Knowledge Base Manager","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-68991","published":"2025-12-30T10:47:50.729Z","updated":"2026-04-28T16:14:33.772Z","title":"WordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xenioushk","product":"BWL Pro Voting Manager","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-68990","published":"2025-12-30T10:47:50.548Z","updated":"2026-04-28T16:14:33.768Z","title":"WordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"xenioushk","product":"BWL Pro Voting Manager","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-68989","published":"2025-12-30T10:47:50.363Z","updated":"2026-04-28T16:14:33.789Z","title":"WordPress Contact Form 7 Extension For Mailchimp plugin <= 0.9.68 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Renzo Johnson","product":"contact-form-7-mailchimp-extension","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-68988","published":"2025-12-30T10:47:50.131Z","updated":"2026-04-28T16:14:33.801Z","title":"WordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"o2oe","product":"E-Invoice App Malaysia","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-68987","published":"2025-12-30T10:47:49.947Z","updated":"2026-04-28T16:14:33.768Z","title":"WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Edge-Themes","product":"Cinerama","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-68985","published":"2025-12-30T10:47:49.767Z","updated":"2026-04-28T16:14:33.567Z","title":"WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Aora","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-68984","published":"2025-12-30T10:47:49.577Z","updated":"2026-04-28T16:14:33.544Z","title":"WordPress Puca theme <= 2.6.39 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Puca","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-68983","published":"2025-12-30T10:47:49.392Z","updated":"2026-04-28T16:14:33.386Z","title":"WordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Greenmart","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-68982","published":"2025-12-30T10:47:49.216Z","updated":"2026-04-28T16:14:33.411Z","title":"WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"designthemes","product":"DesignThemes LMS Addon","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68981","published":"2025-12-30T10:47:49.035Z","updated":"2026-04-28T16:14:33.390Z","title":"WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"designthemes","product":"HomeFix Elementor Portfolio","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68980","published":"2025-12-30T10:47:48.858Z","updated":"2026-04-28T16:14:33.458Z","title":"WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"designthemes","product":"WeDesignTech Portfolio","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68979","published":"2025-12-30T10:47:48.678Z","updated":"2026-04-28T16:14:33.469Z","title":"WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SimpleCalendar","product":"Google Calendar Events","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-68978","published":"2025-12-30T10:47:48.485Z","updated":"2026-04-28T16:14:33.548Z","title":"WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"designthemes","product":"DesignThemes Core","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68977","published":"2025-12-30T10:47:48.297Z","updated":"2026-04-28T16:14:33.385Z","title":"WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"designthemes","product":"DesignThemes Portfolio Addon","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-68976","published":"2025-12-30T10:47:48.092Z","updated":"2026-04-28T16:14:33.395Z","title":"WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Eagle-Themes","product":"Eagle Booking","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-68975","published":"2025-12-30T10:47:47.878Z","updated":"2026-04-28T16:14:33.400Z","title":"WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Eagle-Themes","product":"Eagle Booking","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2025-68974","published":"2025-12-30T10:47:47.632Z","updated":"2026-04-28T16:14:33.450Z","title":"WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.6,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-23554","published":"2025-12-29T23:51:32.627Z","updated":"2026-04-28T16:11:12.896Z","title":"WordPress Off Page SEO plugin <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jakub Glos","product":"Off Page SEO","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23550","published":"2025-12-29T23:50:08.713Z","updated":"2026-04-28T16:11:12.920Z","title":"WordPress Product Puller plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kemal YAZICI","product":"Product Puller","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23469","published":"2025-12-29T23:48:36.314Z","updated":"2026-04-28T16:11:09.923Z","title":"WordPress Sleekplan plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"sleekplan","product":"Sleekplan","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-23458","published":"2025-12-29T23:32:44.943Z","updated":"2026-04-28T16:11:09.875Z","title":"WordPress Ads24 Lite plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rakessh","product":"Ads24 Lite","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68036","published":"2025-12-29T23:26:17.386Z","updated":"2026-04-28T16:14:27.295Z","title":"WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-68040","published":"2025-12-29T23:25:11.382Z","updated":"2026-04-28T16:14:27.401Z","title":"WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2023-41656","published":"2025-12-29T23:22:27.926Z","updated":"2026-04-28T16:08:37.807Z","title":"WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpdive","product":"Better Elementor Addons","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-32238","published":"2025-12-29T23:18:54.834Z","updated":"2026-04-28T16:08:22.198Z","title":"WordPress TheGem theme < 5.8.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-68498","published":"2025-12-29T23:13:35.444Z","updated":"2026-04-28T16:14:28.789Z","title":"WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-68499","published":"2025-12-29T23:10:45.157Z","updated":"2026-04-28T16:14:28.744Z","title":"WordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68502","published":"2025-12-29T21:16:55.539Z","updated":"2026-04-28T16:14:28.908Z","title":"WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-68503","published":"2025-12-29T21:15:43.312Z","updated":"2026-04-28T16:14:28.840Z","title":"WordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-68504","published":"2025-12-29T21:14:40.576Z","updated":"2026-04-28T16:14:29.082Z","title":"WordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSearch","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-68562","published":"2025-12-29T21:13:24.913Z","updated":"2026-04-28T16:14:30.369Z","title":"WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-68607","published":"2025-12-29T21:10:50.618Z","updated":"2026-04-28T16:14:31.270Z","title":"WordPress Custom Field Template plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hiroaki Miyashita","product":"Custom Field Template","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-68860","published":"2025-12-29T21:08:56.358Z","updated":"2026-04-28T16:14:31.983Z","title":"WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mobile Builder","product":"Mobile builder","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2025-68861","published":"2025-12-29T17:23:08.542Z","updated":"2026-04-28T16:14:32.113Z","title":"WordPress Plugin Optimizer plugin <= 1.3.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"pluginoptimizer","product":"Plugin Optimizer","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-68868","published":"2025-12-29T16:12:32.664Z","updated":"2026-04-28T16:14:32.108Z","title":"WordPress Wp Text Slider Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codeaffairs","product":"Wp Text Slider Widget","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68870","published":"2025-12-29T16:09:05.270Z","updated":"2026-04-28T16:14:32.148Z","title":"WordPress CookieHint WP plugin <= 1.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"reDim GmbH","product":"CookieHint WP","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-68876","published":"2025-12-29T16:05:23.287Z","updated":"2026-04-28T16:14:32.135Z","title":"WordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"INVELITY","product":"Invelity SPS connect","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68877","published":"2025-12-29T16:03:22.206Z","updated":"2026-04-28T16:14:32.129Z","title":"WordPress CedCommerce Integration for Good Market plugin <= 1.0.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"cedcommerce","product":"CedCommerce Integration for Good Market","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-68878","published":"2025-12-29T16:00:20.652Z","updated":"2026-04-28T16:14:32.167Z","title":"WordPress Advanced Custom CSS plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"prasadkirpekar","product":"Advanced Custom CSS","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68879","published":"2025-12-29T15:58:57.851Z","updated":"2026-04-28T16:14:32.164Z","title":"WordPress Content Grid Slider plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"councilsoft","product":"Content Grid Slider","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68893","published":"2025-12-29T15:56:47.504Z","updated":"2026-04-28T16:14:32.690Z","title":"WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"HETWORKS","product":"WordPress Image shrinker","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68897","published":"2025-12-29T15:55:13.564Z","updated":"2026-04-28T16:14:32.691Z","title":"WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Mohammad I. Okfie","product":"IF AS Shortcode","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-68606","published":"2025-12-24T13:10:48.784Z","updated":"2026-04-28T16:14:31.303Z","title":"WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPXPO","product":"PostX","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68605","published":"2025-12-24T13:10:48.261Z","updated":"2026-04-28T16:14:31.280Z","title":"WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Post Grid and Gutenberg Blocks","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68603","published":"2025-12-24T13:10:47.744Z","updated":"2026-04-28T16:14:31.304Z","title":"WordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Marketing Fire","product":"Editorial Calendar","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68602","published":"2025-12-24T13:10:47.134Z","updated":"2026-04-28T16:14:31.300Z","title":"WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Scott Paterson","product":"Accept Donations with PayPal & Stripe","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2025-68601","published":"2025-12-24T13:10:46.860Z","updated":"2026-04-28T16:14:31.310Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Rustaurius","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-68600","published":"2025-12-24T13:10:46.548Z","updated":"2026-04-28T16:14:31.242Z","title":"WordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Yannick Lefebvre","product":"Link Library","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68599","published":"2025-12-24T13:10:46.247Z","updated":"2026-04-28T16:14:31.285Z","title":"WordPress YouTube Embed plugin <= 5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Embeds For YouTube Plugin Support","product":"YouTube Embed","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68598","published":"2025-12-24T13:10:45.982Z","updated":"2026-09-21T10:57:59.959Z","title":"WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Live Composer Team","product":"Page Builder: Live Composer","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68597","published":"2025-12-24T13:10:45.718Z","updated":"2026-04-28T16:14:31.280Z","title":"WordPress Jobs for WordPress plugin <= 2.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68596","published":"2025-12-24T13:10:45.364Z","updated":"2026-11-04T00:15:25.683Z","title":"WordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Bit Apps","product":"Bit Assist","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-68595","published":"2025-12-24T13:10:44.856Z","updated":"2026-04-28T16:14:31.316Z","title":"WordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Trustindex","product":"Widgets for Social Photo Feed","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-68594","published":"2025-12-24T13:10:44.556Z","updated":"2026-04-28T16:14:31.225Z","title":"WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin <= 19.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Opinion Stage","product":"Poll, Survey & Quiz Maker Plugin by Opinion Stage","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-68593","published":"2025-12-24T13:10:44.275Z","updated":"2026-04-28T16:14:31.227Z","title":"WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liton Arefin","product":"WP Adminify","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-68592","published":"2025-12-24T13:10:43.992Z","updated":"2026-04-28T16:14:31.246Z","title":"WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liton Arefin","product":"WP Adminify","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68591","published":"2025-12-24T13:10:43.716Z","updated":"2026-04-28T16:14:31.228Z","title":"WordPress Simple File List plugin <= 6.1.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-68590","published":"2025-12-24T13:10:43.422Z","updated":"2026-04-28T16:14:30.930Z","title":"WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"CRM Perks","product":"Integration for Contact Form 7 HubSpot","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-68589","published":"2025-12-24T13:10:43.150Z","updated":"2026-04-28T16:14:30.900Z","title":"WordPress WP Telegram Widget and Join Link plugin <= 2.2.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Socio","product":"WP Telegram Widget and Join Link","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68588","published":"2025-12-24T13:10:42.857Z","updated":"2026-04-28T16:14:30.876Z","title":"WordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"totalsoft","product":"TS Poll","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68587","published":"2025-12-24T13:10:42.440Z","updated":"2026-04-28T16:14:30.900Z","title":"WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bob","product":"Watu Quiz","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68586","published":"2025-12-24T13:10:42.037Z","updated":"2026-11-04T00:15:11.383Z","title":"WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gora Tech","product":"Cooked","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68585","published":"2025-12-24T13:10:41.715Z","updated":"2026-04-28T16:14:31.224Z","title":"WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"Ben Balter","product":"WP Document Revisions","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-68584","published":"2025-12-24T13:10:41.424Z","updated":"2026-11-04T00:14:56.323Z","title":"WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Constantin Boiangiu","product":"Vimeotheque","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-68583","published":"2025-12-24T13:10:41.121Z","updated":"2026-04-28T16:14:30.853Z","title":"WordPress Fast User Switching plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tikweb Management","product":"Fast User Switching","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-68582","published":"2025-12-24T13:10:40.817Z","updated":"2026-04-28T16:14:30.660Z","title":"WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Funnelforms","product":"Funnelforms Free","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68581","published":"2025-12-24T13:10:40.513Z","updated":"2026-04-28T16:14:31.014Z","title":"WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"YITHEMES","product":"YITH Slider for page builders","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68580","published":"2025-12-24T13:10:40.193Z","updated":"2026-04-28T16:14:30.690Z","title":"WordPress Advanced Classifieds & Directory Pro plugin <= 3.2.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"pluginsware","product":"Advanced Classifieds & Directory Pro","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-68579","published":"2025-12-24T13:10:39.669Z","updated":"2026-04-28T16:14:30.710Z","title":"WordPress FV Simpler SEO plugin <= 1.9.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"FolioVision","product":"FV Simpler SEO","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68578","published":"2025-12-24T13:10:39.343Z","updated":"2026-04-28T16:14:30.691Z","title":"WordPress Addonify plugin <= 2.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Addonify","product":"Addonify","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68577","published":"2025-12-24T13:10:38.980Z","updated":"2026-04-28T16:14:30.697Z","title":"WordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Virusdie","product":"Virusdie","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68576","published":"2025-12-24T13:10:38.690Z","updated":"2026-04-28T16:14:30.715Z","title":"WordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Virusdie","product":"Virusdie","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-68575","published":"2025-12-24T13:10:38.366Z","updated":"2026-04-28T16:14:30.714Z","title":"WordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wappointment team","product":"Wappointment","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68574","published":"2025-12-24T13:10:38.100Z","updated":"2026-04-28T16:14:30.666Z","title":"WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"voidcoders","product":"WPBakery Visual Composer WHMCS Elements","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68573","published":"2025-12-24T13:10:37.793Z","updated":"2026-04-28T16:14:30.696Z","title":"WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Alessandro Piconi","product":"Simple Keyword to Link","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-68572","published":"2025-12-24T13:10:37.515Z","updated":"2026-04-28T16:14:30.641Z","title":"WordPress BBP Core plugin <= 1.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spider Themes","product":"BBP Core","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68571","published":"2025-12-24T13:10:37.254Z","updated":"2026-04-28T16:14:30.665Z","title":"WordPress SALESmanago plugin <= 3.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SALESmanago","product":"SALESmanago & Leadoo","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68570","published":"2025-12-24T13:10:36.970Z","updated":"2026-04-28T16:14:30.673Z","title":"WordPress Captivate Sync plugin <= 3.2.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"captivateaudio","product":"Captivate Sync","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-68569","published":"2025-12-24T13:10:36.669Z","updated":"2026-04-28T16:14:30.612Z","title":"WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"WP Time Slots Booking Form","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-68568","published":"2025-12-24T13:10:36.357Z","updated":"2026-04-28T16:14:30.628Z","title":"WordPress Claspo – Popups, Spin the Wheel & Email Capture plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Claspo Popup Builders","product":"Claspo – Popups, Spin the Wheel & Email Capture","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68567","published":"2025-12-24T13:10:36.094Z","updated":"2026-04-28T16:14:30.610Z","title":"WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-68566","published":"2025-12-24T13:10:35.820Z","updated":"2026-04-28T16:14:30.498Z","title":"WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68565","published":"2025-12-24T13:10:35.534Z","updated":"2026-04-28T16:14:30.361Z","title":"WordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"JayBee","product":"Twitch Player","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-68506","published":"2025-12-24T13:10:26.727Z","updated":"2026-04-28T16:14:28.879Z","title":"WordPress Docket Cache plugin <= 24.07.03 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Nawawi Jamili","product":"Docket Cache","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-68038","published":"2025-12-24T13:10:25.043Z","updated":"2026-04-28T16:14:27.348Z","title":"WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Icegram","product":"Icegram Express Pro","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2025-67909","published":"2025-12-24T13:10:24.788Z","updated":"2026-04-28T16:14:22.929Z","title":"WordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Membership For WooCommerce","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2025-67633","published":"2025-12-24T13:10:24.524Z","updated":"2026-04-28T16:14:22.924Z","title":"WordPress Greenhouse Job Board plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"brownbagmarketing","product":"Greenhouse Job Board","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67632","published":"2025-12-24T13:10:24.256Z","updated":"2026-04-28T16:14:22.869Z","title":"WordPress Google AdSense for Responsive Design – GARD plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"The Plugin Factory","product":"Google AdSense for Responsive Design – GARD","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67631","published":"2025-12-24T13:10:23.974Z","updated":"2026-04-28T16:14:22.889Z","title":"WordPress Gift Hunt plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ecommerce Platforms","product":"Gift Hunt","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67630","published":"2025-12-24T13:10:23.685Z","updated":"2026-04-28T16:14:22.856Z","title":"WordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"webheadcoder","product":"WH Tweaks","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67629","published":"2025-12-24T13:10:23.380Z","updated":"2026-04-28T16:14:22.853Z","title":"WordPress Basticom Framework plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Basticom","product":"Basticom Framework","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67628","published":"2025-12-24T13:10:23.116Z","updated":"2026-04-28T16:14:22.835Z","title":"WordPress Review Disclaimer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"AMP-MODE","product":"Review Disclaimer","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67627","published":"2025-12-24T13:10:22.835Z","updated":"2026-04-28T16:14:22.897Z","title":"WordPress Draft Notify plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"TouchOfTech","product":"Draft Notify","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67625","published":"2025-12-24T13:10:22.548Z","updated":"2026-04-28T16:14:22.870Z","title":"WordPress Trade Runner plugin <= 3.14 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tmtraderunner","product":"Trade Runner","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-67623","published":"2025-12-24T13:10:22.188Z","updated":"2026-04-28T16:14:22.715Z","title":"WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"6Storage","product":"6Storage Rentals","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-67622","published":"2025-12-24T13:10:21.161Z","updated":"2026-04-28T16:14:22.853Z","title":"WordPress Evergreen Post Tweeter plugin <= 1.8.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"titopandub","product":"Evergreen Post Tweeter","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2025-67621","published":"2025-12-24T13:10:20.740Z","updated":"2026-04-28T16:14:22.804Z","title":"WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"10up","product":"Eight Day Week Print Workflow","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2023-40679","published":"2025-12-24T12:51:55.976Z","updated":"2026-04-28T16:08:37.191Z","title":"WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jewel Theme","product":"Master Addons for Elementor","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2023-36525","published":"2025-12-24T12:49:35.813Z","updated":"2026-04-28T16:08:31.283Z","title":"WordPress WPJobBoard plugin <= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability","severity":"HIGH","score":8.6,"vendor":"WPJobBoard","product":"WPJobBoard","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2023-32120","published":"2025-12-24T12:45:48.073Z","updated":"2026-04-28T16:08:21.932Z","title":"WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)","severity":"MEDIUM","score":5.9,"vendor":"Bob","product":"Hostel","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2023-28619","published":"2025-12-24T12:43:50.413Z","updated":"2026-04-28T16:08:16.219Z","title":"WordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation","severity":"MEDIUM","score":4.3,"vendor":"bnayawpguy","product":"Resoto","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-68608","published":"2025-12-24T12:31:31.259Z","updated":"2026-04-28T16:14:31.313Z","title":"WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"DeluxeThemes","product":"Userpro","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-68563","published":"2025-12-24T12:31:30.996Z","updated":"2026-04-28T16:14:30.339Z","title":"WordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Shuffle","product":"Subscribe to Unlock Lite","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-68540","published":"2025-12-24T12:31:27.748Z","updated":"2026-04-28T16:14:29.564Z","title":"WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Fana","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-68537","published":"2025-12-24T12:31:27.277Z","updated":"2026-11-04T00:14:41.920Z","title":"WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Zota","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-68535","published":"2025-12-24T12:31:27.019Z","updated":"2026-04-28T16:14:29.918Z","title":"WordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-68533","published":"2025-12-24T12:31:26.717Z","updated":"2026-04-28T16:14:29.524Z","title":"WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HasThemes","product":"WC Builder","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-68532","published":"2025-12-24T12:31:26.464Z","updated":"2026-04-28T16:14:29.511Z","title":"WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"modeltheme","product":"ModelTheme Addons for WPBakery and Elementor","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-68530","published":"2025-12-24T12:31:26.200Z","updated":"2026-04-28T16:14:29.533Z","title":"WordPress Bookory theme <= 2.2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"pavothemes","product":"Bookory","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68529","published":"2025-12-24T12:31:25.832Z","updated":"2026-04-28T16:14:29.921Z","title":"WordPress WP Email Capture plugin <= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rhys Wynne","product":"WP Email Capture","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-68528","published":"2025-12-24T12:31:25.572Z","updated":"2026-04-28T16:14:29.525Z","title":"WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68527","published":"2025-12-24T12:31:25.030Z","updated":"2026-04-28T16:14:29.593Z","title":"WordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kodezen LLC","product":"Academy LMS","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68525","published":"2025-12-24T12:31:24.777Z","updated":"2026-04-28T16:14:29.559Z","title":"WordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"pixelgrade","product":"Category Icon","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-68523","published":"2025-12-24T12:31:24.167Z","updated":"2026-04-28T16:14:29.274Z","title":"WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Spiffy Plugins","product":"Spiffy Calendar","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-68522","published":"2025-12-24T12:31:23.576Z","updated":"2026-04-28T16:14:29.218Z","title":"WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpstream","product":"WpStream","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68521","published":"2025-12-24T12:31:23.159Z","updated":"2026-04-28T16:14:29.184Z","title":"WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpstream","product":"WpStream","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-68519","published":"2025-12-24T12:31:22.910Z","updated":"2026-04-28T16:14:29.187Z","title":"WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BeRocket","product":"Brands for WooCommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-68517","published":"2025-12-24T12:31:22.624Z","updated":"2026-04-28T16:14:29.128Z","title":"WordPress Tablesome plugin <= 1.1.35.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Essekia","product":"Tablesome","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-68516","published":"2025-12-24T12:31:22.368Z","updated":"2026-04-28T16:14:29.140Z","title":"WordPress Tablesome plugin <= 1.1.35.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5,"vendor":"Essekia","product":"Tablesome","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68513","published":"2025-12-24T12:31:22.085Z","updated":"2026-04-28T16:14:29.133Z","title":"WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Timeline Lite","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68512","published":"2025-12-24T12:31:21.792Z","updated":"2026-04-28T16:14:29.101Z","title":"WordPress Real 3D FlipBook plugin <= 4.11.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"creativeinteractivemedia","product":"Real 3D FlipBook","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-68511","published":"2025-12-24T12:31:21.523Z","updated":"2026-04-28T16:14:29.127Z","title":"WordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jegstudio","product":"Gutenverse Form","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-68509","published":"2025-12-24T12:31:21.266Z","updated":"2026-04-28T16:14:28.876Z","title":"WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Jeff Starr","product":"User Submitted Posts","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-68508","published":"2025-12-24T12:31:20.967Z","updated":"2026-04-28T16:14:28.953Z","title":"WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brave","product":"Brave","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-68505","published":"2025-12-24T12:31:20.714Z","updated":"2026-04-28T16:14:29.071Z","title":"WordPress H5P plugin <= 1.16.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"icc0rz","product":"H5P","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-68500","published":"2025-12-24T12:31:20.426Z","updated":"2026-04-28T16:14:28.870Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"bdthemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2025-68497","published":"2025-12-24T12:31:19.996Z","updated":"2026-04-28T16:14:28.741Z","title":"WordPress Astra Widgets plugin <= 1.2.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Brainstorm Force","product":"Astra Widgets","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-68496","published":"2025-12-24T12:31:19.688Z","updated":"2026-04-28T16:14:28.673Z","title":"WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Syed Balkhi","product":"User Feedback","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-68494","published":"2025-12-24T12:31:19.012Z","updated":"2026-04-28T16:14:28.625Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.53 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2024-24844","published":"2025-12-23T12:06:04.875Z","updated":"2026-04-28T16:09:10.933Z","title":"WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability","severity":"HIGH","score":7.5,"vendor":"IdeaBox Creations","product":"PowerPack Pro for Elementor","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2023-52210","published":"2025-12-23T12:02:46.352Z","updated":"2026-04-28T16:09:07.029Z","title":"WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Tyche softwares","product":"Product Delivery Date for WooCommerce – Lite","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-68546","published":"2025-12-23T12:00:07.057Z","updated":"2026-04-28T16:14:30.256Z","title":"WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Nika","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68544","published":"2025-12-23T11:58:39.264Z","updated":"2026-04-28T16:14:29.970Z","title":"WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Diza","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-68548","published":"2025-12-23T11:50:41.384Z","updated":"2026-04-28T16:14:30.224Z","title":"WordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WebCodingPlace","product":"Responsive Posts Carousel Pro","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68550","published":"2025-12-23T11:47:59.408Z","updated":"2026-04-28T16:14:30.246Z","title":"WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"VillaTheme","product":"WPBulky","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-68551","published":"2025-12-23T11:46:19.271Z","updated":"2026-04-28T16:14:30.248Z","title":"WordPress VPSUForm plugin <= 3.2.24 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vikas Ratudi","product":"VPSUForm","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-68556","published":"2025-12-23T11:44:49.953Z","updated":"2026-04-28T16:14:30.292Z","title":"WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"HAPPY","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-68557","published":"2025-12-23T11:43:26.693Z","updated":"2026-04-28T16:14:30.258Z","title":"WordPress Chakra test plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Vikas Ratudi","product":"Chakra test","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-68559","published":"2025-12-23T11:37:35.431Z","updated":"2026-04-28T16:14:30.244Z","title":"WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68560","published":"2025-12-23T11:36:26.213Z","updated":"2026-04-28T16:14:30.348Z","title":"WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for Elementor)","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-68561","published":"2025-12-23T11:34:34.900Z","updated":"2026-04-28T16:14:30.309Z","title":"WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-62094","published":"2025-12-22T09:47:18.472Z","updated":"2026-04-28T16:14:01.530Z","title":"WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"voidthemes","product":"Void Elementor WHMCS Elements For Elementor Page Builder","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62107","published":"2025-12-22T09:32:48.407Z","updated":"2026-04-28T16:14:01.739Z","title":"WordPress Feather Login Page plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PluginOps","product":"Feather Login Page","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62880","published":"2025-12-22T09:31:35.354Z","updated":"2026-04-28T16:14:04.620Z","title":"WordPress Custom 404 Pro plugin <= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kunal","product":"Custom 404 Pro","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-62901","published":"2025-12-21T21:11:56.857Z","updated":"2026-05-13T10:40:10.126Z","title":"WordPress WP Microdata plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tormorten","product":"WP Microdata","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-62926","published":"2025-12-21T21:09:59.552Z","updated":"2026-05-13T10:39:38.775Z","title":"WordPress TempTool  [Show Current Template Info] plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HappyDevs","product":"TempTool  [Show Current Template Info]","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62955","published":"2025-12-21T21:06:30.982Z","updated":"2026-04-28T16:14:06.894Z","title":"WordPress TempTool  [Show Current Template Info] plugin <= 1.3.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HappyDevs","product":"TempTool  [Show Current Template Info]","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-47232","published":"2025-12-21T00:06:36.830Z","updated":"2026-04-28T16:08:48.999Z","title":"WordPress WP Affiliate Disclosure plugin <= 1.2.6 - Broken Access Control + CSRF vulnerability","severity":"MEDIUM","score":4.3,"vendor":"mojofywp","product":"WP Affiliate Disclosure","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2023-25446","published":"2025-12-21T00:01:58.948Z","updated":"2026-04-28T16:08:07.906Z","title":"WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.7,"vendor":"HappyFiles","product":"HappyFiles Pro","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2023-25445","published":"2025-12-21T00:00:41.013Z","updated":"2026-04-28T16:08:07.875Z","title":"WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"HappyFiles","product":"HappyFiles Pro","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-25068","published":"2025-12-20T23:58:16.726Z","updated":"2026-04-28T16:08:07.856Z","title":"WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation","severity":"MEDIUM","score":4.3,"vendor":"Mapro Collins","product":"Magazine Edge","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-62960","published":"2025-12-18T16:51:56.300Z","updated":"2026-04-28T16:14:06.919Z","title":"WordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sparklewpthemes","product":"Construction Light","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62961","published":"2025-12-18T16:50:43.015Z","updated":"2026-04-28T16:14:06.920Z","title":"WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sparklewpthemes","product":"Sparkle FSE","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62998","published":"2025-12-18T16:49:22.414Z","updated":"2026-05-13T10:39:29.628Z","title":"WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5,"vendor":"WP Messiah","product":"WP AI CoPilot","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-63002","published":"2025-12-18T16:46:48.251Z","updated":"2026-04-28T16:14:08.188Z","title":"WordPress Sermon Manager plugin <= 2.30.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpforchurch","product":"Sermon Manager","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-63043","published":"2025-12-18T16:45:08.201Z","updated":"2026-04-28T16:14:09.149Z","title":"WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PickPlugins","product":"Post Grid and Gutenberg Blocks","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-64235","published":"2025-12-18T16:43:47.100Z","updated":"2026-04-28T16:14:11.770Z","title":"WordPress Tuturn plugin < 3.6 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AmentoTech","product":"Tuturn","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-64236","published":"2025-12-18T16:21:48.796Z","updated":"2026-04-28T16:14:11.317Z","title":"WordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AmentoTech","product":"Tuturn","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2025-64282","published":"2025-12-18T16:18:54.393Z","updated":"2026-04-28T16:14:13.350Z","title":"WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"RadiusTheme","product":"Radius Blocks","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-64355","published":"2025-12-18T16:16:33.764Z","updated":"2026-04-28T16:14:14.266Z","title":"WordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-66058","published":"2025-12-18T16:15:15.498Z","updated":"2026-04-28T16:14:15.298Z","title":"WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Post Grid and Gutenberg Blocks","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-67546","published":"2025-12-18T07:22:19.542Z","updated":"2026-04-28T19:19:25.624Z","title":"WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-66119","published":"2025-12-18T07:22:19.370Z","updated":"2026-04-28T19:08:55.259Z","title":"WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Hostel","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-66118","published":"2025-12-18T07:22:19.186Z","updated":"2026-04-28T19:08:42.110Z","title":"WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BoldGrid","product":"Sprout Clients","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-66117","published":"2025-12-18T07:22:19.016Z","updated":"2026-04-28T16:14:17.251Z","title":"WordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Ays Pro","product":"Easy Form","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-66116","published":"2025-12-18T07:22:18.838Z","updated":"2026-04-28T19:08:32.993Z","title":"WordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"UserElements","product":"Ultimate Member Widgets for Elementor","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-66104","published":"2025-12-18T07:22:18.646Z","updated":"2026-04-28T16:14:17.064Z","title":"WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Anton Vanyukov","product":"Offload, AI & Optimize with Cloudflare Images","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-66102","published":"2025-12-18T07:22:18.448Z","updated":"2026-04-28T19:08:02.494Z","title":"WordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"FV Antispam","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-66100","published":"2025-12-18T07:22:18.263Z","updated":"2026-04-28T19:07:53.326Z","title":"WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-66088","published":"2025-12-18T07:22:18.084Z","updated":"2026-04-28T16:14:16.407Z","title":"WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-66078","published":"2025-12-18T07:22:17.890Z","updated":"2026-04-28T16:14:16.343Z","title":"WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"jetmonsters","product":"Hotel Booking Lite","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-66074","published":"2025-12-18T07:22:17.689Z","updated":"2026-04-28T16:14:15.776Z","title":"WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Cozmoslabs","product":"WP Webhooks","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-66070","published":"2025-12-18T07:22:17.491Z","updated":"2026-04-28T16:14:15.778Z","title":"WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-66068","published":"2025-12-18T07:22:17.312Z","updated":"2026-04-28T16:14:15.712Z","title":"WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-66054","published":"2025-12-18T07:22:17.129Z","updated":"2026-04-28T16:14:15.533Z","title":"WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-64378","published":"2025-12-18T07:22:16.946Z","updated":"2026-04-28T16:14:14.807Z","title":"WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-64377","published":"2025-12-18T07:22:16.752Z","updated":"2026-04-28T18:32:17.259Z","title":"WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-64376","published":"2025-12-18T07:22:16.555Z","updated":"2026-04-28T18:32:08.887Z","title":"WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-64375","published":"2025-12-18T07:22:16.373Z","updated":"2026-04-28T16:14:14.843Z","title":"WordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mahmudul Hasan Arif","product":"WP Social Ninja","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-64374","published":"2025-12-18T07:22:16.202Z","updated":"2026-04-28T18:31:57.673Z","title":"WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-64373","published":"2025-12-18T07:22:16.006Z","updated":"2026-04-28T16:14:14.711Z","title":"WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-64372","published":"2025-12-18T07:22:15.823Z","updated":"2026-04-28T16:14:14.653Z","title":"WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-64371","published":"2025-12-18T07:22:15.635Z","updated":"2026-04-28T16:14:14.648Z","title":"WordPress Traveler theme < 3.2.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-64295","published":"2025-12-18T07:22:15.447Z","updated":"2026-04-29T09:51:55.857Z","title":"WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syed Balkhi","product":"All In One SEO Pack","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2025-64273","published":"2025-12-18T07:22:15.266Z","updated":"2026-04-28T16:14:13.322Z","title":"WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GetResponse","product":"Email marketing for WordPress by GetResponse Official","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-64272","published":"2025-12-18T07:22:15.080Z","updated":"2026-04-28T18:29:03.489Z","title":"WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GetResponse","product":"Email marketing for WordPress by GetResponse Official","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-64270","published":"2025-12-18T07:22:14.865Z","updated":"2026-04-28T18:28:54.276Z","title":"WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-64268","published":"2025-12-18T07:22:14.683Z","updated":"2026-04-28T18:28:44.581Z","title":"WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-64266","published":"2025-12-18T07:22:14.481Z","updated":"2026-04-28T18:28:35.463Z","title":"WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-64260","published":"2025-12-18T07:22:14.310Z","updated":"2026-04-28T18:28:16.112Z","title":"WordPress ANAC XML Bandi di Gara plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Marco Milesi","product":"ANAC XML Bandi di Gara","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-64258","published":"2025-12-18T07:22:14.130Z","updated":"2026-04-28T18:28:06.820Z","title":"WordPress Follow My Blog Post plugin <= 2.3.9 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"wpweb","product":"Follow My Blog Post","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-64233","published":"2025-12-18T07:22:13.958Z","updated":"2026-04-28T18:27:09.532Z","title":"WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Codiqa","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-64231","published":"2025-12-18T07:22:13.778Z","updated":"2026-04-28T16:14:11.320Z","title":"WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"RedefiningTheWeb","product":"WordPress Contact Form 7 PDF, Google Sheet & Database","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-64230","published":"2025-12-18T07:22:13.596Z","updated":"2026-04-28T16:14:11.829Z","title":"WordPress Filr plugin <= 1.2.10 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"WP Chill","product":"Filr","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2025-64227","published":"2025-12-18T07:22:13.423Z","updated":"2026-04-28T18:26:32.070Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-64225","published":"2025-12-18T07:22:13.245Z","updated":"2026-04-28T16:14:11.549Z","title":"WordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"colabrio","product":"Stockie Extra","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-64223","published":"2025-12-18T07:22:13.068Z","updated":"2026-04-28T18:26:14.387Z","title":"WordPress PenNews theme < 6.7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"PenciDesign","product":"PenNews","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-64222","published":"2025-12-18T07:22:12.885Z","updated":"2026-04-28T16:14:11.567Z","title":"WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"FantasticPlugins","product":"WooCommerce Recover Abandoned Cart","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-64221","published":"2025-12-18T07:22:12.714Z","updated":"2026-04-28T18:26:03.993Z","title":"WordPress Reservation Plugin plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"Reservation Plugin","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-64218","published":"2025-12-18T07:22:12.527Z","updated":"2026-04-29T09:51:55.890Z","title":"WordPress Passster plugin <= 4.2.19 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2025-64217","published":"2025-12-18T07:22:12.346Z","updated":"2026-04-28T18:25:36.356Z","title":"WordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-64214","published":"2025-12-18T07:22:12.176Z","updated":"2026-04-28T16:14:10.851Z","title":"WordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"MasterStudy LMS Pro","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-64213","published":"2025-12-18T07:22:11.993Z","updated":"2026-04-28T18:25:18.141Z","title":"WordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"MasterStudy LMS Pro","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-64209","published":"2025-12-18T07:22:11.805Z","updated":"2026-04-28T18:24:58.564Z","title":"WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Masterstudy","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-64207","published":"2025-12-18T07:22:11.630Z","updated":"2026-04-28T18:24:39.799Z","title":"WordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-64206","published":"2025-12-18T07:22:11.440Z","updated":"2026-04-28T18:24:30.634Z","title":"WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-64205","published":"2025-12-18T07:22:11.263Z","updated":"2026-04-28T16:14:10.857Z","title":"WordPress Jannah theme <= 7.6.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-64203","published":"2025-12-18T07:22:11.085Z","updated":"2026-04-28T18:24:12.750Z","title":"WordPress Mailster plugin < 4.1.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EverPress","product":"Mailster","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-64193","published":"2025-12-18T07:22:10.879Z","updated":"2026-04-28T18:23:04.050Z","title":"WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-64192","published":"2025-12-18T07:22:10.694Z","updated":"2026-04-28T18:22:55.088Z","title":"WordPress XStore theme < 9.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-64191","published":"2025-12-18T07:22:10.489Z","updated":"2026-04-28T18:22:46.664Z","title":"WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-64189","published":"2025-12-18T07:22:10.319Z","updated":"2026-04-28T16:14:10.269Z","title":"WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme","product":"XStore Core","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-64188","published":"2025-12-18T07:22:10.139Z","updated":"2026-04-28T18:22:37.818Z","title":"WordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"PenciDesign","product":"Soledad","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-6326","published":"2025-12-18T07:22:09.950Z","updated":"2026-04-28T18:22:12.211Z","title":"WordPress Inset theme <= 1.18.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Inset","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-6324","published":"2025-12-18T07:22:09.770Z","updated":"2026-04-28T18:21:54.964Z","title":"WordPress Easy Invoice plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"MatrixAddons","product":"Easy Invoice","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-63039","published":"2025-12-18T07:22:09.593Z","updated":"2026-04-28T16:14:09.106Z","title":"WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-60182","published":"2025-12-18T07:22:09.410Z","updated":"2026-04-28T18:39:33.901Z","title":"WordPress Support Board plugin < 3.8.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Schiocco","product":"Support Board","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-60180","published":"2025-12-18T07:22:09.230Z","updated":"2026-04-28T18:39:24.245Z","title":"WordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms Salesforce","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60178","published":"2025-12-18T07:22:09.058Z","updated":"2026-04-28T18:39:12.738Z","title":"WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms HubSpot","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60174","published":"2025-12-18T07:22:08.874Z","updated":"2026-04-28T18:38:46.480Z","title":"WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms Constant Contact Plugin","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60091","published":"2025-12-18T07:22:08.688Z","updated":"2026-04-28T18:38:08.818Z","title":"WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms Zoho CRM and Bigin","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60090","published":"2025-12-18T07:22:08.488Z","updated":"2026-04-28T18:37:59.843Z","title":"WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms Insightly","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60089","published":"2025-12-18T07:22:08.306Z","updated":"2026-04-28T18:37:51.191Z","title":"WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms FreshDesk Plugin","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-60088","published":"2025-12-18T07:22:08.134Z","updated":"2026-04-28T18:37:41.322Z","title":"WordPress WebinarIgnition plugin <= 4.06.04 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saleswonder Team: Tobias","product":"WebinarIgnition","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-60086","published":"2025-12-18T07:22:07.949Z","updated":"2026-04-28T16:13:54.131Z","title":"WordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Matt","product":"WP Voting Contest","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-60084","published":"2025-12-18T07:22:07.769Z","updated":"2026-04-28T16:13:54.192Z","title":"WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"add-ons.org","product":"PDF for Elementor Forms + Drag And Drop Template Builder","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-60083","published":"2025-12-18T07:22:07.543Z","updated":"2026-04-28T18:37:22.561Z","title":"WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"add-ons.org","product":"PDF Invoice Builder for WooCommerce","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-60082","published":"2025-12-18T07:22:07.372Z","updated":"2026-04-28T18:37:13.299Z","title":"WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"add-ons.org","product":"PDF for WPForms","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-60081","published":"2025-12-18T07:22:07.192Z","updated":"2026-04-28T18:37:04.220Z","title":"WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"add-ons.org","product":"PDF for Contact Form 7","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2025-60080","published":"2025-12-18T07:22:07.018Z","updated":"2026-04-28T18:36:54.668Z","title":"WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"add-ons.org","product":"PDF for Gravity Forms + Drag And Drop Template Builder","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-60079","published":"2025-12-18T07:22:06.840Z","updated":"2026-04-28T16:13:54.305Z","title":"WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Parallax Section block","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-60078","published":"2025-12-18T07:22:06.654Z","updated":"2026-04-28T16:13:54.142Z","title":"WordPress Task Manager plugin <= 3.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Agence web Eoxia – Montpellier","product":"Task Manager","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-60077","published":"2025-12-18T07:22:06.434Z","updated":"2026-04-28T18:36:45.751Z","title":"WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"YayCommerce","product":"YayPricing","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-60076","published":"2025-12-18T07:22:06.163Z","updated":"2026-04-28T16:13:54.254Z","title":"WordPress Ray Enterprise Translation plugin <= 1.7.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Jiro Sasamoto","product":"Ray Enterprise Translation","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-60072","published":"2025-12-18T07:22:05.940Z","updated":"2026-04-28T16:13:54.138Z","title":"WordPress Anchor smooth scroll plugin <= 1.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Processby","product":"Anchor smooth scroll","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60071","published":"2025-12-18T07:22:05.770Z","updated":"2026-04-28T16:13:54.105Z","title":"WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"don-themes","product":"Riode","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60070","published":"2025-12-18T07:22:05.588Z","updated":"2026-04-28T16:13:54.040Z","title":"WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"The4","product":"Molla","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-60069","published":"2025-12-18T07:22:05.403Z","updated":"2026-04-28T16:13:54.063Z","title":"WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"MinimogWP","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60068","published":"2025-12-18T07:22:05.224Z","updated":"2026-04-28T16:13:53.897Z","title":"WordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"javothemes","product":"Javo Core","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-60067","published":"2025-12-18T07:22:05.053Z","updated":"2026-04-28T16:13:53.825Z","title":"WordPress Giardino theme <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Giardino","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60066","published":"2025-12-18T07:22:04.871Z","updated":"2026-04-28T16:13:53.825Z","title":"WordPress Katelyn theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Katelyn","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60065","published":"2025-12-18T07:22:04.689Z","updated":"2026-04-28T16:13:53.813Z","title":"WordPress Pinevale theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Pinevale","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60064","published":"2025-12-18T07:22:04.500Z","updated":"2026-04-28T16:13:53.807Z","title":"WordPress Renewal theme <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Renewal","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60063","published":"2025-12-18T07:22:04.312Z","updated":"2026-04-28T16:13:53.813Z","title":"WordPress Rosalinda theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Rosalinda","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60062","published":"2025-12-18T07:22:04.109Z","updated":"2026-04-28T16:13:53.781Z","title":"WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mmetrodw","product":"tPlayer","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-60061","published":"2025-12-18T07:22:03.925Z","updated":"2026-04-28T18:36:16.786Z","title":"WordPress Kicker theme <= 2.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Kicker","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60060","published":"2025-12-18T07:22:03.729Z","updated":"2026-04-28T18:36:08.288Z","title":"WordPress Pubzinne theme <= 1.0.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Pubzinne","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60059","published":"2025-12-18T07:22:03.468Z","updated":"2026-04-28T18:35:57.123Z","title":"WordPress smart SEO theme <= 2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"smart SEO","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60058","published":"2025-12-18T07:22:03.280Z","updated":"2026-04-28T18:34:12.040Z","title":"WordPress DetailX theme <= 1.10.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"DetailX","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60057","published":"2025-12-18T07:22:03.082Z","updated":"2026-04-28T18:34:02.291Z","title":"WordPress DJ Rainflow theme <= 1.3.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"DJ Rainflow","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60056","published":"2025-12-18T07:22:02.878Z","updated":"2026-04-28T18:33:52.129Z","title":"WordPress Winger theme <= 1.0.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Winger","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60055","published":"2025-12-18T07:22:02.704Z","updated":"2026-04-28T16:13:53.778Z","title":"WordPress Fabrica theme <= 1.8.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Fabrica","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60054","published":"2025-12-18T07:22:02.500Z","updated":"2026-04-28T16:13:53.803Z","title":"WordPress OnLeash theme <= 1.5.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"OnLeash","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60053","published":"2025-12-18T07:22:02.315Z","updated":"2026-04-28T16:13:53.803Z","title":"WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"MaxCube","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60052","published":"2025-12-18T07:22:02.123Z","updated":"2026-04-28T16:13:53.800Z","title":"WordPress W&D theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"W&D","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60051","published":"2025-12-18T07:22:01.919Z","updated":"2026-04-28T16:13:53.790Z","title":"WordPress Rare Radio theme <= 1.0.15.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Rare Radio","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60050","published":"2025-12-18T07:22:01.712Z","updated":"2026-04-28T16:13:53.806Z","title":"WordPress Panda theme <= 1.21 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Panda","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60049","published":"2025-12-18T07:22:01.475Z","updated":"2026-04-28T16:13:53.798Z","title":"WordPress Soleil theme <= 1.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Soleil","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60048","published":"2025-12-18T07:22:01.281Z","updated":"2026-04-28T16:13:53.632Z","title":"WordPress Tripster theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Tripster","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60047","published":"2025-12-18T07:22:01.092Z","updated":"2026-04-28T16:13:53.306Z","title":"WordPress IPharm theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"IPharm","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60046","published":"2025-12-18T07:22:00.903Z","updated":"2026-04-28T16:13:53.265Z","title":"WordPress HeartStar theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"HeartStar","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60045","published":"2025-12-18T07:22:00.733Z","updated":"2026-04-28T18:33:41.529Z","title":"WordPress IDonatePro plugin <= 2.1.11 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeAtelier","product":"IDonatePro","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-60044","published":"2025-12-18T07:22:00.555Z","updated":"2026-04-28T16:13:53.270Z","title":"WordPress Fribbo theme <= 1.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Fribbo","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60043","published":"2025-12-18T07:22:00.383Z","updated":"2026-04-28T16:13:53.210Z","title":"WordPress Wanderic theme <= 1.0.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Wanderic","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-60042","published":"2025-12-18T07:22:00.193Z","updated":"2026-04-28T16:13:53.223Z","title":"WordPress Chinchilla theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Chinchilla","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-59134","published":"2025-12-18T07:21:59.917Z","updated":"2026-04-28T20:19:21.230Z","title":"WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Jthemes","product":"Sale! Immigration law, Visa services support, Migration Agent Consulting","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2025-58951","published":"2025-12-18T07:21:59.734Z","updated":"2026-04-28T16:13:50.356Z","title":"WordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"smartcms","product":"Advance Seat Reservation Management for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-58950","published":"2025-12-18T07:21:59.566Z","updated":"2026-04-28T16:13:50.573Z","title":"WordPress Lione theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Lione","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58949","published":"2025-12-18T07:21:59.396Z","updated":"2026-04-28T16:13:50.385Z","title":"WordPress Spock theme <= 1.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Spock","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58948","published":"2025-12-18T07:21:59.216Z","updated":"2026-04-28T16:13:50.205Z","title":"WordPress Aromatica theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Aromatica","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58947","published":"2025-12-18T07:21:59.042Z","updated":"2026-04-28T16:13:50.170Z","title":"WordPress Athos theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Athos","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58946","published":"2025-12-18T07:21:58.862Z","updated":"2026-04-28T16:13:50.180Z","title":"WordPress Vocal theme <= 1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Vocal","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58945","published":"2025-12-18T07:21:58.690Z","updated":"2026-04-28T16:13:50.146Z","title":"WordPress EcoGrow theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"EcoGrow","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58944","published":"2025-12-18T07:21:58.462Z","updated":"2026-04-28T16:13:50.182Z","title":"WordPress Manufactory theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Manufactory","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58943","published":"2025-12-18T07:21:58.294Z","updated":"2026-04-28T16:13:50.050Z","title":"WordPress Agricola theme <= 1.1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Agricola","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58942","published":"2025-12-18T07:21:58.103Z","updated":"2026-04-28T16:13:50.078Z","title":"WordPress Dwell theme <= 1.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Dwell","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58941","published":"2025-12-18T07:21:57.882Z","updated":"2026-04-28T16:13:50.182Z","title":"WordPress Fabric theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Fabric","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58940","published":"2025-12-18T07:21:57.685Z","updated":"2026-04-28T16:13:50.005Z","title":"WordPress Basil theme <= 1.3.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Basil","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58938","published":"2025-12-18T07:21:57.510Z","updated":"2026-04-28T16:13:50.120Z","title":"WordPress IDonatePro plugin <= 2.1.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeAtelier","product":"IDonatePro","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-58937","published":"2025-12-18T07:21:57.331Z","updated":"2026-04-28T16:13:49.983Z","title":"WordPress Tacticool theme <= 1.0.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Tacticool","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58936","published":"2025-12-18T07:21:57.151Z","updated":"2026-04-28T16:13:49.973Z","title":"WordPress Catamaran theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Catamaran","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58935","published":"2025-12-18T07:21:56.970Z","updated":"2026-04-28T16:13:49.987Z","title":"WordPress Lunna theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Lunna","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2025-58934","published":"2025-12-18T07:21:56.794Z","updated":"2026-04-28T16:13:50.011Z","title":"WordPress The Gig theme <= 1.18.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"The Gig","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58933","published":"2025-12-18T07:21:56.608Z","updated":"2026-04-28T16:13:49.943Z","title":"WordPress Anubis theme <= 1.25 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Anubis","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58932","published":"2025-12-18T07:21:56.420Z","updated":"2026-04-28T16:13:49.952Z","title":"WordPress Prisma theme <= 1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Prisma","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58931","published":"2025-12-18T07:21:56.240Z","updated":"2026-04-28T16:13:50.124Z","title":"WordPress Palatio theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Palatio","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58930","published":"2025-12-18T07:21:56.064Z","updated":"2026-04-28T16:13:49.979Z","title":"WordPress FitFlex theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"FitFlex","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58929","published":"2025-12-18T07:21:55.873Z","updated":"2026-04-28T16:13:49.968Z","title":"WordPress Pantry theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Pantry","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58928","published":"2025-12-18T07:21:55.694Z","updated":"2026-04-28T20:16:15.243Z","title":"WordPress Heart theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Heart","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58927","published":"2025-12-18T07:21:55.482Z","updated":"2026-04-28T20:16:06.792Z","title":"WordPress Stallion theme <= 1.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Stallion","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58926","published":"2025-12-18T07:21:55.311Z","updated":"2026-04-28T20:15:56.547Z","title":"WordPress Cerebrum theme <= 1.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Cerebrum","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58925","published":"2025-12-18T07:21:55.134Z","updated":"2026-04-28T20:15:47.300Z","title":"WordPress Neptunus theme <= 1.0.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Neptunus","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58923","published":"2025-12-18T07:21:54.954Z","updated":"2026-04-28T20:15:37.241Z","title":"WordPress Critique theme <= 1.17 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Critique","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58901","published":"2025-12-18T07:21:54.755Z","updated":"2026-04-28T20:15:28.430Z","title":"WordPress Takeout theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Takeout","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58900","published":"2025-12-18T07:21:54.574Z","updated":"2026-04-28T20:15:18.899Z","title":"WordPress UniTravel theme <= 1.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"UniTravel","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58899","published":"2025-12-18T07:21:54.396Z","updated":"2026-04-28T20:15:10.485Z","title":"WordPress Frame theme <= 2.4.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Frame","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58898","published":"2025-12-18T07:21:54.218Z","updated":"2026-04-28T16:13:49.295Z","title":"WordPress HealthHub theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"HealthHub","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58896","published":"2025-12-18T07:21:54.037Z","updated":"2026-04-28T16:13:49.273Z","title":"WordPress Otaku theme <= 1.8.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Otaku","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58895","published":"2025-12-18T07:21:53.856Z","updated":"2026-04-28T16:13:49.261Z","title":"WordPress Integro theme <= 1.8.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Integro","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58894","published":"2025-12-18T07:21:53.690Z","updated":"2026-04-28T16:13:49.319Z","title":"WordPress Good Mood theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Good Mood","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58893","published":"2025-12-18T07:21:53.521Z","updated":"2026-04-28T16:13:49.248Z","title":"WordPress Alright theme <= 1.6.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Alright","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58892","published":"2025-12-18T07:21:53.352Z","updated":"2026-04-28T16:13:49.172Z","title":"WordPress Tourimo theme <= 1.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Tourimo","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58891","published":"2025-12-18T07:21:53.171Z","updated":"2026-04-28T16:13:49.142Z","title":"WordPress Sanger theme <= 1.24.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Sanger","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58890","published":"2025-12-18T07:21:52.992Z","updated":"2026-04-28T16:13:49.156Z","title":"WordPress Playful theme <= 1.19.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Playful","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58889","published":"2025-12-18T07:21:52.823Z","updated":"2026-04-28T16:13:49.162Z","title":"WordPress Towny theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Towny","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58888","published":"2025-12-18T07:21:52.632Z","updated":"2026-04-28T16:13:49.194Z","title":"WordPress The Flash theme <= 1.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"The Flash","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58885","published":"2025-12-18T07:21:52.434Z","updated":"2026-11-03T22:03:06.351Z","title":"WordPress Pathfinder theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Pathfinder","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58879","published":"2025-12-18T07:21:52.239Z","updated":"2026-04-28T16:13:49.047Z","title":"WordPress Festy theme <= 1.13.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Festy","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58877","published":"2025-12-18T07:21:52.039Z","updated":"2026-04-28T16:13:48.947Z","title":"WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"javothemes","product":"Javo Core","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-58803","published":"2025-12-18T07:21:51.851Z","updated":"2026-04-28T16:13:47.648Z","title":"WordPress Algenix theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Algenix","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58710","published":"2025-12-18T07:21:51.662Z","updated":"2026-04-28T16:13:47.021Z","title":"WordPress Hotel Listing plugin <= 1.4.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"e-plugins","product":"Hotel Listing","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-58709","published":"2025-12-18T07:21:51.475Z","updated":"2026-04-28T20:15:01.398Z","title":"WordPress Legacy theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Legacy","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58708","published":"2025-12-18T07:21:51.283Z","updated":"2026-04-28T20:14:52.200Z","title":"WordPress 777 theme <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"777","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58706","published":"2025-12-18T07:21:51.092Z","updated":"2026-04-28T20:14:42.618Z","title":"WordPress Woo Hoo theme <= 1.25 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Woo Hoo","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-58225","published":"2025-12-18T07:21:50.906Z","updated":"2026-04-28T20:13:46.977Z","title":"WordPress Paragon theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Paragon","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-57897","published":"2025-12-18T07:21:50.715Z","updated":"2026-04-28T19:38:09.653Z","title":"WordPress Logtik theme <= 2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"venusweb","product":"Logtik","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-55707","published":"2025-12-18T07:21:50.529Z","updated":"2026-04-28T18:46:17.677Z","title":"WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability","severity":"HIGH","score":7.2,"vendor":"WPXPO","product":"PostX","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-54751","published":"2025-12-18T07:21:50.337Z","updated":"2026-04-28T18:46:08.669Z","title":"WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WPXPO","product":"PostX","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-54748","published":"2025-12-18T07:21:50.115Z","updated":"2026-04-28T18:45:58.102Z","title":"WordPress MapSVG Plugin < 8.6.12 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-54745","published":"2025-12-18T07:21:49.914Z","updated":"2026-04-28T18:45:48.981Z","title":"WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"miniOrange's Google Authenticator","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-54743","published":"2025-12-18T07:21:49.722Z","updated":"2026-04-29T09:51:55.875Z","title":"WordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type Vulnerability","severity":"MEDIUM","score":5.8,"vendor":"mkscripts","product":"Download After Email","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-54741","published":"2025-12-18T07:21:49.496Z","updated":"2026-04-28T16:13:36.684Z","title":"WordPress Super Blank Plugin <= 1.2.0 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tyler Moore","product":"Super Blank","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-54723","published":"2025-12-18T07:21:49.313Z","updated":"2026-04-28T18:45:29.360Z","title":"WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"DentiCare","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-53453","published":"2025-12-18T07:21:49.127Z","updated":"2026-04-28T16:13:25.541Z","title":"WordPress Hygia theme <= 1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Hygia","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53449","published":"2025-12-18T07:21:48.947Z","updated":"2026-04-28T19:17:23.429Z","title":"WordPress Convex theme <= 1.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Convex","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53448","published":"2025-12-18T07:21:48.769Z","updated":"2026-04-28T19:17:14.414Z","title":"WordPress Rally theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Rally","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53447","published":"2025-12-18T07:21:48.588Z","updated":"2026-04-28T19:17:03.269Z","title":"WordPress Assembly theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Assembly","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53446","published":"2025-12-18T07:21:48.403Z","updated":"2026-04-28T19:16:53.573Z","title":"WordPress Beautique theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Beautique","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53445","published":"2025-12-18T07:21:48.218Z","updated":"2026-04-28T19:16:43.193Z","title":"WordPress Catwalk theme <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Catwalk","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53443","published":"2025-12-18T07:21:48.033Z","updated":"2026-04-28T19:16:32.831Z","title":"WordPress Smash theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Smash","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53442","published":"2025-12-18T07:21:47.842Z","updated":"2026-04-28T19:16:22.731Z","title":"WordPress Rentic theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Rentic","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53441","published":"2025-12-18T07:21:47.651Z","updated":"2026-04-28T19:16:12.195Z","title":"WordPress Greeny theme <= 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Greeny","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53439","published":"2025-12-18T07:21:47.455Z","updated":"2026-04-28T19:16:02.342Z","title":"WordPress Harper theme <= 1.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Harper","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53438","published":"2025-12-18T07:21:47.228Z","updated":"2026-04-28T19:15:51.605Z","title":"WordPress FitLine theme <= 1.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"FitLine","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53437","published":"2025-12-18T07:21:47.030Z","updated":"2026-04-28T19:15:41.228Z","title":"WordPress Greenorganic theme <= 2.45 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Greenorganic","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53436","published":"2025-12-18T07:21:46.801Z","updated":"2026-04-28T19:15:30.971Z","title":"WordPress Monki theme <= 2.0.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"Monki","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53435","published":"2025-12-18T07:21:46.620Z","updated":"2026-04-28T19:15:21.899Z","title":"WordPress Plan My Day theme <= 1.1.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Plan My Day","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53434","published":"2025-12-18T07:21:46.434Z","updated":"2026-04-28T19:15:11.277Z","title":"WordPress ChildHope theme <= 1.1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"ChildHope","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53433","published":"2025-12-18T07:21:46.182Z","updated":"2026-04-28T19:15:03.902Z","title":"WordPress EasyEat theme <= 1.9.0 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"EasyEat","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2025-53432","published":"2025-12-18T07:21:45.954Z","updated":"2026-04-28T19:14:50.799Z","title":"WordPress Echo theme <= 1.15.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Echo","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53431","published":"2025-12-18T07:21:45.771Z","updated":"2026-04-28T19:14:40.863Z","title":"WordPress Emberlyn theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Emberlyn","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-53430","published":"2025-12-18T07:21:45.581Z","updated":"2026-04-28T19:14:29.339Z","title":"WordPress Etta theme <= 1.14.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Etta","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-53429","published":"2025-12-18T07:21:45.401Z","updated":"2026-04-28T19:14:20.229Z","title":"WordPress Exit Game theme <= 1.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Exit Game","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-52768","published":"2025-12-18T07:21:45.204Z","updated":"2026-04-28T19:05:39.551Z","title":"WordPress Faith & Hope theme <= 2.13.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Faith & Hope","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-52745","published":"2025-12-18T07:21:44.978Z","updated":"2026-04-28T19:03:47.026Z","title":"WordPress Farm Agrico theme <= 1.3.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Farm Agrico","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-49943","published":"2025-12-18T07:21:44.794Z","updated":"2026-04-28T20:26:52.988Z","title":"WordPress Femme theme <= 1.3.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Femme","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49942","published":"2025-12-18T07:21:44.617Z","updated":"2026-04-28T20:26:42.476Z","title":"WordPress Gardis theme <= 1.2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Gardis","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49941","published":"2025-12-18T07:21:44.421Z","updated":"2026-04-28T20:26:31.717Z","title":"WordPress GlamChic theme <= 1.0.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"GlamChic","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49919","published":"2025-12-18T07:21:44.250Z","updated":"2026-04-29T09:51:55.324Z","title":"WordPress eRoom plugin <= 1.5.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-49918","published":"2025-12-18T07:21:44.067Z","updated":"2026-04-28T16:13:07.897Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2025-49914","published":"2025-12-18T07:21:43.896Z","updated":"2026-04-28T20:24:30.537Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-49902","published":"2025-12-18T07:21:43.721Z","updated":"2026-04-28T16:13:07.352Z","title":"WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"A WP Life","product":"Login Page Customizer – Customizer Login Page, Admin Page, Custom Design","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-49379","published":"2025-12-18T07:21:43.532Z","updated":"2026-04-28T20:23:11.340Z","title":"WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"silverplugins217","product":"Custom Fields Account Registration For Woocommerce","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2025-49371","published":"2025-12-18T07:21:43.355Z","updated":"2026-04-28T20:22:51.090Z","title":"WordPress Strux theme <= 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Strux","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-49370","published":"2025-12-18T07:21:43.156Z","updated":"2026-04-28T20:22:40.224Z","title":"WordPress Lymcoin theme <= 1.3.12 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Lymcoin","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-49369","published":"2025-12-18T07:21:42.972Z","updated":"2026-04-28T20:22:30.729Z","title":"WordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Lettuce","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49368","published":"2025-12-18T07:21:42.791Z","updated":"2026-04-28T20:22:19.925Z","title":"WordPress Palladio theme <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Palladio","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49367","published":"2025-12-18T07:21:42.595Z","updated":"2026-04-28T20:22:09.616Z","title":"WordPress Monyxi theme <= 1.1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Monyxi","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-49366","published":"2025-12-18T07:21:42.421Z","updated":"2026-04-28T16:13:02.459Z","title":"WordPress Hanani theme <= 1.2.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Hanani","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-49365","published":"2025-12-18T07:21:42.245Z","updated":"2026-04-28T16:13:02.173Z","title":"WordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Jack Well","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49364","published":"2025-12-18T07:21:42.060Z","updated":"2026-04-28T16:13:02.151Z","title":"WordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Ludos Paradise","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-49363","published":"2025-12-18T07:21:41.871Z","updated":"2026-04-28T16:13:02.136Z","title":"WordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Kings & Queens","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2025-49362","published":"2025-12-18T07:21:41.688Z","updated":"2026-04-28T16:13:02.194Z","title":"WordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Gracioza","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2025-49361","published":"2025-12-18T07:21:41.475Z","updated":"2026-04-28T16:13:02.144Z","title":"WordPress Mamita theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Mamita","kev":false,"epss":0.00623,"kevAdded":null},{"id":"CVE-2025-49360","published":"2025-12-18T07:21:41.272Z","updated":"2026-04-28T16:13:02.207Z","title":"WordPress Militarology theme <= 1.0.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Militarology","kev":false,"epss":0.00623,"kevAdded":null},{"id":"CVE-2025-49359","published":"2025-12-18T07:21:41.066Z","updated":"2026-04-28T16:13:02.128Z","title":"WordPress ShieldGroup theme <= 2.13 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"ShieldGroup","kev":false,"epss":0.00623,"kevAdded":null},{"id":"CVE-2025-49041","published":"2025-12-18T07:21:40.869Z","updated":"2026-04-28T16:12:58.038Z","title":"WordPress Get Cash plugin <= 3.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"The African Boss","product":"Get Cash","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-14314","published":"2025-12-18T07:21:40.676Z","updated":"2026-04-28T16:10:57.412Z","title":"WordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Roxnor","product":"PopupKit","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-10019","published":"2025-12-18T07:21:40.448Z","updated":"2026-04-28T16:10:57.279Z","title":"WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Contact Form Email","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2025-68088","published":"2025-12-16T08:13:06.386Z","updated":"2026-04-28T19:59:26.677Z","title":"WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Huger for Elementor","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68087","published":"2025-12-16T08:13:06.187Z","updated":"2026-04-28T19:59:17.651Z","title":"WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Modalier for Elementor","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68086","published":"2025-12-16T08:13:05.956Z","updated":"2026-04-28T19:59:08.151Z","title":"WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Reformer for Elementor","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68085","published":"2025-12-16T08:13:05.766Z","updated":"2026-04-28T19:58:58.123Z","title":"WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Buttoner for Elementor","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-68084","published":"2025-12-16T08:13:05.552Z","updated":"2026-04-28T16:14:28.307Z","title":"WordPress Ultimate Auction  plugin <= 4.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nitesh","product":"Ultimate Auction","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68083","published":"2025-12-16T08:13:05.365Z","updated":"2026-04-28T16:14:28.309Z","title":"WordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Meks","product":"Meks Quick Plugin Disabler","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-68082","published":"2025-12-16T08:13:05.169Z","updated":"2026-04-28T16:14:28.361Z","title":"WordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SEMrush CY LTD","product":"Semrush Content Toolkit","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-68080","published":"2025-12-16T08:13:04.939Z","updated":"2026-04-28T19:58:49.032Z","title":"WordPress User Avatar - Reloaded plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"User Avatar - Reloaded","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68079","published":"2025-12-16T08:13:04.760Z","updated":"2026-04-28T19:58:39.932Z","title":"WordPress Salient Shortcodes plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeNectar","product":"Salient Shortcodes","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68078","published":"2025-12-16T08:13:04.573Z","updated":"2026-04-28T19:58:30.795Z","title":"WordPress Salient Portfolio theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeNectar","product":"Salient Portfolio","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68077","published":"2025-12-16T08:13:04.375Z","updated":"2026-04-28T19:58:21.794Z","title":"WordPress Stockholm theme <= 9.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Select-Themes","product":"Stockholm","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68076","published":"2025-12-16T08:13:04.176Z","updated":"2026-04-28T19:58:12.699Z","title":"WordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Select-Themes","product":"Stockholm Core","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68071","published":"2025-12-16T08:13:03.975Z","updated":"2026-04-28T16:14:28.324Z","title":"WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-68070","published":"2025-12-16T08:13:03.722Z","updated":"2026-04-28T19:57:53.787Z","title":"WordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vektor,Inc.","product":"VK Google Job Posting Manager","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68068","published":"2025-12-16T08:13:03.502Z","updated":"2026-04-28T19:57:43.772Z","title":"WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Stockholm","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-68067","published":"2025-12-16T08:13:03.257Z","updated":"2026-04-28T16:14:28.195Z","title":"WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Stockholm Core","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-68066","published":"2025-12-16T08:13:01.813Z","updated":"2026-04-28T19:57:34.791Z","title":"WordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"PenciDesign","product":"Soledad","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-68065","published":"2025-12-16T08:13:01.354Z","updated":"2026-05-20T09:18:57.916Z","title":"WordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"LiquidThemes","product":"Hub Core","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-68062","published":"2025-12-16T08:13:01.103Z","updated":"2026-04-28T19:57:25.788Z","title":"WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeMove","product":"MinimogWP","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68061","published":"2025-12-16T08:13:00.884Z","updated":"2026-04-28T16:14:28.030Z","title":"WordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeMove","product":"EduMall","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-68056","published":"2025-12-16T08:13:00.522Z","updated":"2026-04-28T16:14:27.744Z","title":"WordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"LBG Zoominoutslider","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-68055","published":"2025-12-16T08:12:59.985Z","updated":"2026-04-28T16:14:27.805Z","title":"WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-68054","published":"2025-12-16T08:12:59.794Z","updated":"2026-04-28T16:14:27.882Z","title":"WordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"CountDown With Image or Video Background","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-68053","published":"2025-12-16T08:12:59.596Z","updated":"2026-04-28T16:14:27.776Z","title":"WordPress xPromoter plugin <= 1.3.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"xPromoter","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-67999","published":"2025-12-16T08:12:59.398Z","updated":"2026-04-28T16:14:25.635Z","title":"WordPress Newsletter plugin <= 9.0.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Stefano Lissa","product":"Newsletter","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-67989","published":"2025-12-16T08:12:59.145Z","updated":"2026-04-28T16:14:25.303Z","title":"WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"LMPixels","product":"Kerge","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67986","published":"2025-12-16T08:12:58.951Z","updated":"2026-04-28T16:14:25.294Z","title":"WordPress Document Library Lite plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Barn2 Plugins","product":"Document Library Lite","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-67985","published":"2025-12-16T08:12:58.770Z","updated":"2026-04-28T16:14:25.282Z","title":"WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Barn2 Plugins","product":"Document Library Lite","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-67983","published":"2025-12-16T08:12:58.563Z","updated":"2026-04-28T19:31:39.107Z","title":"WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"osama.esh","product":"WP Visitor Statistics (Real Time Traffic)","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67976","published":"2025-12-16T08:12:58.348Z","updated":"2026-04-28T19:30:41.799Z","title":"WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bob","product":"Watu Quiz","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-67965","published":"2025-12-16T08:12:58.164Z","updated":"2026-04-28T16:14:24.907Z","title":"WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"favethemes","product":"Homey Core","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-67962","published":"2025-12-16T08:12:57.962Z","updated":"2026-04-28T16:14:24.926Z","title":"WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"AIOSEO Plugin Team","product":"Broken Link Checker","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2025-67951","published":"2025-12-16T08:12:57.750Z","updated":"2026-04-28T19:28:19.903Z","title":"WordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPZOOM","product":"WPZOOM Addons for Elementor","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67950","published":"2025-12-16T08:12:57.565Z","updated":"2026-04-28T16:14:24.486Z","title":"WordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Syed Balkhi","product":"All In One SEO Pack","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-67948","published":"2025-12-16T08:12:57.382Z","updated":"2026-04-28T19:28:01.541Z","title":"WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SendPulse","product":"SendPulse Email Marketing Newsletter","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-67929","published":"2025-12-16T08:12:57.185Z","updated":"2026-04-28T16:14:23.737Z","title":"WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-67912","published":"2025-12-16T08:12:56.996Z","updated":"2026-04-28T19:26:19.529Z","title":"WordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Premio","product":"Stars Testimonials","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-66167","published":"2025-12-16T08:12:56.806Z","updated":"2026-04-28T19:10:54.094Z","title":"WordPress Lottier plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Lottier","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66166","published":"2025-12-16T08:12:56.603Z","updated":"2026-04-28T19:10:45.207Z","title":"WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Lottier for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66165","published":"2025-12-16T08:12:56.408Z","updated":"2026-04-28T19:10:34.652Z","title":"WordPress Lottier for WPBakery plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Lottier for WPBakery","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66164","published":"2025-12-16T08:12:56.211Z","updated":"2026-04-28T19:10:25.147Z","title":"WordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Laser","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66163","published":"2025-12-16T08:12:55.859Z","updated":"2026-04-28T19:10:14.623Z","title":"WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Masker for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66162","published":"2025-12-16T08:12:55.672Z","updated":"2026-04-28T19:10:03.873Z","title":"WordPress Spoter for Elementor plugin <= 1.04 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Spoter for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66161","published":"2025-12-16T08:12:55.484Z","updated":"2026-04-28T19:09:53.687Z","title":"WordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Grider for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66147","published":"2025-12-16T08:12:55.284Z","updated":"2026-04-28T19:09:43.598Z","title":"WordPress Coder for Elementor plugin <= 1.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"merkulove","product":"Coder for Elementor","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-66134","published":"2025-12-16T08:12:55.088Z","updated":"2026-04-28T16:14:17.828Z","title":"WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"NinjaTeam","product":"FileBird Pro","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-66133","published":"2025-12-16T08:12:54.808Z","updated":"2026-04-28T16:14:17.843Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-66132","published":"2025-12-16T08:12:54.562Z","updated":"2026-04-28T16:14:17.862Z","title":"WordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"FAPI Business s.r.o.","product":"FAPI Member","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-66131","published":"2025-12-16T08:12:54.364Z","updated":"2026-04-28T16:14:17.867Z","title":"WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"yaadsarig","product":"Yaad Sarig Payment Gateway For WC","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-66130","published":"2025-12-16T08:12:54.174Z","updated":"2026-04-28T19:09:14.518Z","title":"WordPress WP Views Counter plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"etruel","product":"WP Views Counter","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-66129","published":"2025-12-16T08:12:53.976Z","updated":"2026-04-28T19:09:03.820Z","title":"WordPress Pochipp plugin <= 1.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wppochipp","product":"Pochipp","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-66128","published":"2025-12-16T08:12:53.783Z","updated":"2026-04-28T16:14:17.721Z","title":"WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brevo","product":"Sendinblue for WooCommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-66127","published":"2025-12-16T08:12:53.580Z","updated":"2026-04-28T16:14:17.633Z","title":"WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-66126","published":"2025-12-16T08:12:53.301Z","updated":"2026-04-28T16:14:17.633Z","title":"WordPress Fix Media Library plugin <= 2.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wowpress.host","product":"Fix Media Library","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-66125","published":"2025-12-16T08:12:53.108Z","updated":"2026-04-28T16:14:17.621Z","title":"WordPress Ultimate Auction  plugin <= 4.3.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nitesh","product":"Ultimate Auction","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-66124","published":"2025-12-16T08:12:52.912Z","updated":"2026-04-28T16:14:17.556Z","title":"WordPress Leaky Paywall plugin <= 4.22.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ZEEN101","product":"Leaky Paywall","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-66122","published":"2025-12-16T08:12:52.713Z","updated":"2026-11-03T22:03:07.850Z","title":"WordPress Stylish Price List plugin <= 7.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Design","product":"Stylish Price List","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-66121","published":"2025-12-16T08:12:52.500Z","updated":"2026-04-28T16:14:17.358Z","title":"WordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SiteGround","product":"SiteGround Security","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-66120","published":"2025-12-16T08:12:52.307Z","updated":"2026-04-28T16:14:17.372Z","title":"WordPress CatFolders plugin <= 2.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CatFolders","product":"CatFolders","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-64639","published":"2025-12-16T08:12:52.102Z","updated":"2026-04-28T16:14:15.284Z","title":"WordPress WP Compress for MainWP plugin <= 6.50.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Compress","product":"WP Compress for MainWP","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-64638","published":"2025-12-16T08:12:51.913Z","updated":"2026-04-28T16:14:15.291Z","title":"WordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"OnPay.io","product":"OnPay.io for WooCommerce","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-64635","published":"2025-12-16T08:12:51.705Z","updated":"2026-04-28T16:14:15.302Z","title":"WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Syed Balkhi","product":"Feeds for YouTube","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-64634","published":"2025-12-16T08:12:51.156Z","updated":"2026-04-28T16:14:15.281Z","title":"WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeFusion","product":"Avada","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-64633","published":"2025-12-16T08:12:50.943Z","updated":"2026-04-28T18:33:12.196Z","title":"WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"colabrio","product":"Norebro Extra","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-64632","published":"2025-12-16T08:12:50.749Z","updated":"2026-04-28T16:14:15.242Z","title":"WordPress Google XML Sitemaps plugin <= 4.1.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Auctollo","product":"Google XML Sitemaps","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-64631","published":"2025-12-16T08:12:50.537Z","updated":"2026-04-28T16:14:15.151Z","title":"WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-64630","published":"2025-12-16T08:12:50.318Z","updated":"2026-04-28T16:14:15.185Z","title":"WordPress Business Directory plugin <= 6.4.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-64253","published":"2025-12-16T08:12:50.088Z","updated":"2026-04-28T18:27:48.159Z","title":"WordPress Health Check & Troubleshooting plugin <= 1.7.1 - Path Traversal vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WordPress.org","product":"Health Check & Troubleshooting","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-64251","published":"2025-12-16T08:12:49.880Z","updated":"2026-04-28T16:14:12.676Z","title":"WordPress Ultimate Learning Pro plugin <= 3.9.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":4.9,"vendor":"azzaroco","product":"Ultimate Learning Pro","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-64250","published":"2025-12-16T08:12:49.689Z","updated":"2026-04-28T16:14:12.731Z","title":"WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-64249","published":"2025-12-16T08:12:49.485Z","updated":"2026-04-28T16:14:12.621Z","title":"WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP-EXPERTS.IN","product":"Protect WP Admin","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-64248","published":"2025-12-16T08:12:49.290Z","updated":"2026-04-28T18:27:28.119Z","title":"WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"emarket-design","product":"Request a Quote","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64247","published":"2025-12-16T08:12:49.100Z","updated":"2026-04-28T16:14:12.598Z","title":"WordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"edmon.parker","product":"Read More & Accordion","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64246","published":"2025-12-16T08:12:48.902Z","updated":"2026-04-28T16:14:12.703Z","title":"WordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"netopsae","product":"Accessibility by AudioEye","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64245","published":"2025-12-16T08:12:48.719Z","updated":"2026-04-28T16:14:12.429Z","title":"WordPress Import external attachments plugin <= 1.5.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ryanpcmcquen","product":"Import external attachments","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64244","published":"2025-12-16T08:12:48.528Z","updated":"2026-04-28T16:14:12.374Z","title":"WordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codexpert, Inc","product":"Restrict Elementor Widgets, Columns and Sections","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64243","published":"2025-12-16T08:12:48.343Z","updated":"2026-04-28T16:14:12.409Z","title":"WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64242","published":"2025-12-16T08:12:48.141Z","updated":"2026-04-28T16:14:12.643Z","title":"WordPress Easy Property Listings plugin <= 3.5.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Merv Barrett","product":"Easy Property Listings","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64241","published":"2025-12-16T08:12:47.928Z","updated":"2026-04-28T16:14:12.180Z","title":"WordPress WP Coupons and Deals plugin <= 3.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Imtiaz Rayhan","product":"WP Coupons and Deals","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64240","published":"2025-12-16T08:12:47.734Z","updated":"2026-04-28T18:27:19.039Z","title":"WordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"freshchat","product":"Freshchat","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-64239","published":"2025-12-16T08:12:47.533Z","updated":"2026-04-28T16:14:12.257Z","title":"WordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Yoav Farhi","product":"RTL Tester","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-64238","published":"2025-12-16T08:12:47.350Z","updated":"2026-04-28T16:14:11.545Z","title":"WordPress WPS Bidouille plugin <= 1.33.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"NicolasKulka","product":"WPS Bidouille","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-64237","published":"2025-12-16T08:12:47.167Z","updated":"2026-04-28T16:14:11.750Z","title":"WordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Graham","product":"Quick Interest Slider","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-59009","published":"2025-12-16T08:12:46.981Z","updated":"2026-04-28T20:19:01.397Z","title":"WordPress Listify theme <= 3.2.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Astoundify","product":"Listify","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-59001","published":"2025-12-16T08:12:46.774Z","updated":"2026-04-28T16:13:51.660Z","title":"WordPress Salient Core plugin <= 3.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeNectar","product":"Salient Core","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-58999","published":"2025-12-16T08:12:46.564Z","updated":"2026-04-28T20:17:28.428Z","title":"WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"loopus","product":"WP Attractive Donations System - Easy Stripe & Paypal donations","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-54045","published":"2025-12-16T08:12:46.351Z","updated":"2026-04-28T16:13:29.730Z","title":"WordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreativeMindsSolutions","product":"CM On Demand Search And Replace","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-54005","published":"2025-12-16T08:12:45.965Z","updated":"2026-04-28T16:13:28.268Z","title":"WordPress SKT Page Builder plugin <= 4.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sonalsinha21","product":"SKT Page Builder","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-54004","published":"2025-12-16T08:12:45.704Z","updated":"2026-04-28T16:13:28.267Z","title":"WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"WC Lovers","product":"WCFM – Frontend Manager for WooCommerce","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2025-49300","published":"2025-12-16T08:12:44.867Z","updated":"2026-10-20T11:14:51.224Z","title":"WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability","severity":"LOW","score":2.7,"vendor":"Shinetheme","product":"Traveler Option Tree","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2022-46845","published":"2025-12-09T16:42:21.600Z","updated":"2026-04-28T16:07:55.202Z","title":"WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Essential Plugin","product":"Slider a SlidersPack","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2022-47425","published":"2025-12-09T16:41:37.058Z","updated":"2026-04-28T16:07:57.184Z","title":"WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control","severity":"MEDIUM","score":4.3,"vendor":"Repute Infosystems","product":"ARMember","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2023-22675","published":"2025-12-09T16:41:07.067Z","updated":"2026-04-28T16:07:58.684Z","title":"WordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Taylor Hawkes","product":"WP Fast Cache","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2023-23729","published":"2025-12-09T16:40:37.764Z","updated":"2026-04-28T16:08:01.547Z","title":"WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-67467","published":"2025-12-09T15:03:54.450Z","updated":"2026-04-28T16:14:19.298Z","title":"WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StellarWP","product":"GiveWP","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-66533","published":"2025-12-09T15:03:54.194Z","updated":"2026-10-22T06:43:08.633Z","title":"WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-63077","published":"2025-12-09T14:52:37.020Z","updated":"2026-04-28T16:14:10.207Z","title":"WordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HappyMonster","product":"Happy Addons for Elementor","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-63076","published":"2025-12-09T14:52:36.814Z","updated":"2026-04-28T19:37:42.200Z","title":"WordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Dream-Theme","product":"The7 Elements","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-63075","published":"2025-12-09T14:52:36.619Z","updated":"2026-04-28T19:37:33.364Z","title":"WordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"muffingroup","product":"Betheme","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63074","published":"2025-12-09T14:52:36.427Z","updated":"2026-04-28T19:37:24.040Z","title":"WordPress The7 theme < 12.8.1.1  - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Dream-Theme","product":"The7","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-63073","published":"2025-12-09T14:52:36.226Z","updated":"2026-04-28T19:37:14.351Z","title":"WordPress The7 theme < 12.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dream-Theme","product":"The7","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63072","published":"2025-12-09T14:52:35.972Z","updated":"2026-04-28T19:37:05.217Z","title":"WordPress Cornerstone plugin <= 7.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"THEMECO","product":"Cornerstone","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63071","published":"2025-12-09T14:52:35.783Z","updated":"2026-04-28T19:36:56.133Z","title":"WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"averta","product":"Shortcodes and extra features for Phlox theme","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-63070","published":"2025-12-09T14:52:35.592Z","updated":"2026-04-28T19:36:46.998Z","title":"WordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-63069","published":"2025-12-09T14:52:35.405Z","updated":"2026-04-28T19:36:37.788Z","title":"WordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Vinod Dalvi","product":"Ivory Search","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-63068","published":"2025-12-09T14:52:35.227Z","updated":"2026-04-28T19:36:28.559Z","title":"WordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sevenspark","product":"Contact Form 7 – Dynamic Text Extension","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-63067","published":"2025-12-09T14:52:35.047Z","updated":"2026-04-28T16:14:09.924Z","title":"WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"p-themes","product":"Porto Theme - Functionality","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-63066","published":"2025-12-09T14:52:34.849Z","updated":"2026-04-28T19:36:19.550Z","title":"WordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"p-themes","product":"Porto Theme - Functionality","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63065","published":"2025-12-09T14:52:34.653Z","updated":"2026-04-28T16:14:09.691Z","title":"WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-63064","published":"2025-12-09T14:52:34.461Z","updated":"2026-04-28T19:36:10.534Z","title":"WordPress EventON plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ashanjay","product":"EventON","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63063","published":"2025-12-09T14:52:34.261Z","updated":"2026-04-28T16:14:09.668Z","title":"WordPress Yandex.Metrica plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Yandex Metrika","product":"Yandex.Metrica","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2025-63062","published":"2025-12-09T14:52:34.071Z","updated":"2026-04-28T16:14:09.720Z","title":"WordPress UDesign Core plugin <= 4.14.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2025-63061","published":"2025-12-09T14:52:33.869Z","updated":"2026-04-28T19:36:00.912Z","title":"WordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hogash","product":"KALLYAS","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63060","published":"2025-12-09T14:52:33.675Z","updated":"2026-04-28T16:14:09.719Z","title":"WordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"hogash","product":"KALLYAS","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-63059","published":"2025-12-09T14:52:33.472Z","updated":"2026-04-28T16:14:09.632Z","title":"WordPress Ninja Popups plugin <= 4.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"arscode","product":"Ninja Popups","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63058","published":"2025-12-09T14:52:33.266Z","updated":"2026-04-28T16:14:09.643Z","title":"WordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hiroaki Miyashita","product":"Custom Field Template","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-63057","published":"2025-12-09T14:52:32.998Z","updated":"2026-04-28T16:14:09.728Z","title":"WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"Wp Ultimate Review","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-63056","published":"2025-12-09T14:52:32.803Z","updated":"2026-04-28T16:14:09.616Z","title":"WordPress Contact Form by BestWebSoft plugin <= 4.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bestwebsoft","product":"Contact Form by BestWebSoft","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-63055","published":"2025-12-09T14:52:32.621Z","updated":"2026-04-28T19:35:51.789Z","title":"WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liton Arefin","product":"Master Addons for Elementor","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63054","published":"2025-12-09T14:52:32.429Z","updated":"2026-04-28T16:14:09.690Z","title":"WordPress Quiz And Survey Master plugin <= 10.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-63052","published":"2025-12-09T14:52:32.233Z","updated":"2026-04-28T19:35:41.991Z","title":"WordPress SimpLy Gallery plugin <= 3.3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GalleryCreator","product":"SimpLy Gallery","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63050","published":"2025-12-09T14:52:31.945Z","updated":"2026-04-28T16:14:09.356Z","title":"WordPress REHub Framework plugin < 19.9.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sizam","product":"REHub Framework","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63049","published":"2025-12-09T14:52:31.756Z","updated":"2026-04-28T16:14:09.390Z","title":"WordPress ListingPro Lead Form plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CridioStudio","product":"ListingPro Lead Form","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-63048","published":"2025-12-09T14:52:31.569Z","updated":"2026-04-28T16:14:09.350Z","title":"WordPress ListingPro Lead Form plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CridioStudio","product":"ListingPro Lead Form","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-63047","published":"2025-12-09T14:52:31.382Z","updated":"2026-04-28T19:35:24.375Z","title":"WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-63046","published":"2025-12-09T14:52:31.184Z","updated":"2026-04-28T19:35:14.762Z","title":"WordPress ListingPro plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-63045","published":"2025-12-09T14:52:30.970Z","updated":"2026-04-28T19:35:05.717Z","title":"WordPress Master Slider Pro plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"averta","product":"Master Slider Pro","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-63044","published":"2025-12-09T14:52:30.776Z","updated":"2026-04-28T19:34:55.622Z","title":"WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-63042","published":"2025-12-09T14:52:30.593Z","updated":"2026-04-28T19:34:46.513Z","title":"WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS Elementor Addons","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-63037","published":"2025-12-09T14:52:30.399Z","updated":"2026-04-28T19:34:36.960Z","title":"WordPress Ronneby Theme Core plugin <= 1.5.68 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DFDevelopment","product":"Ronneby Theme Core","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63036","published":"2025-12-09T14:52:30.218Z","updated":"2026-04-28T16:14:09.155Z","title":"WordPress Ronneby Theme Core plugin <= 1.5.68 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"DFDevelopment","product":"Ronneby Theme Core","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-63035","published":"2025-12-09T14:52:29.953Z","updated":"2026-04-28T19:34:27.964Z","title":"WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-63034","published":"2025-12-09T14:52:29.735Z","updated":"2026-04-28T16:14:09.173Z","title":"WordPress Page View Count plugin <= 2.9.0 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Steve Truman","product":"Page View Count","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-63033","published":"2025-12-09T14:52:29.504Z","updated":"2026-04-28T19:34:18.815Z","title":"WordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Riyadh Ahmed","product":"Make Section & Column Clickable For Elementor","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-63030","published":"2025-12-09T14:52:29.217Z","updated":"2026-04-29T09:56:32.068Z","title":"WordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"New User Approve","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-63028","published":"2025-12-09T14:52:29.022Z","updated":"2026-04-28T16:14:08.723Z","title":"WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-63025","published":"2025-12-09T14:52:28.824Z","updated":"2026-04-28T16:14:08.725Z","title":"WordPress Xagio SEO plugin <= 7.1.0.37 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Xagio SEO","product":"Xagio SEO","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-63024","published":"2025-12-09T14:52:28.628Z","updated":"2026-04-28T16:14:08.763Z","title":"WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"tychesoftwares","product":"Order Delivery Date for WooCommerce","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-63023","published":"2025-12-09T14:52:28.444Z","updated":"2026-04-28T16:14:08.832Z","title":"WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Easy Payment","product":"Payment Gateway for PayPal on WooCommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-63015","published":"2025-12-09T14:52:28.261Z","updated":"2026-04-28T16:14:08.719Z","title":"WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"paysera","product":"WooCommerce Payment Gateway - Paysera","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-63013","published":"2025-12-09T14:52:27.989Z","updated":"2026-04-28T16:14:08.669Z","title":"WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"WP Hotel Booking","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-63012","published":"2025-12-09T14:52:27.799Z","updated":"2026-04-28T16:14:08.687Z","title":"WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"WP Hotel Booking","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-63011","published":"2025-12-09T14:52:27.596Z","updated":"2026-04-28T19:34:01.014Z","title":"WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ThimPress","product":"WP Hotel Booking","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-63010","published":"2025-12-09T14:52:27.407Z","updated":"2026-04-28T16:14:08.670Z","title":"WordPress Hercules Core  plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"ThemesInflow","product":"Hercules Core","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-63009","published":"2025-12-09T14:52:27.215Z","updated":"2026-04-28T19:33:51.949Z","title":"WordPress WP Google Analytics Events plugin <= 2.8.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"yuvalo","product":"WP Google Analytics Events","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-63008","published":"2025-12-09T14:52:27.019Z","updated":"2026-04-28T16:14:08.268Z","title":"WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-63007","published":"2025-12-09T14:52:26.826Z","updated":"2026-04-28T19:33:42.706Z","title":"WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-63006","published":"2025-12-09T14:52:26.633Z","updated":"2026-04-28T16:14:08.308Z","title":"WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metagauss","product":"EventPrime","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-63003","published":"2025-12-09T14:52:26.448Z","updated":"2026-04-28T19:33:33.582Z","title":"WordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"fuelthemes","product":"North - Required Plugin","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-62999","published":"2025-12-09T14:52:26.238Z","updated":"2026-04-28T16:14:08.287Z","title":"WordPress Litho Addons plugin <= 3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"themezaa","product":"Litho Addons","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-62997","published":"2025-12-09T14:52:26.001Z","updated":"2026-04-28T19:01:12.123Z","title":"WordPress WP EasyCart plugin <= 5.8.11 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"levelfourdevelopment","product":"WP EasyCart","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-62996","published":"2025-12-09T14:52:25.809Z","updated":"2026-04-28T19:01:01.768Z","title":"WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Code Amp","product":"Custom Layouts – Post + Product grids made easy","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62995","published":"2025-12-09T14:52:25.623Z","updated":"2026-04-28T19:00:51.355Z","title":"WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"multiparcels","product":"MultiParcels Shipping For WooCommerce","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62994","published":"2025-12-09T14:52:25.424Z","updated":"2026-04-28T19:00:41.823Z","title":"WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"WP AI CoPilot","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-62993","published":"2025-12-09T14:52:25.243Z","updated":"2026-04-28T16:14:08.089Z","title":"WordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rainafarai","product":"Notification for Telegram","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62873","published":"2025-12-09T14:52:25.051Z","updated":"2026-04-28T18:56:55.637Z","title":"WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Flashyapp","product":"WP Flashy Marketing Automation","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62872","published":"2025-12-09T14:52:24.849Z","updated":"2026-04-28T18:56:46.658Z","title":"WordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"JK","product":"Social Photo Fetcher","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62871","published":"2025-12-09T14:52:24.656Z","updated":"2026-04-28T18:56:36.032Z","title":"WordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Alex Prokopenko / JustCoded","product":"Just TinyMCE Custom Styles","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62870","published":"2025-12-09T14:52:24.458Z","updated":"2026-04-28T18:56:25.908Z","title":"WordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Eupago","product":"Eupago Gateway For Woocommerce","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62869","published":"2025-12-09T14:52:24.237Z","updated":"2026-04-28T18:56:15.758Z","title":"WordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Gravitec.net - Web Push Notifications","product":"Gravitec.net – Web Push Notifications","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-62867","published":"2025-12-09T14:52:24.049Z","updated":"2026-04-28T16:14:04.344Z","title":"WordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ergonet","product":"Ergonet Cache","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-62866","published":"2025-12-09T14:52:23.816Z","updated":"2026-04-28T18:56:05.358Z","title":"WordPress Auto Alt Text plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Valerio Monti","product":"Auto Alt Text","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62865","published":"2025-12-09T14:52:23.580Z","updated":"2026-04-28T18:55:54.168Z","title":"WordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Evan Herman","product":"Post Cloner","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62762","published":"2025-12-09T14:52:23.375Z","updated":"2026-04-28T16:14:04.343Z","title":"WordPress SMTP Mail plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"photoboxone","product":"SMTP Mail","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62740","published":"2025-12-09T14:52:22.982Z","updated":"2026-04-28T18:55:44.150Z","title":"WordPress WP-CRM System plugin <= 3.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mario Peshev","product":"WP-CRM System","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62739","published":"2025-12-09T14:52:22.791Z","updated":"2026-11-03T22:03:06.890Z","title":"WordPress Add Custom Codes plugin <= 4.80 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SaifuMak","product":"Add Custom Codes","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-62738","published":"2025-12-09T14:52:22.583Z","updated":"2026-04-28T18:55:34.170Z","title":"WordPress Formstack Online Forms plugin <= 2.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mmattax","product":"Formstack Online Forms","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62737","published":"2025-12-09T14:52:22.392Z","updated":"2026-04-28T18:55:23.311Z","title":"WordPress Image Cleanup plugin <= 1.9.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"opicron","product":"Image Cleanup","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-62736","published":"2025-12-09T14:52:22.205Z","updated":"2026-04-28T18:55:12.422Z","title":"WordPress Image Cleanup plugin <= 1.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"opicron","product":"Image Cleanup","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-62735","published":"2025-12-09T14:52:22.012Z","updated":"2026-04-28T18:55:02.245Z","title":"WordPress User Spam Remover plugin <= 1.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Joel","product":"User Spam Remover","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-62734","published":"2025-12-09T14:52:21.803Z","updated":"2026-04-28T18:54:51.970Z","title":"WordPress Media Library Downloader plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"M.Code","product":"Media Library Downloader","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62733","published":"2025-12-09T14:52:21.585Z","updated":"2026-04-28T18:54:40.840Z","title":"WordPress Custom Sidebars by ProteusThemes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ProteusThemes","product":"Custom Sidebars by ProteusThemes","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62153","published":"2025-12-09T14:52:21.381Z","updated":"2026-04-28T16:14:03.244Z","title":"WordPress Quick Interest Slider plugin <= 3.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Graham","product":"Quick Interest Slider","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62152","published":"2025-12-09T14:52:21.181Z","updated":"2026-04-28T16:14:03.247Z","title":"WordPress ConveyThis plugin <= 269.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ConveyThis","product":"ConveyThis","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-62151","published":"2025-12-09T14:52:20.912Z","updated":"2026-11-03T22:03:06.752Z","title":"WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Virtuaria","product":"Virtuaria PagBank / PagSeguro para Woocommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-62109","published":"2025-12-09T14:52:20.721Z","updated":"2026-04-28T16:14:01.672Z","title":"WordPress Geo Controller plugin <= 8.9.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"INFINITUM FORM","product":"Geo Controller","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-62103","published":"2025-12-09T14:52:20.526Z","updated":"2026-04-28T16:14:01.729Z","title":"WordPress Media Library File Download plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpmediadownload","product":"Media Library File Download","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62102","published":"2025-12-09T14:52:20.337Z","updated":"2026-04-28T18:54:31.586Z","title":"WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"apasionados","product":"DoFollow Case by Case","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-62100","published":"2025-12-09T14:52:20.128Z","updated":"2026-04-28T18:54:21.093Z","title":"WordPress ThemeRain Core plugin <= 1.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themerain","product":"ThemeRain Core","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-62093","published":"2025-12-09T14:52:19.928Z","updated":"2026-04-28T16:14:01.370Z","title":"WordPress Image&Video FullScreen Background plugin <= 1.6.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Image&Video FullScreen Background","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-62090","published":"2025-12-09T14:52:19.744Z","updated":"2026-04-28T18:54:11.214Z","title":"WordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jegstudio","product":"Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-62086","published":"2025-12-09T14:52:19.543Z","updated":"2026-04-28T16:14:00.863Z","title":"WordPress Яндекс Доставка (Boxberry) plugin <= 2.34 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"akazanstev","product":"Яндекс Доставка (Boxberry)","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-62085","published":"2025-12-09T14:52:19.152Z","updated":"2026-04-28T18:54:00.324Z","title":"WordPress BERTHA AI plugin <= 1.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Bertha AI – Andrew Palmer","product":"BERTHA AI","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-62082","published":"2025-12-09T14:52:18.804Z","updated":"2026-04-28T18:53:51.159Z","title":"WordPress Generic Elements plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nasir Uddin","product":"Generic Elements","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-59132","published":"2025-12-09T14:52:18.582Z","updated":"2026-04-28T20:19:11.838Z","title":"WordPress Duplicate Content Cure plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Badi Jones","product":"Duplicate Content Cure","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-49351","published":"2025-12-09T14:52:18.391Z","updated":"2026-04-28T20:21:59.091Z","title":"WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Valentin Agachi","product":"Create Posts & Terms","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-49350","published":"2025-12-09T14:52:18.182Z","updated":"2026-04-28T16:13:02.166Z","title":"WordPress Actionwear products sync plugin <= 2.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"marcoingraiti","product":"Actionwear products sync","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-49348","published":"2025-12-09T14:52:17.974Z","updated":"2026-04-28T16:13:02.160Z","title":"WordPress Hype plugin <= 1.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Hype","product":"Hype","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-49347","published":"2025-12-09T14:52:17.791Z","updated":"2026-04-28T20:21:49.061Z","title":"WordPress WP sIFR plugin <= 0.6.8.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jupitercow","product":"WP sIFR","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-49341","published":"2025-12-09T14:52:17.582Z","updated":"2026-04-28T20:21:38.905Z","title":"WordPress PDF Creator Lite plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Alex Furr","product":"PDF Creator Lite","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-67599","published":"2025-12-09T14:14:19.262Z","updated":"2026-04-28T19:24:54.480Z","title":"WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"WebToffee eCommerce Marketing Automation","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-67598","published":"2025-12-09T14:14:19.039Z","updated":"2026-04-28T16:14:22.277Z","title":"WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67597","published":"2025-12-09T14:14:18.833Z","updated":"2026-04-28T16:14:22.248Z","title":"WordPress Fluent Booking plugin <= 1.9.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjahan Jewel","product":"Fluent Booking","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-67596","published":"2025-12-09T14:14:18.627Z","updated":"2026-04-28T16:14:22.228Z","title":"WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67595","published":"2025-12-09T14:14:18.334Z","updated":"2026-04-28T16:14:22.225Z","title":"WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67594","published":"2025-12-09T14:14:18.018Z","updated":"2026-04-28T16:14:22.176Z","title":"WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"Thim Elementor Kit","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-67593","published":"2025-12-09T14:14:17.816Z","updated":"2026-04-28T16:14:22.114Z","title":"WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67592","published":"2025-12-09T14:14:17.621Z","updated":"2026-04-28T16:14:22.112Z","title":"WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Joe Dolson","product":"My Calendar","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-67591","published":"2025-12-09T14:14:17.411Z","updated":"2026-04-28T16:14:22.134Z","title":"WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"jegtheme","product":"JNews Paywall","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67590","published":"2025-12-09T14:14:17.214Z","updated":"2026-04-28T16:14:22.159Z","title":"WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rustaurius","product":"Ultimate FAQ","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-67589","published":"2025-12-09T14:14:17.021Z","updated":"2026-04-28T16:14:22.122Z","title":"WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Overnight","product":"WooCommerce PDF Invoices & Packing Slips","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-67588","published":"2025-12-09T14:14:16.826Z","updated":"2026-04-28T16:14:22.112Z","title":"WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-67587","published":"2025-12-09T14:14:16.613Z","updated":"2026-04-28T16:14:22.129Z","title":"WordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms FreshDesk Plugin","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-67586","published":"2025-12-09T14:14:16.416Z","updated":"2026-04-28T16:14:21.967Z","title":"WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Ronald Huereca","product":"Highlight and Share","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-67585","published":"2025-12-09T14:14:16.160Z","updated":"2026-04-28T19:24:45.499Z","title":"WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"flexmls","product":"Flexmls® IDX","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67584","published":"2025-12-09T14:14:15.957Z","updated":"2026-04-28T19:24:36.176Z","title":"WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"rtCamp","product":"GoDAM","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-67583","published":"2025-12-09T14:14:15.775Z","updated":"2026-04-28T16:14:21.939Z","title":"WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Foysal Imran","product":"IDonate","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-67582","published":"2025-12-09T14:14:15.571Z","updated":"2026-04-28T16:14:21.956Z","title":"WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wbcomdesigns","product":"Wbcom Designs","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-67581","published":"2025-12-09T14:14:15.375Z","updated":"2026-04-28T16:14:21.958Z","title":"WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-67580","published":"2025-12-09T14:14:15.160Z","updated":"2026-04-28T16:14:21.957Z","title":"WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Constant Contact","product":"Constant Contact + WooCommerce","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-67579","published":"2025-12-09T14:14:14.852Z","updated":"2026-04-28T19:24:27.293Z","title":"WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vanquish","product":"User Extra Fields","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-67578","published":"2025-12-09T14:14:14.654Z","updated":"2026-04-28T16:14:21.978Z","title":"WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Rhys Wynne","product":"WP Email Capture","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67577","published":"2025-12-09T14:14:14.438Z","updated":"2026-04-28T16:14:21.856Z","title":"WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"hassantafreshi","product":"Easy Form Builder","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67576","published":"2025-12-09T14:14:13.956Z","updated":"2026-04-28T19:24:18.251Z","title":"WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"QuantumCloud","product":"Simple Link Directory","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-67575","published":"2025-12-09T14:14:13.775Z","updated":"2026-04-28T16:14:21.544Z","title":"WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Andrew Lima","product":"Sitewide Notice WP","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-67574","published":"2025-12-09T14:14:13.576Z","updated":"2026-04-28T16:14:21.814Z","title":"WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdevart","product":"Booking calendar, Appointment Booking System","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67573","published":"2025-12-09T14:14:13.358Z","updated":"2026-04-28T19:24:08.742Z","title":"WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"Sailing","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67572","published":"2025-12-09T14:14:13.153Z","updated":"2026-04-28T19:23:58.265Z","title":"WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PenciDesign","product":"PenNews","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67571","published":"2025-12-09T14:14:12.900Z","updated":"2026-04-28T19:23:49.210Z","title":"WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-67570","published":"2025-12-09T14:14:12.713Z","updated":"2026-04-28T19:23:40.203Z","title":"WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WesternDeal","product":"WPForms Google Sheet Connector","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67569","published":"2025-12-09T14:14:12.523Z","updated":"2026-04-28T19:23:31.123Z","title":"WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-67568","published":"2025-12-09T14:14:12.329Z","updated":"2026-04-28T19:23:22.028Z","title":"WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"xtemos","product":"Basel","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-67567","published":"2025-12-09T14:14:12.134Z","updated":"2026-04-28T19:23:12.755Z","title":"WordPress Sober theme <= 3.5.11 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"uixthemes","product":"Sober","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-67566","published":"2025-12-09T14:14:11.939Z","updated":"2026-04-28T16:14:21.224Z","title":"WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WofficeIO","product":"Woffice Core","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-67565","published":"2025-12-09T14:14:11.750Z","updated":"2026-04-28T19:23:03.616Z","title":"WordPress Rehub theme <= 19.9.9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sizam","product":"Rehub","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-67564","published":"2025-12-09T14:14:11.456Z","updated":"2026-04-28T19:22:54.580Z","title":"WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"alekv","product":"Pixel Manager for WooCommerce","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-67563","published":"2025-12-09T14:14:11.248Z","updated":"2026-04-28T16:14:21.208Z","title":"WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"Post SMTP","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-67562","published":"2025-12-09T14:14:10.979Z","updated":"2026-04-28T16:14:21.237Z","title":"WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WebCodingPlace","product":"Image Caption Hover Pro","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-67561","published":"2025-12-09T14:14:10.737Z","updated":"2026-04-28T16:14:21.233Z","title":"WordPress Debug Log Viewer plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Oleksandr Lysyi","product":"Debug Log Viewer","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-67560","published":"2025-12-09T14:14:09.636Z","updated":"2026-04-28T16:14:21.258Z","title":"WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-67559","published":"2025-12-09T14:14:09.425Z","updated":"2026-04-28T16:14:21.219Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-67558","published":"2025-12-09T14:14:09.063Z","updated":"2026-04-28T16:14:21.154Z","title":"WordPress Rencontre plugin <= 3.13.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jacques Malgrange","product":"Rencontre","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67557","published":"2025-12-09T14:14:08.814Z","updated":"2026-04-28T16:14:21.248Z","title":"WordPress WP eBay Product Feeds plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Rhys Wynne","product":"WP eBay Product Feeds","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67556","published":"2025-12-09T14:14:08.628Z","updated":"2026-04-28T19:20:36.233Z","title":"WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ThemeHigh","product":"Advanced FAQ Manager","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67555","published":"2025-12-09T14:14:08.288Z","updated":"2026-04-28T16:14:21.160Z","title":"WordPress UseStrict's Calendly Embedder plugin <= 1.1.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"useStrict","product":"UseStrict's Calendly Embedder","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67554","published":"2025-12-09T14:14:08.007Z","updated":"2026-04-28T19:20:27.546Z","title":"WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Humanityco","product":"Cookie Notice & Compliance for GDPR / CCPA","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-67553","published":"2025-12-09T14:14:07.745Z","updated":"2026-04-28T19:20:18.257Z","title":"WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeHigh","product":"Advanced FAQ Manager","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67552","published":"2025-12-09T14:14:07.454Z","updated":"2026-04-28T19:20:08.757Z","title":"WordPress Walker Core plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WalkerWP","product":"Walker Core","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67551","published":"2025-12-09T14:14:07.205Z","updated":"2026-04-28T19:19:57.416Z","title":"WordPress Wappointment plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wappointment team","product":"Wappointment","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67550","published":"2025-12-09T14:14:06.957Z","updated":"2026-04-28T19:19:48.490Z","title":"WordPress Donation Thermometer plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"rhewlif","product":"Donation Thermometer","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67549","published":"2025-12-09T14:14:06.739Z","updated":"2026-04-28T19:19:38.917Z","title":"WordPress oik plugin <= 4.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67548","published":"2025-12-09T14:14:06.510Z","updated":"2026-04-28T16:14:20.589Z","title":"WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Delicious","product":"WP Delicious","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-67545","published":"2025-12-09T14:14:06.130Z","updated":"2026-04-28T19:19:15.550Z","title":"WordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FirePlugins","product":"FireBox","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67544","published":"2025-12-09T14:14:05.870Z","updated":"2026-04-28T19:19:03.930Z","title":"WordPress Shopkeeper Extender plugin < 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Get Bowtied","product":"Shopkeeper Extender","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67543","published":"2025-12-09T14:14:05.667Z","updated":"2026-04-28T19:18:54.458Z","title":"WordPress Essential Widgets plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Catch Themes","product":"Essential Widgets","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67542","published":"2025-12-09T14:14:05.482Z","updated":"2026-04-28T19:18:43.709Z","title":"WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SilkyPress","product":"Multi-Step Checkout for WooCommerce","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67541","published":"2025-12-09T14:14:05.260Z","updated":"2026-04-28T16:14:20.126Z","title":"WordPress WP-ShowHide plugin <= 1.05 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Lester Chan","product":"WP-ShowHide","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67540","published":"2025-12-09T14:14:05.024Z","updated":"2026-04-28T19:18:34.669Z","title":"WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wealcoder","product":"Animation Addons for Elementor","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-67539","published":"2025-12-09T14:14:04.804Z","updated":"2026-04-28T19:18:23.949Z","title":"WordPress Select Core plugin < 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Select-Themes","product":"Select Core","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67538","published":"2025-12-09T14:14:04.582Z","updated":"2026-04-28T19:18:14.699Z","title":"WordPress JNews Gallery plugin < 12.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jegtheme","product":"JNews Gallery","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67537","published":"2025-12-09T14:14:04.310Z","updated":"2026-04-28T19:18:03.895Z","title":"WordPress ThirstyAffiliates plugin <= 3.11.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Blair Williams","product":"ThirstyAffiliates","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-67536","published":"2025-12-09T14:14:04.062Z","updated":"2026-04-28T19:17:53.966Z","title":"WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-67535","published":"2025-12-09T14:14:03.841Z","updated":"2026-04-28T16:14:20.157Z","title":"WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Flipper Code - WordPress Development Company","product":"WP Maps","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2025-67534","published":"2025-12-09T14:14:03.622Z","updated":"2026-04-28T16:14:20.073Z","title":"WordPress Rencontre plugin <= 3.13.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacques Malgrange","product":"Rencontre","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2025-67533","published":"2025-12-09T14:14:03.414Z","updated":"2026-04-28T16:14:20.045Z","title":"WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themifyme","product":"Themify Portfolio Post","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-67532","published":"2025-12-09T14:14:03.164Z","updated":"2026-04-28T16:14:20.095Z","title":"WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Hara","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67531","published":"2025-12-09T14:14:01.550Z","updated":"2026-04-28T16:14:20.208Z","title":"WordPress Turitor theme < 1.5.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"trippleS","product":"Turitor","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67530","published":"2025-12-09T14:14:01.260Z","updated":"2026-04-28T16:14:20.233Z","title":"WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Besa","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67529","published":"2025-12-09T14:14:01.047Z","updated":"2026-04-28T16:14:20.000Z","title":"WordPress Fashion theme < 5.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Opal_WP","product":"Fashion","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67528","published":"2025-12-09T14:14:00.840Z","updated":"2026-11-03T22:03:09.032Z","title":"WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"thembay","product":"Urna","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67527","published":"2025-12-09T14:14:00.496Z","updated":"2026-04-28T16:14:19.971Z","title":"WordPress Digiqole theme < 2.2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"trippleS","product":"Digiqole","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67526","published":"2025-12-09T14:14:00.209Z","updated":"2026-11-03T22:03:08.876Z","title":"WordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"Sailing","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67525","published":"2025-12-09T14:13:59.771Z","updated":"2026-04-28T16:14:19.743Z","title":"WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Opal_WP","product":"ekommart","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67524","published":"2025-12-09T14:13:59.520Z","updated":"2026-04-28T16:14:19.765Z","title":"WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"NooTheme","product":"Jobmonster Elementor Addon","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67523","published":"2025-12-09T14:13:59.287Z","updated":"2026-11-03T22:03:08.720Z","title":"WordPress Exhibz theme <= 3.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"trippleS","product":"Exhibz","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67522","published":"2025-12-09T14:13:59.066Z","updated":"2026-11-03T22:03:08.569Z","title":"WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67521","published":"2025-12-09T14:13:58.865Z","updated":"2026-11-03T22:03:08.406Z","title":"WordPress Select Core plugin < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Select Core","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-67520","published":"2025-12-09T14:13:58.651Z","updated":"2026-04-28T16:14:19.827Z","title":"WordPress Media Library Tools plugin <= 1.6.15 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Tiny Solutions","product":"Media Library Tools","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-67519","published":"2025-12-09T14:13:58.092Z","updated":"2026-04-28T16:14:19.622Z","title":"WordPress Ninja Tables plugin <= 5.2.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shahjahan Jewel","product":"Ninja Tables","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2025-67518","published":"2025-12-09T14:13:57.826Z","updated":"2026-04-28T16:14:19.607Z","title":"WordPress Accordion Slider PRO plugin <= 1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Accordion Slider PRO","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-67517","published":"2025-12-09T14:13:57.629Z","updated":"2026-04-28T16:14:19.659Z","title":"WordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"artplacer","product":"ArtPlacer Widget","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-67516","published":"2025-12-09T14:13:57.425Z","updated":"2026-04-28T16:14:19.635Z","title":"WordPress Store Locator WordPress plugin <= 1.6.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Agile Logix","product":"Store Locator WordPress","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-67515","published":"2025-12-09T14:13:57.222Z","updated":"2026-04-28T16:14:19.652Z","title":"WordPress Wilmër theme < 3.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Mikado-Themes","product":"Wilmër","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-67474","published":"2025-12-09T14:13:57.009Z","updated":"2026-04-28T19:17:43.447Z","title":"WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ultimate Member","product":"ForumWP","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-67473","published":"2025-12-09T14:13:56.814Z","updated":"2026-04-28T16:14:19.628Z","title":"WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"codeworkweb","product":"CWW Companion","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-67472","published":"2025-12-09T14:13:56.599Z","updated":"2026-04-28T16:14:19.591Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-67471","published":"2025-12-09T14:13:56.242Z","updated":"2026-04-28T16:14:19.604Z","title":"WordPress Quick Contact Form plugin <= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Saad Iqbal","product":"Quick Contact Form","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-67470","published":"2025-12-09T14:13:56.054Z","updated":"2026-04-28T19:17:34.250Z","title":"WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Essential Plugin","product":"Portfolio and Projects","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-67469","published":"2025-12-09T14:13:55.861Z","updated":"2026-04-28T16:14:19.608Z","title":"WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"kubiq","product":"PDF Thumbnail Generator","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-67468","published":"2025-12-09T14:13:55.664Z","updated":"2026-04-28T16:14:19.556Z","title":"WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CRM Perks","product":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-67466","published":"2025-12-09T14:13:55.460Z","updated":"2026-04-28T16:14:19.696Z","title":"WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sergiotrinity","product":"Trinity Audio","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-67465","published":"2025-12-09T14:13:55.262Z","updated":"2026-04-28T16:14:19.420Z","title":"WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"QuantumCloud","product":"Simple Link Directory","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-66534","published":"2025-12-09T14:13:54.991Z","updated":"2026-11-03T22:03:08.256Z","title":"WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Elated-Themes","product":"The Aisle","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-66532","published":"2025-12-09T14:13:54.794Z","updated":"2026-04-28T16:14:19.280Z","title":"WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mikado-Themes","product":"Powerlift","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-66531","published":"2025-12-09T14:13:54.558Z","updated":"2026-04-28T16:14:19.251Z","title":"WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-66530","published":"2025-12-09T14:13:53.897Z","updated":"2026-04-28T16:14:19.257Z","title":"WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-66529","published":"2025-12-09T14:13:53.647Z","updated":"2026-04-28T16:14:19.249Z","title":"WordPress Chartify plugin <= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Chartify","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-66528","published":"2025-12-09T14:13:53.449Z","updated":"2026-11-03T22:03:08.126Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-66527","published":"2025-12-09T14:13:53.255Z","updated":"2026-04-28T16:14:19.273Z","title":"WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VanKarWai","product":"Lobo","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-66526","published":"2025-12-09T14:13:53.002Z","updated":"2026-04-28T19:11:04.563Z","title":"WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Essekia","product":"Tablesome","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-66525","published":"2025-12-09T14:13:52.779Z","updated":"2026-04-28T16:14:19.089Z","title":"WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Elastic Email","product":"Elastic Email Sender","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-64257","published":"2025-12-09T14:13:52.568Z","updated":"2026-04-28T16:14:12.717Z","title":"WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Joe Dolson","product":"My Tickets","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-64256","published":"2025-12-09T14:13:52.351Z","updated":"2026-04-28T16:14:12.692Z","title":"WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PressTigers","product":"Simple Folio","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-64255","published":"2025-12-09T14:13:52.144Z","updated":"2026-04-28T16:14:12.629Z","title":"WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"Bowo","product":"Admin and Site Enhancements (ASE)","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-64254","published":"2025-12-09T14:13:51.839Z","updated":"2026-04-28T18:27:56.867Z","title":"WordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"Ronald Huereca","product":"Photo Block","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-13835","published":"2025-12-01T17:57:41.794Z","updated":"2026-04-28T16:10:57.260Z","title":"WordPress Arconix Shortcodes plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tychesoftwares","product":"Arconix Shortcodes","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-66115","published":"2025-11-21T12:30:06.442Z","updated":"2026-04-28T16:14:17.199Z","title":"WordPress Easy Invoice plugin <= 2.1.4 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.6,"vendor":"MatrixAddons","product":"Easy Invoice","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2025-66114","published":"2025-11-21T12:30:06.230Z","updated":"2026-04-28T16:14:17.220Z","title":"WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"theme funda","product":"Show Variations as Single Products Woocommerce","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-66113","published":"2025-11-21T12:30:05.951Z","updated":"2026-04-28T16:14:17.093Z","title":"WordPress Better Chat Support for Messenger plugin <= 1.2.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeAtelier","product":"Better Chat Support for Messenger","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-66112","published":"2025-11-21T12:30:05.704Z","updated":"2026-04-28T19:08:24.679Z","title":"WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Accessibility Toolkit by WebYes","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-66111","published":"2025-11-21T12:30:05.445Z","updated":"2026-04-28T16:14:17.094Z","title":"WordPress Nelio Popups plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nelio Software","product":"Nelio Popups","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66110","published":"2025-11-21T12:30:05.216Z","updated":"2026-04-28T16:14:17.075Z","title":"WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-66109","published":"2025-11-21T12:30:04.941Z","updated":"2026-04-28T16:14:17.074Z","title":"WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Octolize Shipping Plugins","product":"Cart Weight for WooCommerce","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-66108","published":"2025-11-21T12:30:04.685Z","updated":"2026-04-28T16:14:17.096Z","title":"WordPress TNC Toolbox: Web Performance plugin <= 2.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Merlot Digital (by TNC)","product":"TNC Toolbox: Web Performance","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-66107","published":"2025-11-21T12:30:04.428Z","updated":"2026-04-28T19:08:13.163Z","title":"WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Scott Paterson","product":"Subscriptions & Memberships for PayPal","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-66106","published":"2025-11-21T12:30:03.619Z","updated":"2026-04-28T16:14:17.083Z","title":"WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Essential Plugin","product":"Featured Post Creative","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-66101","published":"2025-11-21T12:30:01.600Z","updated":"2026-04-28T16:14:16.998Z","title":"WordPress CBX Bookmark & Favorite plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sabuj Kundu","product":"CBX Bookmark & Favorite","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-66099","published":"2025-11-21T12:30:01.184Z","updated":"2026-04-28T19:07:42.662Z","title":"WordPress Chat Help plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeAtelier","product":"Chat Help","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-66098","published":"2025-11-21T12:30:00.878Z","updated":"2026-04-28T19:07:33.519Z","title":"WordPress Travelers' Map plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Camille V","product":"Travelers' Map","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66097","published":"2025-11-21T12:29:59.986Z","updated":"2026-04-28T16:14:16.976Z","title":"WordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Igor Jerosimić","product":"I Order Terms","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-66096","published":"2025-11-21T12:29:59.819Z","updated":"2026-04-28T16:14:16.817Z","title":"WordPress Table Block by Tableberg plugin <= 0.6.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Imtiaz Rayhan","product":"Table Block by Tableberg","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-66095","published":"2025-11-21T12:29:59.655Z","updated":"2026-04-28T16:14:16.559Z","title":"WordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Iqonic Design","product":"KiviCare","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-66093","published":"2025-11-21T12:29:59.483Z","updated":"2026-04-28T19:07:22.703Z","title":"WordPress Extensions for Leaflet Map plugin <= 4.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hupe13","product":"Extensions for Leaflet Map","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66092","published":"2025-11-21T12:29:59.275Z","updated":"2026-04-28T19:07:12.614Z","title":"WordPress Accordion Slider plugin <= 1.9.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bqworks","product":"Accordion Slider","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66091","published":"2025-11-21T12:29:59.090Z","updated":"2026-04-28T19:07:01.753Z","title":"WordPress Stylish Cost Calculator plugin <= 8.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Design","product":"Stylish Cost Calculator","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66090","published":"2025-11-21T12:29:58.912Z","updated":"2026-04-28T19:06:50.911Z","title":"WordPress SKT Skill Bar plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Skill Bar","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-66089","published":"2025-11-21T12:29:58.741Z","updated":"2026-04-28T16:14:16.399Z","title":"WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Product Feed for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-66087","published":"2025-11-21T12:29:58.540Z","updated":"2026-04-28T16:14:16.481Z","title":"WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-66086","published":"2025-11-21T12:29:58.296Z","updated":"2026-04-28T16:14:16.345Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozy Vision","product":"SMS Alert Order Notifications","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-66085","published":"2025-11-21T12:29:58.133Z","updated":"2026-04-28T16:14:16.569Z","title":"WordPress Arconix Shortcodes plugin <= 2.1.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tychesoftwares","product":"Arconix Shortcodes","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-66084","published":"2025-11-21T12:29:57.920Z","updated":"2026-04-28T16:14:16.325Z","title":"WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjahan Jewel","product":"FluentCommunity","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-66083","published":"2025-11-21T12:29:57.750Z","updated":"2026-04-28T16:14:16.564Z","title":"WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-66082","published":"2025-11-21T12:29:57.578Z","updated":"2026-04-28T16:14:16.333Z","title":"WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-66081","published":"2025-11-21T12:29:57.410Z","updated":"2026-04-28T16:14:16.531Z","title":"WordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jeff Starr","product":"Head Meta Data","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-66079","published":"2025-11-21T12:29:57.227Z","updated":"2026-04-28T19:06:40.617Z","title":"WordPress Gutenverse Form plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jegstudio","product":"Gutenverse Form","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-66077","published":"2025-11-21T12:29:57.063Z","updated":"2026-04-28T16:14:16.240Z","title":"WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpWax","product":"Legal Pages","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-66075","published":"2025-11-21T12:29:56.896Z","updated":"2026-04-28T16:14:16.264Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-66073","published":"2025-11-21T12:29:56.667Z","updated":"2026-04-28T16:14:15.776Z","title":"WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Cozmoslabs","product":"WP Webhooks","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-66072","published":"2025-11-21T12:29:56.382Z","updated":"2026-04-28T16:14:15.864Z","title":"WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-66071","published":"2025-11-21T12:29:56.210Z","updated":"2026-04-28T19:06:30.520Z","title":"WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"tychesoftwares","product":"Custom Order Numbers for WooCommerce","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-66069","published":"2025-11-21T12:29:56.025Z","updated":"2026-04-28T16:14:15.729Z","title":"WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeisle","product":"PPOM for WooCommerce","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-66067","published":"2025-11-21T12:29:55.849Z","updated":"2026-04-28T16:14:15.817Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.13.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aman","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-66066","published":"2025-11-21T12:29:55.680Z","updated":"2026-04-28T16:14:15.744Z","title":"WordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"EnvoThemes","product":"Envo Extra","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-66065","published":"2025-11-21T12:29:55.513Z","updated":"2026-04-28T16:14:15.667Z","title":"WordPress Gutenverse plugin <= 3.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jegstudio","product":"Gutenverse","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-66064","published":"2025-11-21T12:29:55.338Z","updated":"2026-04-28T16:14:15.601Z","title":"WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"Giveaways and Contests by RafflePress","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-66063","published":"2025-11-21T12:29:55.169Z","updated":"2026-04-28T16:14:15.490Z","title":"WordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"jgwhite33","product":"WP Google Review Slider","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-66062","published":"2025-11-21T12:29:54.981Z","updated":"2026-04-28T16:14:15.519Z","title":"WordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability","severity":"LOW","score":3.4,"vendor":"Frank Goossens","product":"WP YouTube Lyte","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-66061","published":"2025-11-21T12:29:54.807Z","updated":"2026-04-28T16:14:15.342Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-66060","published":"2025-11-21T12:29:54.618Z","updated":"2026-04-28T16:14:15.525Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-66059","published":"2025-11-21T12:29:54.426Z","updated":"2026-04-28T16:14:15.521Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-66057","published":"2025-11-21T12:29:54.209Z","updated":"2026-04-28T16:14:15.307Z","title":"WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-66056","published":"2025-11-21T12:29:54.000Z","updated":"2026-04-28T19:06:21.036Z","title":"WordPress Uncanny Automator plugin < 6.10.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-66055","published":"2025-11-21T12:29:53.666Z","updated":"2026-04-28T19:06:10.579Z","title":"WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Icegram","product":"Email Subscribers & Newsletters","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-66053","published":"2025-11-21T12:29:53.446Z","updated":"2026-04-28T19:05:59.849Z","title":"WordPress Enfold theme <= 7.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kriesi","product":"Enfold","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-64384","published":"2025-11-13T09:24:36.292Z","updated":"2026-04-28T16:14:14.846Z","title":"WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-64383","published":"2025-11-13T09:24:35.862Z","updated":"2026-04-28T18:33:03.137Z","title":"WordPress Qi Blocks plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Qode","product":"Qi Blocks","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-64382","published":"2025-11-13T09:24:35.435Z","updated":"2026-04-28T18:32:53.974Z","title":"WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Order Export & Order Import for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-64381","published":"2025-11-13T09:24:35.014Z","updated":"2026-04-28T18:32:44.923Z","title":"WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64380","published":"2025-11-13T09:24:34.585Z","updated":"2026-04-28T18:32:35.729Z","title":"WordPress Booster for WooCommerce plugin <= 7.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-64379","published":"2025-11-13T09:24:34.101Z","updated":"2026-04-28T18:32:26.874Z","title":"WordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-64370","published":"2025-11-13T09:24:33.651Z","updated":"2026-04-28T16:14:14.526Z","title":"WordPress YOP Poll plugin <= 6.5.38 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YOP","product":"YOP Poll","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-64369","published":"2025-11-13T09:24:33.215Z","updated":"2026-04-28T18:31:48.885Z","title":"WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Contact Form Email","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-64292","published":"2025-11-13T09:24:32.781Z","updated":"2026-04-28T16:14:14.066Z","title":"WordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PascalBajorat","product":"Analytics Germanized for Google Analytics","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64277","published":"2025-11-13T09:24:32.345Z","updated":"2026-04-28T16:14:13.339Z","title":"WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-64276","published":"2025-11-13T09:24:31.911Z","updated":"2026-04-28T18:29:22.429Z","title":"WordPress Survey Maker plugin <= 5.1.9.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-64275","published":"2025-11-13T09:24:31.484Z","updated":"2026-04-28T18:29:13.143Z","title":"WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Manager","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64274","published":"2025-11-13T09:24:31.061Z","updated":"2026-04-28T16:14:13.351Z","title":"WordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpkoithemes","product":"WPKoi Templates for Elementor","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-64271","published":"2025-11-13T09:24:30.639Z","updated":"2026-04-28T16:14:13.325Z","title":"WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HasThemes","product":"WP Plugin Manager","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2025-64269","published":"2025-11-13T09:24:30.214Z","updated":"2026-04-28T16:14:13.326Z","title":"WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EDGARROJAS","product":"WooCommerce PDF Invoice Builder","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-64267","published":"2025-11-13T09:24:29.783Z","updated":"2026-04-28T16:14:12.918Z","title":"WordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPSwings","product":"WooCommerce Ultimate Points And Rewards","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-64265","published":"2025-11-13T09:24:29.310Z","updated":"2026-04-28T16:14:12.942Z","title":"WordPress Frontend File Manager plugin <= 23.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-64264","published":"2025-11-13T09:24:28.871Z","updated":"2026-04-28T18:28:25.260Z","title":"WordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Aman","product":"Popup addon for Ninja Forms","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-64263","published":"2025-11-13T09:24:28.383Z","updated":"2026-04-28T16:14:12.805Z","title":"WordPress WP Content Pilot plugin <= 2.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PluginEver","product":"WP Content Pilot","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-64262","published":"2025-11-13T09:24:27.918Z","updated":"2026-04-28T16:14:12.930Z","title":"WordPress Auto Prune Posts plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ramon fincken","product":"Auto Prune Posts","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-64261","published":"2025-11-13T09:24:27.476Z","updated":"2026-04-28T16:14:12.817Z","title":"WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"codepeople","product":"Appointment Booking Calendar","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-64259","published":"2025-11-13T09:24:26.955Z","updated":"2026-04-28T16:14:12.742Z","title":"WordPress Theater for WordPress plugin <= 0.18.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jeroen Schmit","product":"Theater for WordPress","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-64293","published":"2025-11-12T15:52:49.026Z","updated":"2026-05-13T10:39:20.539Z","title":"WordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Golemiq","product":"0 Day Analytics","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-64287","published":"2025-11-06T15:56:13.317Z","updated":"2026-04-28T16:14:13.443Z","title":"WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Alloggio - Hotel Booking","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-64232","published":"2025-11-06T15:56:12.576Z","updated":"2026-04-28T18:26:59.649Z","title":"WordPress Import from YML plugin <= 3.1.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"icopydoc","product":"Import from YML","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-64224","published":"2025-11-06T15:56:10.204Z","updated":"2026-04-28T18:26:22.929Z","title":"WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Conference Theme Custom Post Type","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-64198","published":"2025-11-06T15:56:09.273Z","updated":"2026-04-28T18:23:47.001Z","title":"WordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"appscreo","product":"Easy Social Share Buttons","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-64196","published":"2025-11-06T15:56:07.302Z","updated":"2026-04-28T18:23:29.747Z","title":"WordPress Booster for WooCommerce plugin <= 7.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-6327","published":"2025-11-06T15:56:06.826Z","updated":"2026-04-28T18:22:20.539Z","title":"WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-6325","published":"2025-11-06T15:56:05.901Z","updated":"2026-04-28T18:22:03.400Z","title":"WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-62950","published":"2025-11-06T15:56:04.961Z","updated":"2026-04-28T16:14:06.870Z","title":"WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-62914","published":"2025-11-06T15:56:02.281Z","updated":"2026-04-28T16:14:05.612Z","title":"WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"anibalwainstein","product":"Effect Maker","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-62076","published":"2025-11-06T15:55:59.012Z","updated":"2026-04-28T18:53:29.952Z","title":"WordPress Simple Payment plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-62075","published":"2025-11-06T15:55:57.636Z","updated":"2026-04-28T16:14:00.987Z","title":"WordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2025-62074","published":"2025-11-06T15:55:56.024Z","updated":"2026-04-28T18:53:19.307Z","title":"WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Amauri","product":"WPMobile.App","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-62067","published":"2025-11-06T15:55:55.213Z","updated":"2026-04-28T16:14:00.282Z","title":"WordPress Savory theme <= 2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Savory","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-62066","published":"2025-11-06T15:55:54.429Z","updated":"2026-04-28T16:14:00.783Z","title":"WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"fuelthemes","product":"Revolution","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2025-62065","published":"2025-11-06T15:55:53.302Z","updated":"2026-04-28T18:52:47.513Z","title":"WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Rometheme","product":"RTMKit","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-62064","published":"2025-11-06T15:55:51.676Z","updated":"2026-04-28T18:52:38.358Z","title":"WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Elated-Themes","product":"Search & Go","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-62059","published":"2025-11-06T15:55:51.134Z","updated":"2026-04-28T18:52:10.770Z","title":"WordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureRank","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-62057","published":"2025-11-06T15:55:50.427Z","updated":"2026-04-28T18:51:52.727Z","title":"WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"favethemes","product":"Houzez Theme - Functionality","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-62055","published":"2025-11-06T15:55:49.844Z","updated":"2026-04-28T16:14:00.193Z","title":"WordPress Academist theme < 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Academist","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-62053","published":"2025-11-06T15:55:48.526Z","updated":"2026-04-28T16:13:59.715Z","title":"WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-62051","published":"2025-11-06T15:55:47.211Z","updated":"2026-04-28T18:51:22.108Z","title":"WordPress UDesign Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-62049","published":"2025-11-06T15:55:44.281Z","updated":"2026-04-28T16:14:00.166Z","title":"WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"Cost Calculator Builder","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2025-62047","published":"2025-11-06T15:55:43.609Z","updated":"2026-04-28T18:51:02.501Z","title":"WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Case-Themes","product":"Case Addons","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2025-62046","published":"2025-11-06T15:55:42.909Z","updated":"2026-04-28T16:13:59.779Z","title":"WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Demo Import (for WPBakery)","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-62045","published":"2025-11-06T15:55:41.551Z","updated":"2026-04-28T16:13:59.856Z","title":"WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CodexThemes","product":"TheGem Theme Elements (for WPBakery)","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2025-62044","published":"2025-11-06T15:55:39.461Z","updated":"2026-04-28T18:50:53.305Z","title":"WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem Theme Elements (for WPBakery)","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-62041","published":"2025-11-06T15:55:38.770Z","updated":"2026-04-28T18:50:33.517Z","title":"WordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-62040","published":"2025-11-06T15:55:38.092Z","updated":"2026-04-28T18:50:24.216Z","title":"WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"YOP","product":"YOP Poll","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-62039","published":"2025-11-06T15:55:37.380Z","updated":"2026-04-28T18:50:12.214Z","title":"WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Ays Pro","product":"AI ChatBot with ChatGPT and Content Generator by AYS","kev":false,"epss":0.01333,"kevAdded":null},{"id":"CVE-2025-62038","published":"2025-11-06T15:55:36.094Z","updated":"2026-04-28T16:13:59.417Z","title":"WordPress MeetingHub plugin <= 1.23.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sovlix","product":"MeetingHub","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-62037","published":"2025-11-06T15:55:34.720Z","updated":"2026-04-28T16:13:59.481Z","title":"WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"uxper","product":"Togo","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-62036","published":"2025-11-06T15:55:32.766Z","updated":"2026-04-28T18:49:59.506Z","title":"WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Togo","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-62035","published":"2025-11-06T15:55:31.398Z","updated":"2026-04-28T18:49:49.967Z","title":"WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"uxper","product":"Togo","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2025-62034","published":"2025-11-06T15:55:30.572Z","updated":"2026-04-28T18:49:39.716Z","title":"WordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"uxper","product":"Togo","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-62033","published":"2025-11-06T15:55:29.843Z","updated":"2026-04-28T16:13:59.394Z","title":"WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"uxper","product":"Togo","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-62032","published":"2025-11-06T15:55:29.230Z","updated":"2026-04-28T18:49:30.048Z","title":"WordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tagDiv","product":"tagDiv Cloud Library","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62031","published":"2025-11-06T15:55:28.516Z","updated":"2026-04-28T18:49:20.448Z","title":"WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-62030","published":"2025-11-06T15:55:27.866Z","updated":"2026-04-28T18:49:09.269Z","title":"WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tagDiv","product":"tagDiv Composer","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62028","published":"2025-11-06T15:55:27.077Z","updated":"2026-04-28T16:13:59.260Z","title":"WordPress Salient theme < 17.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeNectar","product":"Salient","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62018","published":"2025-11-06T15:55:26.361Z","updated":"2026-04-28T16:13:59.165Z","title":"WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"hogash","product":"KALLYAS","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-62017","published":"2025-11-06T15:55:25.294Z","updated":"2026-04-28T16:13:59.087Z","title":"WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"hogash","product":"KALLYAS","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-62016","published":"2025-11-06T15:55:24.586Z","updated":"2026-04-28T18:47:22.415Z","title":"WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"hogash","product":"KALLYAS","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-62014","published":"2025-11-06T15:55:23.874Z","updated":"2026-04-28T18:47:13.305Z","title":"WordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"ITok","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2025-62012","published":"2025-11-06T15:55:23.261Z","updated":"2026-04-28T18:47:04.273Z","title":"WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62011","published":"2025-11-06T15:55:22.593Z","updated":"2026-04-28T18:46:55.151Z","title":"WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodexThemes","product":"TheGem","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62010","published":"2025-11-06T15:55:21.866Z","updated":"2026-04-28T18:46:45.524Z","title":"WordPress Famita theme <= 1.54 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Famita","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-60248","published":"2025-11-06T15:55:21.142Z","updated":"2026-04-28T18:44:42.723Z","title":"WordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"WPClever","product":"WPC Product Options for WooCommerce","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2025-60247","published":"2025-11-06T15:55:20.539Z","updated":"2026-04-28T16:13:58.396Z","title":"WordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bux","product":"Bux Woocommerce","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-60245","published":"2025-11-06T15:55:19.859Z","updated":"2026-04-28T18:44:23.986Z","title":"WordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-60244","published":"2025-11-06T15:55:18.193Z","updated":"2026-04-28T18:44:14.953Z","title":"WordPress TableOn plugin <= 1.0.5.1 - Content Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-60243","published":"2025-11-06T15:55:15.782Z","updated":"2026-04-28T18:44:06.234Z","title":"WordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Holest Engineering","product":"Selling Commander for WooCommerce","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2025-60242","published":"2025-11-06T15:55:14.917Z","updated":"2026-04-28T16:13:58.787Z","title":"WordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Anatoly","product":"Download Counter","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2025-60241","published":"2025-11-06T15:55:13.362Z","updated":"2026-04-28T18:43:56.710Z","title":"WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Premmerce","product":"Premmerce","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60240","published":"2025-11-06T15:55:10.324Z","updated":"2026-04-28T18:43:50.930Z","title":"WordPress AnyComment plugin <= 0.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Alexander","product":"AnyComment","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60239","published":"2025-11-06T15:55:09.493Z","updated":"2026-04-28T16:13:58.311Z","title":"WordPress CoSchool LMS plugin <= 1.4.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Codexpert, Inc","product":"CoSchool LMS","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-60235","published":"2025-11-06T15:55:07.928Z","updated":"2026-04-28T18:43:38.229Z","title":"WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"Plugify","product":"Support Ticket System for WooCommerce (Premium)","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-60207","published":"2025-11-06T15:55:06.274Z","updated":"2026-04-28T18:40:38.756Z","title":"WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"Addify","product":"Custom User Registration Fields for WooCommerce","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-60204","published":"2025-11-06T15:55:05.172Z","updated":"2026-04-28T16:13:57.688Z","title":"WordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Josh Kohlbach","product":"WooCommerce Store Toolkit","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60203","published":"2025-11-06T15:55:04.065Z","updated":"2026-04-28T16:13:57.678Z","title":"WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Josh Kohlbach","product":"Store Exporter","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60202","published":"2025-11-06T15:55:03.303Z","updated":"2026-04-28T16:13:57.735Z","title":"WordPress Favorites plugin <= 2.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Kyle Phillips","product":"Favorites","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60201","published":"2025-11-06T15:55:00.953Z","updated":"2026-10-09T10:21:32.809Z","title":"WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"aguilatechnologies","product":"WP Customer Area","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60200","published":"2025-11-06T15:54:59.689Z","updated":"2026-04-28T16:13:57.651Z","title":"WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress Export Import","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60199","published":"2025-11-06T15:54:56.700Z","updated":"2026-04-28T16:13:57.557Z","title":"WordPress InHype - Blog & Magazine WordPress Theme theme <= 1.5.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"dedalx","product":"InHype - Blog & Magazine WordPress Theme","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-60198","published":"2025-11-06T15:54:55.955Z","updated":"2026-04-28T18:40:20.107Z","title":"WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme <= 1.9.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"dedalx","product":"Saxon - Viral Content Blog & Magazine Marketing WordPress Theme","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-60197","published":"2025-11-06T15:54:54.553Z","updated":"2026-04-28T16:13:57.562Z","title":"WordPress Simple Contact Forms plugin <= 1.6.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"owenr88","product":"Simple Contact Forms","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-60196","published":"2025-11-06T15:54:52.172Z","updated":"2026-04-28T16:13:57.438Z","title":"WordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Clearblue","product":"Clearblue® Ovulation Calculator","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60195","published":"2025-11-06T15:54:51.541Z","updated":"2026-04-28T18:40:11.086Z","title":"WordPress Atarim plugin <= 4.2.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2025-60194","published":"2025-11-06T15:54:50.878Z","updated":"2026-04-28T16:13:57.032Z","title":"WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Premmerce","product":"Premmerce Product Search for WooCommerce","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60193","published":"2025-11-06T15:54:49.770Z","updated":"2026-04-28T16:13:57.088Z","title":"WordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Premmerce","product":"Premmerce User Roles","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60192","published":"2025-11-06T15:54:49.257Z","updated":"2026-04-28T16:13:57.079Z","title":"WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Premmerce","product":"Premmerce Wholesale Pricing for WooCommerce","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60191","published":"2025-11-06T15:54:48.713Z","updated":"2026-04-28T16:13:57.104Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60190","published":"2025-11-06T15:54:48.157Z","updated":"2026-04-28T16:13:57.089Z","title":"WordPress Immocaster WordPress Plugin plugin <= 1.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Hinnerk Altenburg","product":"Immocaster WordPress Plugin","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-60189","published":"2025-11-06T15:54:47.579Z","updated":"2026-04-28T18:40:03.051Z","title":"WordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"PoloPag","product":"PoloPag – Pix Automático para Woocommerce","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60188","published":"2025-11-06T15:54:46.469Z","updated":"2026-04-28T16:13:57.069Z","title":"WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.03733,"kevAdded":null},{"id":"CVE-2025-60187","published":"2025-11-06T15:54:45.484Z","updated":"2026-04-28T18:39:52.035Z","title":"WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-60074","published":"2025-11-06T15:54:43.533Z","updated":"2026-04-28T16:13:54.143Z","title":"WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Processby","product":"Lazy Load Optimizer","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-60073","published":"2025-11-06T15:54:42.201Z","updated":"2026-04-28T18:36:26.383Z","title":"WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Processby","product":"Responsive Sidebar","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-59556","published":"2025-11-06T15:54:38.990Z","updated":"2026-04-28T20:19:51.919Z","title":"WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"GoStore","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-58998","published":"2025-11-06T15:54:37.699Z","updated":"2026-04-28T20:17:19.331Z","title":"WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cristián Lávaque","product":"s2Member","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-58996","published":"2025-11-06T15:54:36.343Z","updated":"2026-04-28T20:17:10.233Z","title":"WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Helmut Wandl","product":"Advanced Settings","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-58995","published":"2025-11-06T15:54:33.654Z","updated":"2026-04-28T16:13:51.759Z","title":"WordPress Leblix Theme <= 2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Creatives_Planet","product":"Leblix","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2025-58994","published":"2025-11-06T15:54:32.378Z","updated":"2026-04-28T16:13:51.219Z","title":"WordPress Greenify theme <= 2.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"designervily","product":"Greenify","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58986","published":"2025-11-06T15:54:30.961Z","updated":"2026-04-28T16:13:50.865Z","title":"WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ganddser","product":"Jock On Air Now (JOAN)","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-58972","published":"2025-11-06T15:54:30.300Z","updated":"2026-04-28T20:17:00.605Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerability","severity":"HIGH","score":7.2,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00507,"kevAdded":null},{"id":"CVE-2025-58964","published":"2025-11-06T15:54:29.627Z","updated":"2026-04-28T20:16:42.683Z","title":"WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Enzy","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-58638","published":"2025-11-06T15:54:28.161Z","updated":"2026-04-28T20:14:33.603Z","title":"WordPress Institutions Directory Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"Institutions Directory","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-58636","published":"2025-11-06T15:54:26.970Z","updated":"2026-04-28T20:14:24.565Z","title":"WordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"WP Gravity Forms Keap/Infusionsoft","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-58629","published":"2025-11-06T15:54:25.101Z","updated":"2026-04-28T16:13:44.841Z","title":"WordPress Miraculous theme < 2.0.9 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"kamleshyadav","product":"Miraculous","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-58627","published":"2025-11-06T15:54:23.943Z","updated":"2026-04-28T20:14:15.681Z","title":"WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"CRITICAL","score":9.8,"vendor":"kamleshyadav","product":"Miraculous Core Plugin","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-58619","published":"2025-11-06T15:54:22.879Z","updated":"2026-04-28T20:14:06.158Z","title":"WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"sbouey","product":"Falang multilanguage","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-58595","published":"2025-11-06T15:54:21.774Z","updated":"2026-04-29T09:51:55.859Z","title":"WordPress All In One Login plugin <= 2.0.8 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"All In One Login","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-58592","published":"2025-11-06T15:54:20.550Z","updated":"2026-04-28T20:13:55.810Z","title":"WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability","severity":"HIGH","score":8.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-58243","published":"2025-11-06T15:54:19.824Z","updated":"2026-04-28T16:13:42.784Z","title":"WordPress imEvent Theme <= 3.4.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jthemes","product":"imEvent","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58207","published":"2025-11-06T15:54:19.210Z","updated":"2026-04-28T16:13:42.210Z","title":"WordPress Ai Image Alt Text Generator for WP Plugin <= 1.1.5 - Broken Access Control Vulnerability","severity":"HIGH","score":8.2,"vendor":"WP Messiah","product":"Ai Image Alt Text Generator for WP","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-5803","published":"2025-11-06T15:54:18.609Z","updated":"2026-04-28T16:13:40.872Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-54737","published":"2025-11-06T15:54:17.806Z","updated":"2026-04-28T18:45:38.491Z","title":"WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54722","published":"2025-11-06T15:54:16.991Z","updated":"2026-04-28T16:13:35.855Z","title":"WordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ex-Themes","product":"WooTour","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54721","published":"2025-11-06T15:54:16.209Z","updated":"2026-04-28T18:45:19.832Z","title":"WordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"Resca","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54719","published":"2025-11-06T15:54:15.371Z","updated":"2026-04-28T18:45:10.216Z","title":"WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data Vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"Yogi - Health Beauty & Yoga","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-54718","published":"2025-11-06T15:54:14.634Z","updated":"2026-04-28T18:45:00.924Z","title":"WordPress Yogi - Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Yogi - Health Beauty & Yoga","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54711","published":"2025-11-06T15:54:14.029Z","updated":"2026-04-28T16:13:35.837Z","title":"WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Info Cards","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-53586","published":"2025-11-06T15:54:13.387Z","updated":"2026-04-28T16:13:26.988Z","title":"WordPress WeMusic Theme <= 1.9.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"WeMusic","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-53585","published":"2025-11-06T15:54:12.787Z","updated":"2026-04-28T16:13:26.988Z","title":"WordPress WeMusic theme <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"WeMusic","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53574","published":"2025-11-06T15:54:11.607Z","updated":"2026-04-28T16:13:26.623Z","title":"WordPress Doliconnect Plugin <= 9.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ptibogxiv","product":"Doliconnect","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53573","published":"2025-11-06T15:54:10.426Z","updated":"2026-04-28T16:13:26.698Z","title":"WordPress Epic Review Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"jegtheme","product":"Epic Review","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53349","published":"2025-11-06T15:54:06.581Z","updated":"2026-04-28T16:13:24.388Z","title":"WordPress Kalium Theme <= 3.18.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Laborator","product":"Kalium","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53324","published":"2025-11-06T15:54:05.737Z","updated":"2026-04-28T16:13:23.878Z","title":"WordPress Gutenify Plugin <= 1.5.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"CodeYatri","product":"Gutenify","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53316","published":"2025-11-06T15:54:04.995Z","updated":"2026-04-28T16:13:23.568Z","title":"WordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Shahjahan Jewel","product":"WP GDPR Cookie Consent","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-53286","published":"2025-11-06T15:54:04.283Z","updated":"2026-04-28T16:13:22.738Z","title":"WordPress Dropify plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jhainey Milevis","product":"Dropify","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53283","published":"2025-11-06T15:54:03.506Z","updated":"2026-04-28T19:12:29.681Z","title":"WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"borisolhor","product":"Drop Uploader for CF7 - Drag&Drop File Uploader Addon","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-53252","published":"2025-11-06T15:54:02.680Z","updated":"2026-04-28T16:13:21.948Z","title":"WordPress Zegen Theme <= 1.1.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"zozothemes","product":"Zegen","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2025-53246","published":"2025-11-06T15:53:59.915Z","updated":"2026-04-28T16:13:21.803Z","title":"WordPress Backup and Move Plugin <= 0.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gaurav Aggarwal","product":"Backup and Move","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-53245","published":"2025-11-06T15:53:59.391Z","updated":"2026-04-28T16:13:21.814Z","title":"WordPress WP Logo Changer Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Afzal Multani","product":"WP Logo Changer","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53242","published":"2025-11-06T15:53:58.962Z","updated":"2026-04-28T16:13:21.678Z","title":"WordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"VictorThemes","product":"Seil","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-53239","published":"2025-11-06T15:53:58.555Z","updated":"2026-04-28T16:13:21.649Z","title":"WordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"bnovotny","product":"User Registration Aide","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53214","published":"2025-11-06T15:53:58.037Z","updated":"2026-04-28T16:13:20.955Z","title":"WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sertifier","product":"Sertifier Certificate & Badge Maker","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-52773","published":"2025-11-06T15:53:57.496Z","updated":"2026-04-28T16:13:18.702Z","title":"WordPress HieCOR Payment Gateway plugin plugin <= 1.5.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"hiecor","product":"HieCOR Payment Gateway Plugin","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-52764","published":"2025-11-06T15:53:56.937Z","updated":"2026-04-28T16:13:18.627Z","title":"WordPress flexoslider plugin <= 1.0004 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"marielav","product":"flexoslider","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49909","published":"2025-11-06T15:53:56.279Z","updated":"2026-04-28T16:13:07.554Z","title":"WordPress Penci Bookmark & Follow plugin < 2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PenciDesign","product":"Penci Bookmark & Follow","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49905","published":"2025-11-06T15:53:55.700Z","updated":"2026-04-28T16:13:07.390Z","title":"WordPress Range Slider Addon for Gravity Forms plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginsCafe","product":"Range Slider Addon for Gravity Forms","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49904","published":"2025-11-06T15:53:55.162Z","updated":"2026-04-28T16:13:07.311Z","title":"WordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49900","published":"2025-11-06T15:53:54.586Z","updated":"2026-04-28T20:23:31.818Z","title":"WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"Advanced scrollbar","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-49398","published":"2025-11-06T15:53:53.979Z","updated":"2026-04-28T16:13:03.285Z","title":"WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Easy Appointments","product":"Easy Appointments","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-49394","published":"2025-11-06T15:53:53.230Z","updated":"2026-04-28T16:13:03.451Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-49393","published":"2025-11-06T15:53:52.480Z","updated":"2026-04-28T20:23:20.575Z","title":"WordPress Sign-up Sheets Plugin <= 2.3.2 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Fetch Designs","product":"Sign-up Sheets","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2025-49390","published":"2025-11-06T15:53:51.739Z","updated":"2026-04-28T16:13:02.890Z","title":"WordPress Cookie Notice & Consent plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"christophrado","product":"Cookie Notice & Consent","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49386","published":"2025-11-06T15:53:50.934Z","updated":"2026-04-28T16:13:02.847Z","title":"WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"Scott Reilly","product":"Preserve Code Formatting","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-49372","published":"2025-11-06T15:53:50.181Z","updated":"2026-04-28T20:23:00.452Z","title":"WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"VillaTheme","product":"HAPPY","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2025-48330","published":"2025-11-06T15:53:48.806Z","updated":"2026-04-28T16:12:56.387Z","title":"WordPress Real Time Validation for Gravity Forms <= 1.7.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Daman Jeet","product":"Real Time Validation for Gravity Forms","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-48290","published":"2025-11-06T15:53:47.362Z","updated":"2026-04-28T16:12:55.297Z","title":"WordPress Kinsley theme <= 3.4.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"bslthemes","product":"Kinsley","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-48090","published":"2025-11-06T15:53:43.727Z","updated":"2026-04-28T16:12:50.352Z","title":"WordPress Blanka - One Page WordPress Theme Theme < 1.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Blanka - One Page WordPress Theme","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2025-48089","published":"2025-11-06T15:53:43.152Z","updated":"2026-04-28T16:12:50.490Z","title":"WordPress Education WordPress Theme | HiStudy theme < 3.1.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Rainbow-Themes","product":"Education WordPress Theme | HiStudy","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-48086","published":"2025-11-06T15:53:42.585Z","updated":"2026-04-28T16:12:50.464Z","title":"WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability","severity":"MEDIUM","score":5.5,"vendor":"wpdreams","product":"Ajax Search Lite","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-48085","published":"2025-11-06T15:53:41.777Z","updated":"2026-04-28T16:12:50.555Z","title":"WordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ZIPANG","product":"Simple Stripe","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48083","published":"2025-11-06T15:53:40.546Z","updated":"2026-04-28T16:12:50.381Z","title":"WordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"andriassundskard","product":"wpNamedUsers","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48078","published":"2025-11-06T15:53:37.443Z","updated":"2026-04-28T16:12:50.473Z","title":"WordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Norbert","product":"Slick Google Map","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48077","published":"2025-11-06T15:53:36.642Z","updated":"2026-04-28T16:12:50.225Z","title":"WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"nitinmaurya12","product":"Block Country","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-47588","published":"2025-11-06T15:53:35.904Z","updated":"2026-04-28T16:12:46.488Z","title":"WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9.1,"vendor":"acowebs","product":"Dynamic Pricing With Discount Rules for WooCommerce","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-39468","published":"2025-11-06T15:53:34.539Z","updated":"2026-04-28T16:12:32.189Z","title":"WordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"pantherius","product":"Modal Survey","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2025-39467","published":"2025-11-06T15:53:33.195Z","updated":"2026-11-03T22:03:00.369Z","title":"WordPress Wanderland theme <= 1.7.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Wanderland","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2025-39466","published":"2025-11-06T15:53:30.016Z","updated":"2026-04-28T16:12:32.128Z","title":"WordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Dør","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2025-39465","published":"2025-11-06T15:53:29.145Z","updated":"2026-04-28T16:12:32.101Z","title":"WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"flippercode","product":"Advanced Google Maps","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-39463","published":"2025-11-06T15:53:23.424Z","updated":"2026-04-28T16:12:32.181Z","title":"WordPress Dessau theme < 1.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Select-Themes","product":"Dessau","kev":false,"epss":0.00614,"kevAdded":null},{"id":"CVE-2025-32222","published":"2025-11-06T15:53:22.717Z","updated":"2026-04-28T16:12:19.234Z","title":"WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Widgetlogic.org","product":"Widget Logic","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2025-31029","published":"2025-11-06T15:53:19.694Z","updated":"2026-04-28T16:12:03.896Z","title":"WordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"bingu","product":"replyMail","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-28953","published":"2025-11-06T15:53:18.852Z","updated":"2026-04-28T16:11:51.735Z","title":"WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"axiomthemes","product":"smart SEO","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-22288","published":"2025-11-06T15:53:18.126Z","updated":"2026-04-28T19:38:18.746Z","title":"WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability","severity":"MEDIUM","score":4.1,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"Smush Image Compression and Optimization","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-64294","published":"2025-11-03T13:09:39.398Z","updated":"2026-04-28T16:14:14.122Z","title":"WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"d3wp","product":"WP Snow Effect","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-64368","published":"2025-10-31T11:42:40.843Z","updated":"2026-04-28T16:14:14.723Z","title":"WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mikado-Themes","product":"Bard","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-64367","published":"2025-10-31T11:42:40.076Z","updated":"2026-04-28T18:31:38.734Z","title":"WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64366","published":"2025-10-31T11:42:39.301Z","updated":"2026-04-28T16:14:14.541Z","title":"WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-64365","published":"2025-10-31T11:42:38.588Z","updated":"2026-04-28T18:31:28.580Z","title":"WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"colabrio","product":"Ohio Extra","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64364","published":"2025-10-31T11:42:37.865Z","updated":"2026-04-28T18:31:19.613Z","title":"WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Masterstudy","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-64363","published":"2025-10-31T11:42:37.131Z","updated":"2026-04-28T18:31:10.075Z","title":"WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"SeventhQueen","product":"Kleo","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-64362","published":"2025-10-31T11:42:36.419Z","updated":"2026-04-28T18:31:00.269Z","title":"WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SeventhQueen","product":"K Elements","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64361","published":"2025-10-31T11:42:33.072Z","updated":"2026-04-28T18:30:50.689Z","title":"WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"Consulting Elementor Widgets","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64360","published":"2025-10-31T11:42:32.330Z","updated":"2026-04-28T16:14:14.317Z","title":"WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Consulting Elementor Widgets","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-64359","published":"2025-10-31T11:42:31.602Z","updated":"2026-04-28T16:14:14.316Z","title":"WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Consulting","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-64358","published":"2025-10-31T11:42:28.439Z","updated":"2026-04-28T16:14:14.291Z","title":"WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Smart Coupons for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-64357","published":"2025-10-31T11:42:27.627Z","updated":"2026-04-28T16:14:14.298Z","title":"WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Younes JFR.","product":"Advanced Database Cleaner","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64356","published":"2025-10-31T11:42:26.908Z","updated":"2026-04-28T18:30:41.150Z","title":"WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"f1logic","product":"Insert PHP Code Snippet","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-64354","published":"2025-10-31T11:42:26.178Z","updated":"2026-04-28T18:30:31.590Z","title":"WordPress Gutenberg plugin <= 21.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Matias Ventura","product":"Gutenberg","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64353","published":"2025-10-31T11:42:25.417Z","updated":"2026-04-28T18:30:21.297Z","title":"WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"Chouby","product":"Polylang","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-64352","published":"2025-10-31T11:42:23.045Z","updated":"2026-04-28T16:14:14.117Z","title":"WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability","severity":"LOW","score":2.7,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-64351","published":"2025-10-31T11:42:22.226Z","updated":"2026-04-28T18:30:11.716Z","title":"WordPress Rank Math SEO plugin <= 1.0.252.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-64350","published":"2025-10-31T11:42:17.908Z","updated":"2026-04-28T16:14:14.069Z","title":"WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability","severity":"LOW","score":3.8,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-64291","published":"2025-10-29T08:38:15.757Z","updated":"2026-04-28T18:30:00.996Z","title":"WordPress Premmerce User Roles plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Premmerce","product":"Premmerce User Roles","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-64290","published":"2025-10-29T08:38:15.299Z","updated":"2026-04-28T16:14:13.796Z","title":"WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Premmerce","product":"Premmerce Product Search for WooCommerce","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64289","published":"2025-10-29T08:38:14.838Z","updated":"2026-09-25T10:08:42.536Z","title":"WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Premmerce","product":"Premmerce Product Search for WooCommerce","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-64288","published":"2025-10-29T08:38:14.400Z","updated":"2026-04-28T16:14:13.438Z","title":"WordPress Premmerce plugin <= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Premmerce","product":"Premmerce","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64286","published":"2025-10-29T08:38:13.920Z","updated":"2026-04-28T16:14:13.350Z","title":"WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WpEstate","product":"WP Rentals","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64285","published":"2025-10-29T08:38:13.449Z","updated":"2026-04-28T16:14:13.480Z","title":"WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Premmerce","product":"Premmerce Wholesale Pricing for WooCommerce","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-64284","published":"2025-10-29T08:38:12.876Z","updated":"2026-04-28T18:29:41.129Z","title":"WordPress Majestic Support plugin <= 1.0.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-64283","published":"2025-10-29T08:38:12.413Z","updated":"2026-04-28T18:29:31.518Z","title":"WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rometheme","product":"RTMKit","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-64234","published":"2025-10-29T08:38:11.964Z","updated":"2026-04-28T16:14:11.576Z","title":"WordPress Evergreen Content Poster plugin <= 1.4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Evergreen Content Poster","product":"Evergreen Content Poster","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-64229","published":"2025-10-29T08:38:11.498Z","updated":"2026-04-28T18:26:50.524Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-64228","published":"2025-10-29T08:38:11.052Z","updated":"2026-04-28T18:26:41.184Z","title":"WordPress SUMO Affiliates Pro plugin <= 11.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"FantasticPlugins","product":"SUMO Affiliates Pro","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-64226","published":"2025-10-29T08:38:10.612Z","updated":"2026-04-28T16:14:11.548Z","title":"WordPress Stockie Extra plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"colabrio","product":"Stockie Extra","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64220","published":"2025-10-29T08:38:10.174Z","updated":"2026-04-28T18:25:56.042Z","title":"WordPress Rey Core plugin <= 3.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ReyCommerce","product":"Rey Core","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64219","published":"2025-10-29T08:38:09.728Z","updated":"2026-04-28T18:25:46.090Z","title":"WordPress Business Directory plugin <= 6.4.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-64216","published":"2025-10-29T08:38:09.280Z","updated":"2026-04-28T18:25:27.384Z","title":"WordPress SmartMag theme <= 10.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeSphere","product":"SmartMag","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-64212","published":"2025-10-29T08:38:08.827Z","updated":"2026-04-28T16:14:10.893Z","title":"WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StylemixThemes","product":"MasterStudy LMS Pro","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-64211","published":"2025-10-29T08:38:08.406Z","updated":"2026-04-28T16:14:10.863Z","title":"WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"StylemixThemes","product":"Masterstudy Elementor Widgets","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-64210","published":"2025-10-29T08:38:07.975Z","updated":"2026-04-28T18:25:08.908Z","title":"WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StylemixThemes","product":"Masterstudy Elementor Widgets","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-64208","published":"2025-10-29T08:38:07.521Z","updated":"2026-04-28T18:24:48.816Z","title":"WordPress Jannah - Extensions plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TieLabs","product":"Jannah - Extensions","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64204","published":"2025-10-29T08:38:07.091Z","updated":"2026-04-28T18:24:22.268Z","title":"WordPress SmartMag theme <= 10.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeSphere","product":"SmartMag","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64202","published":"2025-10-29T08:38:06.577Z","updated":"2026-04-28T18:24:03.818Z","title":"WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TieLabs","product":"Sahifa","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64201","published":"2025-10-29T08:38:06.132Z","updated":"2026-04-28T16:14:10.739Z","title":"WordPress PowerPress Podcasting plugin <= 11.13.12 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-64200","published":"2025-10-29T08:38:05.654Z","updated":"2026-04-28T18:23:55.418Z","title":"WordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"VillaTheme","product":"Email Template Customizer for WooCommerce","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-64199","published":"2025-10-29T08:38:05.202Z","updated":"2026-04-28T16:14:10.720Z","title":"WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WpEstate","product":"wpresidence","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-64197","published":"2025-10-29T08:38:04.636Z","updated":"2026-04-28T18:23:38.203Z","title":"WordPress Rehub theme < 19.9.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sizam","product":"Rehub","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-64195","published":"2025-10-29T08:38:04.034Z","updated":"2026-04-28T18:23:21.298Z","title":"WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"Eduma","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-64194","published":"2025-10-29T08:38:03.614Z","updated":"2026-04-28T18:23:12.935Z","title":"WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThimPress","product":"Eduma","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-60075","published":"2025-10-29T08:38:03.170Z","updated":"2026-04-28T18:36:35.534Z","title":"WordPress hpb seo plugin for WordPress plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Allegro Marketing","product":"hpb seo plugin for WordPress","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58939","published":"2025-10-29T08:38:02.625Z","updated":"2026-04-28T16:13:50.006Z","title":"WordPress Super Store Finder plugin <= 7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58711","published":"2025-10-29T08:38:01.894Z","updated":"2026-04-28T16:13:46.843Z","title":"WordPress Blog Designer PRO plugin <= 3.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"solwin","product":"Blog Designer PRO","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-49042","published":"2025-10-29T04:50:12.507Z","updated":"2026-04-28T16:12:58.197Z","title":"WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-64296","published":"2025-10-29T04:08:45.858Z","updated":"2026-04-28T16:14:14.183Z","title":"WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Facebook","product":"Facebook for WooCommerce","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-57931","published":"2025-10-29T04:02:09.962Z","updated":"2026-04-28T16:13:38.812Z","title":"WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Popup box","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-48088","published":"2025-10-27T02:09:52.224Z","updated":"2026-04-28T16:12:50.403Z","title":"WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm_Force","product":"Ultimate Addons for WPBakery Page Builder","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-58918","published":"2025-10-27T02:07:49.744Z","updated":"2026-04-28T16:13:49.430Z","title":"WordPress Entrada theme <= 5.7.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Waituk","product":"Entrada","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-62988","published":"2025-10-27T01:34:22.355Z","updated":"2026-04-28T16:14:07.658Z","title":"WordPress Slider Templates plugin <= 1.0.3 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Codeless","product":"Slider Templates","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-62987","published":"2025-10-27T01:34:21.954Z","updated":"2026-04-28T19:00:30.568Z","title":"WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Builderall","product":"Builderall Builder for WordPress","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62986","published":"2025-10-27T01:34:21.481Z","updated":"2026-04-28T19:00:21.594Z","title":"WordPress FanBridge signup plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"FanBridge","product":"FanBridge signup","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2025-62985","published":"2025-10-27T01:34:21.085Z","updated":"2026-04-28T19:00:10.863Z","title":"WordPress Simple Pull Quote plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"llamaman","product":"Simple Pull Quote","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62984","published":"2025-10-27T01:34:20.717Z","updated":"2026-04-28T19:00:06.727Z","title":"WordPress WP AdCenter plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPeka","product":"WP AdCenter","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62983","published":"2025-10-27T01:34:20.337Z","updated":"2026-04-28T18:59:50.209Z","title":"WordPress Posts By Tag plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sudar Muthu","product":"Posts By Tag","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62982","published":"2025-10-27T01:34:19.955Z","updated":"2026-04-28T16:14:07.590Z","title":"WordPress Dynamic User Directory plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-62981","published":"2025-10-27T01:34:19.548Z","updated":"2026-04-28T16:14:07.491Z","title":"WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.8 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Zoho CRM and Bigin","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-62980","published":"2025-10-27T01:34:19.046Z","updated":"2026-04-28T16:14:07.354Z","title":"WordPress Persian Admnin Fonts plugin <= 4.1.03 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"MDZ","product":"Persian Admnin Fonts","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-62979","published":"2025-10-27T01:34:18.671Z","updated":"2026-04-28T18:59:41.155Z","title":"WordPress ACF to REST API plugin <= 3.3.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"airesvsg","product":"ACF to REST API","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-62978","published":"2025-10-27T01:34:18.281Z","updated":"2026-04-28T16:14:07.235Z","title":"WordPress KiotViet Sync plugin <= 1.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kiotviet","product":"KiotViet Sync","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-62977","published":"2025-10-27T01:34:17.906Z","updated":"2026-04-28T16:14:07.507Z","title":"WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"沃之涛","product":"百度站长SEO合集(支持百度/神马/Bing/头条推送)","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-62976","published":"2025-10-27T01:34:17.528Z","updated":"2026-04-28T16:14:07.360Z","title":"WordPress Sendle Shipping plugin <= 6.02 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Joovii","product":"Sendle Shipping","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-62975","published":"2025-10-27T01:34:17.146Z","updated":"2026-04-28T16:14:07.319Z","title":"WordPress Raychat plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"raychat","product":"Raychat","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-62974","published":"2025-10-27T01:34:16.779Z","updated":"2026-04-28T18:59:30.923Z","title":"WordPress Headline Analyzer plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CoSchedule","product":"Headline Analyzer","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62973","published":"2025-10-27T01:34:16.394Z","updated":"2026-10-07T07:43:10.912Z","title":"WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themekraft","product":"BuddyForms","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-62972","published":"2025-10-27T01:34:16.018Z","updated":"2026-04-28T16:14:07.261Z","title":"WordPress WebinarPress plugin <= 1.33.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPWebinarSystem","product":"WebinarPress","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-62971","published":"2025-10-27T01:34:15.629Z","updated":"2026-04-28T18:59:09.361Z","title":"WordPress Attesa Extra plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CrestaProject","product":"Attesa Extra","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62970","published":"2025-10-27T01:34:15.242Z","updated":"2026-04-28T16:14:07.237Z","title":"WordPress Link Whisper Free plugin <= 0.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spencer Haws","product":"Link Whisper Free","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-62969","published":"2025-10-27T01:34:14.860Z","updated":"2026-04-28T18:58:58.984Z","title":"WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"XLPlugins","product":"NextMove Lite","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62968","published":"2025-10-27T01:34:14.465Z","updated":"2026-04-28T18:58:48.262Z","title":"WordPress WP Last Modified Info plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sayan Datta","product":"WP Last Modified Info","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62967","published":"2025-10-27T01:34:14.079Z","updated":"2026-04-28T18:58:36.202Z","title":"WordPress DirectoryPress plugin <= 3.6.25 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-62966","published":"2025-10-27T01:34:13.698Z","updated":"2026-04-28T16:14:07.238Z","title":"WordPress GoCache plugin <= 1.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Apiki","product":"GoCache","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-62965","published":"2025-10-27T01:34:13.305Z","updated":"2026-04-28T16:14:07.184Z","title":"WordPress Admin Management Xtended  plugin <= 2.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpseek","product":"Admin Management Xtended","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-62964","published":"2025-10-27T01:34:12.925Z","updated":"2026-04-28T16:14:07.140Z","title":"WordPress MDTF plugin <= 1.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RealMag777","product":"MDTF","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-62963","published":"2025-10-27T01:34:12.534Z","updated":"2026-04-28T16:14:07.147Z","title":"WordPress Estatik plugin <= 4.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62962","published":"2025-10-27T01:34:12.156Z","updated":"2026-04-28T16:14:07.027Z","title":"WordPress CloudSearch plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Andrea Landonio","product":"CloudSearch","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-62959","published":"2025-10-27T01:34:11.771Z","updated":"2026-04-28T18:58:25.836Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"videowhisper","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-62958","published":"2025-10-27T01:34:11.386Z","updated":"2026-04-28T18:58:15.148Z","title":"WordPress Simple Content Templates for Blog Posts & Pages plugin <= 2.2.61 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Clifton Griffin","product":"Simple Content Templates for Blog Posts & Pages","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-62957","published":"2025-10-27T01:34:10.997Z","updated":"2026-04-28T16:14:06.945Z","title":"WordPress NikanWP WooCommerce Reporting plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"NikanWP","product":"NikanWP WooCommerce Reporting","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-62956","published":"2025-10-27T01:34:10.627Z","updated":"2026-04-28T16:14:06.943Z","title":"WordPress Reloadly plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"iseremet","product":"Reloadly","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-62954","published":"2025-10-27T01:34:10.251Z","updated":"2026-04-28T16:14:06.941Z","title":"WordPress Revive Old Posts plugin <= 9.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rsocial","product":"Revive Old Posts","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62953","published":"2025-10-27T01:34:09.846Z","updated":"2026-04-28T16:14:07.022Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62952","published":"2025-10-27T01:34:09.465Z","updated":"2026-04-28T16:14:06.931Z","title":"WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62951","published":"2025-10-27T01:34:09.049Z","updated":"2026-04-28T18:58:05.674Z","title":"WordPress H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"icc0rz","product":"H5P","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62949","published":"2025-10-27T01:34:08.667Z","updated":"2026-04-28T18:57:55.209Z","title":"WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BuddyDev","product":"Activity Plus Reloaded for BuddyPress","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62948","published":"2025-10-27T01:34:08.293Z","updated":"2026-04-28T18:57:45.389Z","title":"WordPress Date counter plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Konstantin Pankratov","product":"Date counter","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62947","published":"2025-10-27T01:34:07.905Z","updated":"2026-04-28T16:14:06.820Z","title":"WordPress Publitio plugin <= 2.2.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5,"vendor":"publitio","product":"Publitio","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-62946","published":"2025-10-27T01:34:07.532Z","updated":"2026-04-28T16:14:06.740Z","title":"WordPress Everest Backup plugin <= 2.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-62945","published":"2025-10-27T01:34:07.137Z","updated":"2026-04-28T16:14:06.884Z","title":"WordPress Did Prestashop Display plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Eduard Pinuaga Linares","product":"Did Prestashop Display","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-62944","published":"2025-10-27T01:34:06.759Z","updated":"2026-04-28T16:14:06.710Z","title":"WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mark O'Donnell","product":"MSTW CSV EXPORTER","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-62943","published":"2025-10-27T01:34:06.378Z","updated":"2026-04-28T16:14:06.874Z","title":"WordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Matt McInvale","product":"Next Page, Not Next Post","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62942","published":"2025-10-27T01:34:05.970Z","updated":"2026-04-28T16:14:06.644Z","title":"WordPress WP Mapbox GL JS Maps plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tempranova","product":"WP Mapbox GL JS Maps","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62941","published":"2025-10-27T01:34:05.575Z","updated":"2026-04-28T16:14:06.536Z","title":"WordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dFactory","product":"Events Maker by dFactory","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62940","published":"2025-10-27T01:34:05.124Z","updated":"2026-04-28T16:14:06.531Z","title":"WordPress Blox Lite plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nick Diego","product":"Blox Lite","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62939","published":"2025-10-27T01:34:04.735Z","updated":"2026-04-28T16:14:06.406Z","title":"WordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Joe","product":"Open Currency Converter","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62938","published":"2025-10-27T01:34:04.368Z","updated":"2026-04-28T16:14:06.340Z","title":"WordPress Reoon Email Verifier plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Reoon Technology","product":"Reoon Email Verifier","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-62937","published":"2025-10-27T01:34:03.973Z","updated":"2026-04-28T16:14:06.342Z","title":"WordPress Post List Featured Image plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Johnny","product":"Post List Featured Image","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62936","published":"2025-10-27T01:34:03.605Z","updated":"2026-04-28T16:14:06.370Z","title":"WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jthemes","product":"xSmart","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-62935","published":"2025-10-27T01:34:03.234Z","updated":"2026-04-28T16:14:06.370Z","title":"WordPress Open Close WooCommerce Store plugin <= 5.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StackWC","product":"Open Close WooCommerce Store","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-62934","published":"2025-10-27T01:34:02.856Z","updated":"2026-04-28T16:14:06.364Z","title":"WordPress WP Business Hours plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mejar","product":"WP Business Hours","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-62933","published":"2025-10-27T01:34:02.471Z","updated":"2026-04-28T16:14:06.357Z","title":"WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Prakash","product":"Awesome Testimonials","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-62932","published":"2025-10-27T01:34:02.004Z","updated":"2026-04-28T16:14:06.333Z","title":"WordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wprio","product":"Table Block by RioVizual","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-62931","published":"2025-10-27T01:34:01.473Z","updated":"2026-04-28T16:14:06.367Z","title":"WordPress MSN Partner Hub plugin <= 2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"microsoftstart","product":"MSN Partner Hub","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-62930","published":"2025-10-27T01:34:01.039Z","updated":"2026-04-28T16:14:06.257Z","title":"WordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62929","published":"2025-10-27T01:34:00.648Z","updated":"2026-04-28T16:14:06.020Z","title":"WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Testimonial Slider","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-62928","published":"2025-10-27T01:34:00.000Z","updated":"2026-04-28T16:14:06.256Z","title":"WordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Joby Joseph","product":"SEO Meta Description Updater","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2025-62927","published":"2025-10-27T01:33:59.620Z","updated":"2026-04-28T16:14:06.286Z","title":"WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nelio Software","product":"Nelio Content","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-62925","published":"2025-10-27T01:33:59.236Z","updated":"2026-04-28T16:14:06.183Z","title":"WordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Conversios","product":"Conversios.io","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-62924","published":"2025-10-27T01:33:58.866Z","updated":"2026-04-28T18:57:34.749Z","title":"WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Post Grid and Gutenberg Blocks","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-62923","published":"2025-10-27T01:33:58.486Z","updated":"2026-04-28T16:14:06.132Z","title":"WordPress Marquee Addons for Elementor plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Debuggers Studio","product":"Marquee Addons for Elementor","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62922","published":"2025-10-27T01:33:58.086Z","updated":"2026-04-28T16:14:06.028Z","title":"WordPress Export Categories plugin <= 1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shambhu Patnaik","product":"Export Categories","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-62921","published":"2025-10-27T01:33:57.675Z","updated":"2026-04-28T18:57:26.234Z","title":"WordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pagup","product":"Bulk Auto Image Title Attribute","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62920","published":"2025-10-27T01:33:57.278Z","updated":"2026-04-28T16:14:05.732Z","title":"WordPress USERCENTRICS CMP plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"webnique","product":"USERCENTRICS CMP","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-62919","published":"2025-10-27T01:33:56.876Z","updated":"2026-04-28T16:14:06.187Z","title":"WordPress TS Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"themeshopy","product":"TS Demo Importer","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-62918","published":"2025-10-27T01:33:56.477Z","updated":"2026-04-28T16:14:06.015Z","title":"WordPress IgnitionDeck plugin <= 2.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ignitionwp","product":"IgnitionDeck","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-62917","published":"2025-10-27T01:33:56.091Z","updated":"2026-04-28T16:14:05.764Z","title":"WordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jamel.Z","product":"Tooltipy","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62916","published":"2025-10-27T01:33:55.688Z","updated":"2026-04-28T16:14:05.328Z","title":"WordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Travon WP","product":"Flights & Hotels Booking WP Plugin","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-62915","published":"2025-10-27T01:33:55.284Z","updated":"2026-11-03T22:03:07.306Z","title":"WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"clicksend","product":"SMS Contact Form 7 Notifications by ClickSend","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2025-62913","published":"2025-10-27T01:33:54.900Z","updated":"2026-04-28T16:14:05.634Z","title":"WordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpopal","product":"Opal Service","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62912","published":"2025-10-27T01:33:54.526Z","updated":"2026-04-28T16:14:05.753Z","title":"WordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SiteGround","product":"SiteGround Email Marketing","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62911","published":"2025-10-27T01:33:54.127Z","updated":"2026-04-28T16:14:05.684Z","title":"WordPress Rock Convert plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rock Content","product":"Rock Convert","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62910","published":"2025-10-27T01:33:53.748Z","updated":"2026-04-28T16:14:05.552Z","title":"WordPress Video Gallery by Huzzaz plugin <= 10.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"deshine","product":"Video Gallery by Huzzaz","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62909","published":"2025-10-27T01:33:53.355Z","updated":"2026-04-28T16:14:05.800Z","title":"WordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"mrityunjay","product":"Smart WeTransfer","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-62907","published":"2025-10-27T01:33:52.564Z","updated":"2026-04-28T16:14:05.701Z","title":"WordPress Custom Post Type Attachment plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aviplugins.com","product":"Custom Post Type Attachment","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-62906","published":"2025-10-27T01:33:52.110Z","updated":"2026-04-28T16:14:05.320Z","title":"WordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"epiphanyit321","product":"Referral Link Tracker","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-62905","published":"2025-10-27T01:33:51.717Z","updated":"2026-04-28T16:14:05.307Z","title":"WordPress Query Posts plugin <= 0.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Justin Tadlock","product":"Query Posts","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62904","published":"2025-10-27T01:33:51.339Z","updated":"2026-04-28T16:14:05.324Z","title":"WordPress WP Geo plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ben Huson","product":"WP Geo","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62903","published":"2025-10-27T01:33:50.952Z","updated":"2026-04-28T16:14:05.070Z","title":"WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPClever","product":"WPC Smart Messages for WooCommerce","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62902","published":"2025-10-27T01:33:50.531Z","updated":"2026-04-28T16:14:05.156Z","title":"WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeHunk","product":"WP Popup Builder","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-62900","published":"2025-10-27T01:33:50.140Z","updated":"2026-04-28T16:14:04.995Z","title":"WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WeblineIndia","product":"Popular Posts by Webline","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62899","published":"2025-10-27T01:33:49.758Z","updated":"2026-04-28T16:14:05.019Z","title":"WordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"THRIVE - Web Design Gold Coast","product":"Photospace Responsive","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-62898","published":"2025-10-27T01:33:49.376Z","updated":"2026-04-28T16:14:04.996Z","title":"WordPress Links shortcode plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Maarten","product":"Links shortcode","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62897","published":"2025-10-27T01:33:49.016Z","updated":"2026-04-28T16:14:04.976Z","title":"WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brecht","product":"WP Recipe Maker","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-62896","published":"2025-10-27T01:33:48.644Z","updated":"2026-04-28T16:14:04.986Z","title":"WordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"digitaldonkey","product":"Multilang Contact Form","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-62895","published":"2025-10-27T01:33:48.249Z","updated":"2026-04-28T16:14:05.019Z","title":"WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Vito Peleg","product":"Atarim","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-62894","published":"2025-10-27T01:33:47.856Z","updated":"2026-04-28T16:14:04.987Z","title":"WordPress ACF Recent Posts Widget plugin <= 5.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magicoders","product":"ACF Recent Posts Widget","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62892","published":"2025-10-27T01:33:47.085Z","updated":"2026-04-28T16:14:04.987Z","title":"WordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-62891","published":"2025-10-27T01:33:46.691Z","updated":"2026-04-28T16:14:05.002Z","title":"WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jory Hogeveen","product":"Off-Canvas Sidebars & Menus (Slidebars)","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-62890","published":"2025-10-27T01:33:46.308Z","updated":"2026-04-28T16:14:04.894Z","title":"WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Premmerce","product":"Premmerce Brands for WooCommerce","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-62889","published":"2025-10-27T01:33:45.909Z","updated":"2026-04-28T16:14:04.955Z","title":"WordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-62887","published":"2025-10-27T01:33:45.420Z","updated":"2026-04-28T16:14:04.978Z","title":"WordPress King Addons for Elementor plugin <= 51.1.61 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62886","published":"2025-10-27T01:33:44.741Z","updated":"2026-04-28T16:14:04.919Z","title":"WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdevart","product":"Pricing Table builder","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-62885","published":"2025-10-27T01:33:44.357Z","updated":"2026-04-28T18:57:15.581Z","title":"WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RexTheme","product":"WP VR","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-62884","published":"2025-10-27T01:33:43.969Z","updated":"2026-04-28T16:14:04.926Z","title":"WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Elliot Sowersby / RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-62883","published":"2025-10-27T01:33:43.581Z","updated":"2026-04-28T18:57:06.577Z","title":"WordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Premmerce","product":"Premmerce User Roles","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-62882","published":"2025-10-27T01:33:43.191Z","updated":"2026-04-28T16:14:04.807Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62881","published":"2025-10-27T01:33:42.812Z","updated":"2026-04-28T16:14:04.620Z","title":"WordPress WP-Lister Lite for eBay plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Lab","product":"WP-Lister Lite for eBay","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-62868","published":"2025-10-24T07:52:58.711Z","updated":"2026-04-28T16:14:04.331Z","title":"WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Edge CPT","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-62073","published":"2025-10-22T14:32:54.713Z","updated":"2026-04-28T16:14:00.850Z","title":"WordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sovlix","product":"MeetingHub","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-62072","published":"2025-10-22T14:32:54.422Z","updated":"2026-04-28T16:14:01.011Z","title":"WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rustaurius","product":"Front End Users","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-62071","published":"2025-10-22T14:32:54.166Z","updated":"2026-04-28T16:14:00.904Z","title":"WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Repuso","product":"Social proof testimonials and reviews by Repuso","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-62070","published":"2025-10-22T14:32:53.947Z","updated":"2026-04-28T16:14:00.829Z","title":"WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPXPO","product":"WowRevenue","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-62069","published":"2025-10-22T14:32:53.749Z","updated":"2026-04-28T18:53:08.328Z","title":"WordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"MDTF","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62068","published":"2025-10-22T14:32:53.513Z","updated":"2026-04-28T18:52:57.495Z","title":"WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"E2Pdf","product":"e2pdf","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62063","published":"2025-10-22T14:32:53.303Z","updated":"2026-04-28T18:52:28.772Z","title":"WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Travel","product":"WP Travel Gutenberg Blocks","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62062","published":"2025-10-22T14:32:53.065Z","updated":"2026-04-28T16:14:00.221Z","title":"WordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeRuby","product":"Easy Post Submission","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-62061","published":"2025-10-22T14:32:52.854Z","updated":"2026-04-28T16:14:00.105Z","title":"WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"impleCode","product":"Product Catalog Simple","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-62060","published":"2025-10-22T14:32:52.503Z","updated":"2026-04-28T18:52:19.785Z","title":"WordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Tab Ultimate","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62058","published":"2025-10-22T14:32:52.269Z","updated":"2026-04-28T18:52:01.727Z","title":"WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"favethemes","product":"Houzez Theme - Functionality","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62054","published":"2025-10-22T14:32:52.067Z","updated":"2026-04-28T18:51:33.485Z","title":"WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"favethemes","product":"Houzez Theme - Functionality","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-62052","published":"2025-10-22T14:32:51.853Z","updated":"2026-04-28T16:14:00.231Z","title":"WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Horea Radu","product":"One Page Express Companion","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-62048","published":"2025-10-22T14:32:51.617Z","updated":"2026-04-28T16:14:00.073Z","title":"WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPMU DEV - Your All-in-One WordPress Platform","product":"SmartCrawl","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-62042","published":"2025-10-22T14:32:51.413Z","updated":"2026-04-28T18:50:43.578Z","title":"WordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bastien Ho","product":"Event post","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-62029","published":"2025-10-22T14:32:51.220Z","updated":"2026-04-28T18:48:59.485Z","title":"WordPress Grevo theme <= 2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"themesion","product":"Grevo","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-62027","published":"2025-10-22T14:32:51.014Z","updated":"2026-04-28T18:48:49.487Z","title":"WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StellarWP","product":"Event Tickets","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-62026","published":"2025-10-22T14:32:50.799Z","updated":"2026-04-28T18:48:28.533Z","title":"WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Blockspare","product":"Blockspare","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-62025","published":"2025-10-22T14:32:50.582Z","updated":"2026-04-28T18:48:19.539Z","title":"WordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-62024","published":"2025-10-22T14:32:50.360Z","updated":"2026-04-28T18:48:10.544Z","title":"WordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jonathan Jernigan","product":"Pie Calendar","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-62023","published":"2025-10-22T14:32:50.026Z","updated":"2026-09-29T06:48:02.803Z","title":"WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9,"vendor":"Cristián Lávaque","product":"s2Member","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-62022","published":"2025-10-22T14:32:49.815Z","updated":"2026-04-28T18:47:51.400Z","title":"WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-62021","published":"2025-10-22T14:32:49.606Z","updated":"2026-04-28T16:13:59.249Z","title":"WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Made Neat","product":"Acknowledgify","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-62020","published":"2025-10-22T14:32:49.407Z","updated":"2026-04-28T18:47:41.781Z","title":"WordPress VOD Infomaniak plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-62019","published":"2025-10-22T14:32:49.208Z","updated":"2026-04-28T18:47:31.829Z","title":"WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPZOOM","product":"Recipe Card Blocks for Gutenberg & Elementor","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-62015","published":"2025-10-22T14:32:49.014Z","updated":"2026-04-28T16:13:58.949Z","title":"WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.6.8 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Josh Kohlbach","product":"Advanced Coupons for WooCommerce Coupons","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-62013","published":"2025-10-22T14:32:48.799Z","updated":"2026-04-28T16:13:59.034Z","title":"WordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"POSIMYTH","product":"UiChemy","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2025-62009","published":"2025-10-22T14:32:48.527Z","updated":"2026-04-28T16:13:58.919Z","title":"WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"UPC/EAN/GTIN Code Generator","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-62008","published":"2025-10-22T14:32:48.273Z","updated":"2026-04-28T18:46:36.221Z","title":"WordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"acowebs","product":"Product Table For WooCommerce","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2025-62007","published":"2025-10-22T14:32:47.880Z","updated":"2026-04-28T18:46:27.269Z","title":"WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"bPlugins","product":"Voice Feedback","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-62006","published":"2025-10-22T14:32:47.684Z","updated":"2026-04-28T16:13:58.994Z","title":"WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VeronaLabs","product":"WP SMS","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-62005","published":"2025-10-22T14:32:47.453Z","updated":"2026-04-28T16:13:58.328Z","title":"WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"FantasticPlugins","product":"SUMO Memberships for WooCommerce","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-60246","published":"2025-10-22T14:32:47.237Z","updated":"2026-04-28T18:44:33.502Z","title":"WordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weissmike","product":"Simple Finance Calculator","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-60238","published":"2025-10-22T14:32:47.058Z","updated":"2026-04-28T16:13:58.544Z","title":"WordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"universam","product":"UNIVERSAM","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60234","published":"2025-10-22T14:32:46.860Z","updated":"2026-04-28T18:43:29.160Z","title":"WordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Single Property","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-60232","published":"2025-10-22T14:32:46.670Z","updated":"2026-04-28T18:43:20.002Z","title":"WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"quantumcloud","product":"KBx Pro Ultimate","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60228","published":"2025-10-22T14:32:46.487Z","updated":"2026-04-28T18:43:09.987Z","title":"WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Knowledge Base","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-60227","published":"2025-10-22T14:32:46.277Z","updated":"2026-04-28T16:13:58.105Z","title":"WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-60226","published":"2025-10-22T14:32:46.090Z","updated":"2026-04-28T18:43:00.651Z","title":"WordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"White Rabbit","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60225","published":"2025-10-22T14:32:45.876Z","updated":"2026-04-28T18:42:51.595Z","title":"WordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"BugsPatrol","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-60224","published":"2025-10-22T14:32:45.675Z","updated":"2026-04-28T18:42:42.648Z","title":"WordPress Subscribe to Download plugin <= 2.0.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpshuffle","product":"Subscribe to Download","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60222","published":"2025-10-22T14:32:45.465Z","updated":"2026-04-28T18:42:32.911Z","title":"WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"FantasticPlugins","product":"SUMO Memberships for WooCommerce","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-60221","published":"2025-10-22T14:32:45.187Z","updated":"2026-04-28T18:42:23.343Z","title":"WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"captivateaudio","product":"Captivate Sync","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60220","published":"2025-10-22T14:32:44.897Z","updated":"2026-04-28T18:42:14.027Z","title":"WordPress CouponXxL theme <= 3.0.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"pebas","product":"CouponXxL","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2025-60217","published":"2025-10-22T14:32:44.691Z","updated":"2026-04-28T16:13:57.867Z","title":"WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"ypromo","product":"PT Luxa Addons","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-60216","published":"2025-10-22T14:32:44.405Z","updated":"2026-04-28T18:42:04.604Z","title":"WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Addison","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60215","published":"2025-10-22T14:32:44.186Z","updated":"2026-04-28T18:41:55.101Z","title":"WordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Kriya","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-60214","published":"2025-10-22T14:32:44.013Z","updated":"2026-04-28T18:41:44.825Z","title":"WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Goldenblatt","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2025-60213","published":"2025-10-22T14:32:43.800Z","updated":"2026-04-28T18:41:35.808Z","title":"WordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Whitebox-Studio","product":"Scape","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60212","published":"2025-10-22T14:32:43.582Z","updated":"2026-04-28T18:41:26.327Z","title":"WordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"VEDA","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-60211","published":"2025-10-22T14:32:43.390Z","updated":"2026-04-28T18:41:15.596Z","title":"WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"extendons","product":"WooCommerce Registration Fields Plugin - Custom Signup Fields","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-60210","published":"2025-10-22T14:32:43.171Z","updated":"2026-04-28T18:41:06.361Z","title":"WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpeverest","product":"Everest Forms - Frontend Listing","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-60209","published":"2025-10-22T14:32:42.951Z","updated":"2026-04-28T18:40:56.831Z","title":"WordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Connector for Gravity Forms and Google Sheets","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-60208","published":"2025-10-22T14:32:42.742Z","updated":"2026-04-28T18:40:47.846Z","title":"WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Tusko Trush","product":"Advanced Custom Fields : CPT Options Pages","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-60206","published":"2025-10-22T14:32:42.404Z","updated":"2026-04-28T18:40:29.190Z","title":"WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Beplusthemes","product":"Alone","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-60176","published":"2025-10-22T14:32:42.200Z","updated":"2026-04-28T18:38:58.515Z","title":"WordPress WP Tesseract Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"tattersoftware","product":"WP Tesseract","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60168","published":"2025-10-22T14:32:42.006Z","updated":"2026-04-28T18:38:35.678Z","title":"WordPress HotelRunner Booking Widget Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"integrationshotelrunner","product":"HotelRunner Booking Widget","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-60151","published":"2025-10-22T14:32:41.801Z","updated":"2026-04-28T18:38:26.594Z","title":"WordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms HubSpot","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-60135","published":"2025-10-22T14:32:41.610Z","updated":"2026-04-28T18:38:17.147Z","title":"WordPress WeShare Buttons Plugin <= 13.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"NIKITAS GEORGOPOULOS","product":"WeShare Buttons","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60134","published":"2025-10-22T14:32:41.146Z","updated":"2026-04-28T16:13:55.419Z","title":"WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"John James Jacoby","product":"WP Media Categories","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60132","published":"2025-10-22T14:32:40.543Z","updated":"2026-04-28T16:13:55.331Z","title":"WordPress Video Blogster Lite Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"johnh10","product":"Video Blogster Lite","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-60131","published":"2025-10-22T14:32:40.297Z","updated":"2026-04-28T16:13:55.418Z","title":"WordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Zoefff","product":"Werk aan de Muur","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60041","published":"2025-10-22T14:32:40.107Z","updated":"2026-04-28T16:13:52.990Z","title":"WordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Iulia Cazan","product":"Emails Catch All","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-60039","published":"2025-10-22T14:32:39.926Z","updated":"2026-04-28T18:33:32.504Z","title":"WordPress Noisa theme <= 2.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rascals","product":"Noisa","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-59593","published":"2025-10-22T14:32:39.727Z","updated":"2026-04-28T16:13:53.101Z","title":"WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Extend Themes","product":"Colibri Page Builder","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-59580","published":"2025-10-22T14:32:39.528Z","updated":"2026-04-28T20:20:34.777Z","title":"WordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"GoodLayers","product":"Goodlayers Core","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-59579","published":"2025-10-22T14:32:39.279Z","updated":"2026-04-29T09:51:56.610Z","title":"WordPress Simple Job Board plugin <= 2.13.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"PressTigers","product":"Simple Job Board","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-59578","published":"2025-10-22T14:32:39.044Z","updated":"2026-04-29T09:51:56.611Z","title":"WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"wpdesk","product":"ShopMagic","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-59575","published":"2025-10-22T14:32:38.795Z","updated":"2026-04-29T09:51:56.610Z","title":"WordPress MasterStudy LMS plugin <= 3.6.20 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-59571","published":"2025-10-22T14:32:38.590Z","updated":"2026-04-28T20:20:24.690Z","title":"WordPress WorkScout-Core plugin < 1.7.06 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"purethemes","product":"WorkScout-Core","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-59566","published":"2025-10-22T14:32:38.405Z","updated":"2026-04-28T16:13:52.478Z","title":"WordPress Workreap (theme's plugin) plugin <= 3.3.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"AmentoTech","product":"Workreap (theme's plugin)","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-59564","published":"2025-10-22T14:32:38.200Z","updated":"2026-04-28T20:20:13.799Z","title":"WordPress EduMall Theme < 4.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"EduMall","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-59558","published":"2025-10-22T14:32:37.987Z","updated":"2026-04-28T20:20:03.224Z","title":"WordPress Billey Theme < 2.1.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Billey","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-59557","published":"2025-10-22T14:32:37.757Z","updated":"2026-04-28T16:13:52.432Z","title":"WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThemeMove","product":"Learts Addons","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-59555","published":"2025-10-22T14:32:37.531Z","updated":"2026-04-28T20:19:42.140Z","title":"WordPress Medizin Theme < 1.9.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Medizin","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-59550","published":"2025-10-22T14:32:37.298Z","updated":"2026-04-28T20:19:30.913Z","title":"WordPress Xcare theme < 6.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"designervily","product":"Xcare","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2025-59007","published":"2025-10-22T14:32:37.108Z","updated":"2026-04-28T16:13:51.844Z","title":"WordPress TF Woo Product Grid Addon For Elementor Plugin <= 1.0.1 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themesflat","product":"TF Woo Product Grid Addon For Elementor","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-59006","published":"2025-10-22T14:32:36.907Z","updated":"2026-04-28T16:13:51.229Z","title":"WordPress Easy Woocommerce Customizer plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themebon","product":"Easy Woocommerce Customizer","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-59004","published":"2025-10-22T14:32:36.724Z","updated":"2026-04-28T20:18:52.270Z","title":"WordPress WC Return products plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pco_58","product":"WC Return products","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-58971","published":"2025-10-22T14:32:36.518Z","updated":"2026-04-28T20:16:51.565Z","title":"WordPress Doctreat theme <= 1.6.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"AmentoTech","product":"Doctreat","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-58970","published":"2025-10-22T14:32:36.243Z","updated":"2026-04-28T16:13:50.516Z","title":"WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability","severity":"MEDIUM","score":6.3,"vendor":"AmentoTech","product":"Doctreat","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-58967","published":"2025-10-22T14:32:36.057Z","updated":"2026-04-28T16:13:50.512Z","title":"WordPress Businext theme < 2.4.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Businext","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58966","published":"2025-10-22T14:32:35.821Z","updated":"2026-04-28T16:13:50.771Z","title":"WordPress NEX-Forms LITE plugin < 8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms LITE","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-58963","published":"2025-10-22T14:32:35.581Z","updated":"2026-04-28T16:13:50.417Z","title":"WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"7oroof","product":"Medcity","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-58961","published":"2025-10-22T14:32:35.382Z","updated":"2026-04-28T20:16:33.337Z","title":"WordPress CF7 Auto Responder Addon plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kamleshyadav","product":"CF7 Auto Responder Addon","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-58959","published":"2025-10-22T14:32:35.198Z","updated":"2026-04-28T16:13:50.400Z","title":"WordPress Taskbot plugin <= 6.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"AmentoTech","product":"Taskbot","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-58958","published":"2025-10-22T14:32:35.016Z","updated":"2026-04-28T16:13:50.561Z","title":"WordPress SmilePure Theme < 1.8.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"SmilePure","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-58955","published":"2025-10-22T14:32:34.802Z","updated":"2026-04-28T20:16:24.317Z","title":"WordPress Karzo theme < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"designervily","product":"Karzo","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2025-58921","published":"2025-10-22T14:32:34.600Z","updated":"2026-04-28T16:13:49.558Z","title":"WordPress WP Tactical Popup plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arevico","product":"WP Tactical Popup","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-58916","published":"2025-10-22T14:32:34.398Z","updated":"2026-04-28T16:13:49.334Z","title":"WordPress Author: Munzir plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Munzir","product":"Author: Munzir","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53428","published":"2025-10-22T14:32:34.204Z","updated":"2026-04-28T19:14:09.725Z","title":"WordPress Simple User Registration plugin <= 6.8 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"N-Media","product":"Simple User Registration","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-53427","published":"2025-10-22T14:32:34.002Z","updated":"2026-04-28T19:13:59.567Z","title":"WordPress SEO Pyramid plugin <= 1.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Chibueze Okechukwu","product":"SEO Pyramid","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53426","published":"2025-10-22T14:32:33.768Z","updated":"2026-04-28T16:13:24.461Z","title":"WordPress Likert Survey Master plugin <= 0.8.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Likert Survey Master","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53425","published":"2025-10-22T14:32:33.573Z","updated":"2026-04-28T16:13:24.832Z","title":"WordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Dokan, Inc.","product":"Dokan","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2025-53424","published":"2025-10-22T14:32:33.353Z","updated":"2026-04-28T16:13:24.490Z","title":"WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vanquish","product":"WooCommerce Orders & Customers Exporter","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-53423","published":"2025-10-22T14:32:33.165Z","updated":"2026-04-28T19:13:48.953Z","title":"WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"Triss","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53422","published":"2025-10-22T14:32:32.974Z","updated":"2026-04-28T19:13:39.958Z","title":"WordPress WhatsApp Chat for WordPress and WooCommerce plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeWarriors","product":"WhatsApp Chat for WordPress and WooCommerce","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53421","published":"2025-10-22T14:32:32.545Z","updated":"2026-04-28T16:13:24.592Z","title":"WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-53420","published":"2025-10-22T14:32:32.282Z","updated":"2026-04-28T19:13:29.464Z","title":"WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53352","published":"2025-10-22T14:32:31.986Z","updated":"2026-04-28T19:13:20.506Z","title":"WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"G5Theme","product":"Grid Plus","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53351","published":"2025-10-22T14:32:31.652Z","updated":"2026-04-28T19:13:10.071Z","title":"WordPress Fidelo Snippet plugin <= 1.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fidelo Software GmbH","product":"Fidelo Snippet","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53350","published":"2025-10-22T14:32:31.360Z","updated":"2026-04-28T19:13:00.639Z","title":"WordPress Calendar Plus plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"webjunk","product":"Calendar Plus","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53297","published":"2025-10-22T14:32:31.023Z","updated":"2026-04-28T19:12:40.146Z","title":"WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AA-Team","product":"Woocommerce Envato Affiliates","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53238","published":"2025-10-22T14:32:30.376Z","updated":"2026-04-28T16:13:21.647Z","title":"WordPress Toast Mobile Menu plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Toast Plugins","product":"Toast Mobile Menu","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53236","published":"2025-10-22T14:32:29.996Z","updated":"2026-04-28T19:12:08.509Z","title":"WordPress UDesign Core plugin <= 4.14.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-53234","published":"2025-10-22T14:32:29.678Z","updated":"2026-04-28T19:11:57.515Z","title":"WordPress UDesign Core plugin <= 4.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53232","published":"2025-10-22T14:32:29.356Z","updated":"2026-04-29T09:51:55.440Z","title":"WordPress WP Gmail SMTP plugin <= 1.0.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"inkthemes","product":"WP Gmail SMTP","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-53229","published":"2025-10-22T14:32:29.122Z","updated":"2026-04-28T19:11:24.786Z","title":"WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kamleshyadav","product":"RockON DJ","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-53218","published":"2025-10-22T14:32:28.882Z","updated":"2026-04-29T09:51:55.525Z","title":"WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Saad Iqbal","product":"AppExperts","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-52770","published":"2025-10-22T14:32:28.679Z","updated":"2026-04-28T19:05:48.972Z","title":"WordPress Hello Followers plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"appscreo","product":"Hello Followers","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52763","published":"2025-10-22T14:32:28.478Z","updated":"2026-04-28T19:05:29.693Z","title":"WordPress Nifty Backups plugin <= 1.08 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NickDuncan","product":"Nifty Backups","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52760","published":"2025-10-22T14:32:28.248Z","updated":"2026-04-28T16:13:18.269Z","title":"WordPress MultiSite Clone Duplicator plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Globalis","product":"MultiSite Clone Duplicator","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52758","published":"2025-10-22T14:32:27.961Z","updated":"2026-04-28T16:13:18.266Z","title":"WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Gesundheit Bewegt GmbH","product":"Zippy","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2025-52757","published":"2025-10-22T14:32:27.245Z","updated":"2026-04-28T16:13:18.225Z","title":"WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FantasticPlugins","product":"SUMO Memberships for WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-52756","published":"2025-10-22T14:32:26.710Z","updated":"2026-04-28T19:05:19.215Z","title":"WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.4,"vendor":"Sayan Datta","product":"WP Last Modified Info","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-52755","published":"2025-10-22T14:32:26.093Z","updated":"2026-04-28T19:05:08.578Z","title":"WordPress Child Themes plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Chris Taylor","product":"Child Themes","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52754","published":"2025-10-22T14:32:25.569Z","updated":"2026-04-28T19:04:58.173Z","title":"WordPress Sello ChannelConnector plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"selloio","product":"Sello ChannelConnector","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52753","published":"2025-10-22T14:32:25.219Z","updated":"2026-04-28T19:04:48.262Z","title":"WordPress Contact Form by Supsystic plugin <= 1.7.36 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52752","published":"2025-10-22T14:32:25.039Z","updated":"2026-04-28T19:04:38.622Z","title":"WordPress IDonatePro plugin <= 2.1.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeAtelier","product":"IDonatePro","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2025-52751","published":"2025-10-22T14:32:24.841Z","updated":"2026-04-28T19:04:27.969Z","title":"WordPress Slide Puzzle plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"colome","product":"Slide Puzzle","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-52750","published":"2025-10-22T14:32:24.658Z","updated":"2026-04-28T19:04:18.237Z","title":"WordPress Emu2 plugin <= 0.83b - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Juergen Schulze","product":"Emu2","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52749","published":"2025-10-22T14:32:24.442Z","updated":"2026-04-28T19:04:08.232Z","title":"WordPress Uji Countdown plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Activity Track","product":"Uji Countdown","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52748","published":"2025-10-22T14:32:24.265Z","updated":"2026-04-28T19:03:57.830Z","title":"WordPress Directory Pro plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52743","published":"2025-10-22T14:32:24.069Z","updated":"2026-04-28T16:13:17.997Z","title":"WordPress oik-privacy-policy plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bobbingwide","product":"oik-privacy-policy","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52742","published":"2025-10-22T14:32:23.806Z","updated":"2026-04-28T19:02:10.895Z","title":"WordPress Pets Plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Igor Benic","product":"Pets","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52741","published":"2025-10-22T14:32:23.521Z","updated":"2026-04-28T19:02:00.370Z","title":"WordPress Post Connector Plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Barry Kooij","product":"Post Connector","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-52740","published":"2025-10-22T14:32:23.272Z","updated":"2026-04-28T19:01:50.653Z","title":"WordPress Boldermail Plugin <= 2.4.0 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"Hernan Villanueva","product":"Boldermail","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-52738","published":"2025-10-22T14:32:23.016Z","updated":"2026-04-28T16:13:17.751Z","title":"WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wikimedia Foundation","product":"Wikipedia Preview","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-52737","published":"2025-10-22T14:32:22.788Z","updated":"2026-04-28T19:01:40.317Z","title":"WordPress WP Store Locator plugin <= 2.2.260 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Tijmen Smit","product":"WP Store Locator","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-52736","published":"2025-10-22T14:32:22.566Z","updated":"2026-04-28T19:01:31.279Z","title":"WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Daman Jeet","product":"Finale Lite","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-52735","published":"2025-10-22T14:32:22.345Z","updated":"2026-04-28T16:13:17.689Z","title":"WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"XLPlugins","product":"NextMove Lite","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-52734","published":"2025-10-22T14:32:22.152Z","updated":"2026-04-28T16:13:17.707Z","title":"WordPress CropRefine Plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ERA404","product":"CropRefine","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49992","published":"2025-10-22T14:32:21.965Z","updated":"2026-04-28T20:29:34.769Z","title":"WordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"LearnPress Export Import","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49963","published":"2025-10-22T14:32:21.783Z","updated":"2026-04-28T20:29:24.942Z","title":"WordPress Simple Stripe Checkout plugin <= 1.1.28 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"growniche","product":"Simple Stripe Checkout","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49962","published":"2025-10-22T14:32:21.576Z","updated":"2026-04-28T20:29:14.021Z","title":"WordPress bbPress Notify plugin <= 2.19.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"useStrict","product":"bbPress Notify","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49961","published":"2025-10-22T14:32:21.376Z","updated":"2026-04-28T16:13:14.119Z","title":"WordPress Breeze Checkout plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Breeze Team","product":"Breeze Checkout","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-49960","published":"2025-10-22T14:32:21.173Z","updated":"2026-04-28T20:29:03.625Z","title":"WordPress LeadBI Plugin for WordPress plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"leadbi","product":"LeadBI Plugin for WordPress","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-49959","published":"2025-10-22T14:32:20.965Z","updated":"2026-04-28T20:28:53.697Z","title":"WordPress bbPress Move Topics plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pascal Casier","product":"bbPress Move Topics","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49958","published":"2025-10-22T14:32:20.661Z","updated":"2026-04-28T16:13:10.044Z","title":"WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"robokassa","product":"Robokassa payment gateway for Woocommerce","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49957","published":"2025-10-22T14:32:20.403Z","updated":"2026-04-28T20:28:43.883Z","title":"WordPress Email Attachment by Order Status & Products Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Weboccult Technologies Pvt Ltd","product":"Email Attachment by Order Status & Products","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49956","published":"2025-10-22T14:32:20.199Z","updated":"2026-04-28T20:28:33.288Z","title":"WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Anandaraj Balu","product":"Fade Slider","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49955","published":"2025-10-22T14:32:20.010Z","updated":"2026-04-28T20:28:22.866Z","title":"WordPress WP Smart Flexslider Plugin <= 2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Rajan Vijayan","product":"WP Smart Flexslider","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49954","published":"2025-10-22T14:32:19.827Z","updated":"2026-04-28T20:28:13.562Z","title":"WordPress WP-Click-Tracker Plugin <= 0.7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"mithra62","product":"WP-Click-Tracker","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49953","published":"2025-10-22T14:32:19.616Z","updated":"2026-04-28T20:28:02.951Z","title":"WordPress ShareBang, Ultimate Social Share Buttons for WordPress Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themeinity","product":"ShareBang, Ultimate Social Share Buttons for WordPress","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49952","published":"2025-10-22T14:32:19.320Z","updated":"2026-04-28T16:13:08.925Z","title":"WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2025-49951","published":"2025-10-22T14:32:19.132Z","updated":"2026-04-28T20:27:53.812Z","title":"WordPress gAppointments Plugin <= 1.14.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"wpcrunch","product":"gAppointments","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49950","published":"2025-10-22T14:32:18.932Z","updated":"2026-04-28T16:13:08.830Z","title":"WordPress Official Integration for Billingo plugin <= 4.3.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"billingo","product":"Official Integration for Billingo","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2025-49949","published":"2025-10-22T14:32:18.660Z","updated":"2026-04-28T16:13:09.088Z","title":"WordPress Templazee plugin <= 1.0.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"templazee","product":"Templazee","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-49948","published":"2025-10-22T14:32:18.319Z","updated":"2026-04-28T20:27:44.086Z","title":"WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Ahmad Awais","product":"WP Super Edit","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49947","published":"2025-10-22T14:32:18.131Z","updated":"2026-04-28T20:27:33.892Z","title":"WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"extendons","product":"WooCommerce Registration Fields Plugin - Custom Signup Fields","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-49946","published":"2025-10-22T14:32:17.913Z","updated":"2026-04-28T20:27:23.488Z","title":"WordPress Auto Login After Registration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cynob IT Consultancy","product":"Auto Login After Registration","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49945","published":"2025-10-22T14:32:17.676Z","updated":"2026-04-28T20:27:18.728Z","title":"WordPress Shortcode Generator plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kylegetson","product":"Shortcode Generator","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49944","published":"2025-10-22T14:32:17.445Z","updated":"2026-04-28T20:27:02.574Z","title":"WordPress WPCode Content Ratio plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jonatan Jumbert","product":"WPCode Content Ratio","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-49940","published":"2025-10-22T14:32:17.247Z","updated":"2026-04-28T20:26:21.983Z","title":"WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeFusion","product":"Fusion Builder","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-49939","published":"2025-10-22T14:32:17.061Z","updated":"2026-04-28T20:26:11.314Z","title":"WordPress JetElements For Elementor plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49938","published":"2025-10-22T14:32:16.875Z","updated":"2026-04-28T20:26:02.899Z","title":"WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49937","published":"2025-10-22T14:32:16.676Z","updated":"2026-04-28T16:13:08.568Z","title":"WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"Smash Balloon Social Post Feed","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-49936","published":"2025-10-22T14:32:16.302Z","updated":"2026-04-28T20:25:50.916Z","title":"WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xtemos","product":"WoodMart","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-49935","published":"2025-10-22T14:32:16.098Z","updated":"2026-04-28T16:13:08.535Z","title":"WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"xtemos","product":"WoodMart","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2025-49934","published":"2025-10-22T14:32:15.865Z","updated":"2026-04-28T16:13:08.263Z","title":"WordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49933","published":"2025-10-22T14:32:15.603Z","updated":"2026-04-28T20:25:41.863Z","title":"WordPress JetBlog plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49932","published":"2025-10-22T14:32:15.443Z","updated":"2026-04-28T20:25:31.642Z","title":"WordPress JetBlog plugin <= 2.4.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49931","published":"2025-10-22T14:32:15.259Z","updated":"2026-10-22T14:29:49.751Z","title":"WordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock","product":"JetSearch","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-49930","published":"2025-10-22T14:32:15.035Z","updated":"2026-04-28T20:25:22.183Z","title":"WordPress JetSearch plugin <= 3.5.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetSearch","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49929","published":"2025-10-22T14:32:14.811Z","updated":"2026-04-28T20:25:12.288Z","title":"WordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ultimate Blocks","product":"Ultimate Blocks","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49928","published":"2025-10-22T14:32:14.597Z","updated":"2026-04-28T20:25:01.596Z","title":"WordPress JetWooBuilder plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetWooBuilder","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49927","published":"2025-10-22T14:32:14.395Z","updated":"2026-04-28T20:24:51.375Z","title":"WordPress JetWooBuilder plugin <= 2.1.20.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetWooBuilder","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49926","published":"2025-10-22T14:32:14.208Z","updated":"2026-04-28T16:13:07.897Z","title":"WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.2,"vendor":"Laborator","product":"Kalium","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-49925","published":"2025-10-22T14:32:14.033Z","updated":"2026-04-28T16:13:07.976Z","title":"WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-49924","published":"2025-10-22T14:32:13.804Z","updated":"2026-04-28T16:13:08.005Z","title":"WordPress Wholesale Suite plugin <= 2.2.4.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Josh Kohlbach","product":"Wholesale Suite","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-49923","published":"2025-10-22T14:32:13.596Z","updated":"2026-04-28T16:13:07.972Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.11.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-49922","published":"2025-10-22T14:32:13.367Z","updated":"2026-04-28T16:13:07.972Z","title":"WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"etruel","product":"WPeMatico RSS Feed Fetcher","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-49921","published":"2025-10-22T14:32:13.059Z","updated":"2026-04-28T16:13:07.913Z","title":"WordPress JetReviews plugin <= 3.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2025-49920","published":"2025-10-22T14:32:12.844Z","updated":"2026-04-28T16:13:07.817Z","title":"WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"accessiBe","product":"Web Accessibility By accessiBe","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-49917","published":"2025-10-22T14:32:12.630Z","updated":"2026-04-28T20:24:40.871Z","title":"WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Icegram","product":"Icegram Express Pro","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-49916","published":"2025-10-22T14:32:12.420Z","updated":"2026-04-28T16:13:07.903Z","title":"WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability","severity":"HIGH","score":8.6,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-49915","published":"2025-10-22T14:32:12.221Z","updated":"2026-04-28T16:13:07.898Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Cozy Vision","product":"SMS Alert Order Notifications","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-49913","published":"2025-10-22T14:32:11.977Z","updated":"2026-04-28T16:13:07.838Z","title":"WordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CoSchedule","product":"CoSchedule","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-49912","published":"2025-10-22T14:32:11.545Z","updated":"2026-04-28T20:24:20.135Z","title":"WordPress Email Subscription Popup plugin <= 1.2.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Nks","product":"Email Subscription Popup","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-49911","published":"2025-10-22T14:32:11.293Z","updated":"2026-04-28T20:24:10.805Z","title":"WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpinstinct","product":"WooCommerce Vehicle Parts Finder","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49910","published":"2025-10-22T14:32:11.095Z","updated":"2026-04-28T20:24:00.284Z","title":"WordPress WPGuppy plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"AmentoTech Private Limited","product":"WPGuppy","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-49908","published":"2025-10-22T14:32:10.858Z","updated":"2026-04-28T20:23:50.701Z","title":"WordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPClever","product":"WPC Countdown Timer for WooCommerce","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-49907","published":"2025-10-22T14:32:10.614Z","updated":"2026-04-28T16:13:07.579Z","title":"WordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"RealMag777","product":"MDTF","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-49906","published":"2025-10-22T14:32:10.402Z","updated":"2026-04-28T16:13:07.508Z","title":"WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"StellarWP","product":"WPComplete","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-49903","published":"2025-10-22T14:32:10.215Z","updated":"2026-04-28T16:13:07.504Z","title":"WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bdthemes","product":"ZoloBlocks","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-49901","published":"2025-10-22T14:32:10.033Z","updated":"2026-04-28T20:23:39.925Z","title":"WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"quantumcloud","product":"Simple Link Directory","kev":false,"epss":0.00731,"kevAdded":null},{"id":"CVE-2025-49899","published":"2025-10-22T14:32:09.852Z","updated":"2026-04-28T16:13:07.332Z","title":"WordPress Whydonate plugin <= 4.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"jjlemstra","product":"Whydonate","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-49380","published":"2025-10-22T14:32:09.626Z","updated":"2026-04-28T16:13:02.695Z","title":"WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpinstinct","product":"WooCommerce Vehicle Parts Finder","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-49378","published":"2025-10-22T14:32:09.452Z","updated":"2026-04-28T16:13:02.542Z","title":"WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2025-49377","published":"2025-10-22T14:32:09.195Z","updated":"2026-04-28T16:13:02.685Z","title":"WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-49376","published":"2025-10-22T14:32:08.837Z","updated":"2026-04-28T16:13:02.683Z","title":"WordPress DELUCKS SEO plugin <= 2.5.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DELUCKS","product":"DELUCKS SEO","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-49374","published":"2025-10-22T14:32:08.617Z","updated":"2026-04-28T16:13:02.687Z","title":"WordPress Captcha.eu plugin <= 1.0.61 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"captcha.eu","product":"Captcha.eu","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-49373","published":"2025-10-22T14:32:08.403Z","updated":"2026-04-28T16:13:02.656Z","title":"WordPress Evergreen Content Poster plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Evergreen Content Poster","product":"Evergreen Content Poster","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-49060","published":"2025-10-22T14:32:08.196Z","updated":"2026-04-28T20:20:45.834Z","title":"WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"CMSSuperHeroes","product":"Wastia","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-48338","published":"2025-10-22T14:32:07.858Z","updated":"2026-04-28T16:12:56.712Z","title":"WordPress WP Abstracts plugin <= 2.7.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Kevon Adonis","product":"WP Abstracts","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-48106","published":"2025-10-22T14:32:07.674Z","updated":"2026-04-28T20:18:43.355Z","title":"WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"CMSSuperHeroes","product":"Clanora","kev":false,"epss":0.0062,"kevAdded":null},{"id":"CVE-2025-48099","published":"2025-10-22T14:32:07.494Z","updated":"2026-04-28T20:18:34.198Z","title":"WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Code Amp","product":"Search & Filter","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-48098","published":"2025-10-22T14:32:07.268Z","updated":"2026-04-28T20:18:25.154Z","title":"WordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48097","published":"2025-10-22T14:32:07.078Z","updated":"2026-04-28T20:18:16.145Z","title":"WordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shiva","product":"WSAnalytics","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48096","published":"2025-10-22T14:32:06.895Z","updated":"2026-04-28T16:12:51.232Z","title":"WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FRESHFACE","product":"Custom CSS","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-48095","published":"2025-10-22T14:32:06.692Z","updated":"2026-04-28T20:18:05.889Z","title":"WordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-48093","published":"2025-10-22T14:32:06.499Z","updated":"2026-04-28T20:17:55.710Z","title":"WordPress Password only login plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Calvaweb","product":"Password only login","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-48092","published":"2025-10-22T14:32:06.317Z","updated":"2026-04-28T20:17:46.532Z","title":"WordPress Fix Multiple Redirects plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jurajpuchky","product":"Fix Multiple Redirects","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-48091","published":"2025-10-22T14:32:06.134Z","updated":"2026-04-28T16:12:50.891Z","title":"WordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Alexander","product":"AnyComment","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-48082","published":"2025-10-22T14:32:05.935Z","updated":"2026-04-28T20:17:37.536Z","title":"WordPress Progress Planner plugin <= 1.8.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Planner","product":"Progress Planner","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-39534","published":"2025-10-22T14:32:05.744Z","updated":"2026-04-28T20:13:38.212Z","title":"WordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Somonator","product":"Terms Dictionary","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-32657","published":"2025-10-22T14:32:05.506Z","updated":"2026-04-28T19:38:00.539Z","title":"WordPress Testimonial Slider and Showcase Pro plugin <= 2.1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"RadiusTheme","product":"Testimonial Slider And Showcase Pro","kev":false,"epss":0.00614,"kevAdded":null},{"id":"CVE-2025-32283","published":"2025-10-22T14:32:05.260Z","updated":"2026-04-28T19:37:51.256Z","title":"WordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Solar Energy","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2025-31634","published":"2025-10-22T14:32:05.043Z","updated":"2026-04-28T18:33:22.905Z","title":"WordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Insurance","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2025-30944","published":"2025-10-22T14:32:04.793Z","updated":"2026-04-28T16:12:02.040Z","title":"WordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Essekia","product":"Tablesome Table Premium","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-48087","published":"2025-10-17T14:18:04.368Z","updated":"2026-04-28T16:12:50.384Z","title":"WordPress Memberlite Shortcodes plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jason C.","product":"Memberlite Shortcodes","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-60219","published":"2025-09-26T08:32:14.458Z","updated":"2026-04-28T16:13:57.852Z","title":"WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"HaruTheme","product":"WooCommerce Designer Pro","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-60186","published":"2025-09-26T08:32:13.829Z","updated":"2026-04-28T16:13:57.135Z","title":"WordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Alex Moss","product":"Google+ Comments","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-60185","published":"2025-09-26T08:32:13.195Z","updated":"2026-04-28T16:13:57.109Z","title":"WordPress kontur Admin Style Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"kontur.us","product":"kontur Admin Style","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-60184","published":"2025-09-26T08:32:12.438Z","updated":"2026-04-28T16:13:57.016Z","title":"WordPress SEO Search Permalink Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Terry L.","product":"SEO Search Permalink","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-60181","published":"2025-09-26T08:32:11.848Z","updated":"2026-04-28T16:13:57.089Z","title":"WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"silence","product":"Silencesoft RSS Reader","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-60179","published":"2025-09-26T08:32:11.221Z","updated":"2026-04-28T16:13:56.787Z","title":"WordPress Click & Tweet Plugin <= 0.8.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Space Studio","product":"Click & Tweet","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-60177","published":"2025-09-26T08:32:10.595Z","updated":"2026-04-28T16:13:56.768Z","title":"WordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"rozx","product":"Recaptcha – wp","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-60173","published":"2025-09-26T08:32:09.970Z","updated":"2026-04-28T16:13:56.981Z","title":"WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Ashwani kumar","product":"GST for WooCommerce","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-60172","published":"2025-09-26T08:32:09.381Z","updated":"2026-04-28T16:13:56.387Z","title":"WordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"flytedesk","product":"Flytedesk Digital","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-60171","published":"2025-09-26T08:32:06.652Z","updated":"2026-04-28T16:13:56.385Z","title":"WordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"yourplugins","product":"Conditional Cart Messages for WooCommerce – YourPlugins.com","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-60170","published":"2025-09-26T08:32:06.029Z","updated":"2026-04-28T16:13:56.910Z","title":"WordPress HTACCESS IP Blocker Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Taraprasad Swain","product":"HTACCESS IP Blocker","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-60169","published":"2025-09-26T08:32:04.685Z","updated":"2026-04-28T16:13:56.362Z","title":"WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"W3S Cloud Technology","product":"W3SCloud Contact Form 7 to Zoho CRM","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-60167","published":"2025-09-26T08:32:04.092Z","updated":"2026-04-28T16:13:56.371Z","title":"WordPress Page Manager for Elementor Plugin <= 2.0.5 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"honzat","product":"Page Manager for Elementor","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-60166","published":"2025-09-26T08:32:03.483Z","updated":"2026-04-28T16:13:56.386Z","title":"WordPress WP Subscription Forms PRO Plugin <=  2.0.5 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpshuffle","product":"WP Subscription Forms PRO","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-60165","published":"2025-09-26T08:32:02.793Z","updated":"2026-04-28T16:13:56.347Z","title":"WordPress Frames Theme <= 1.5.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HaruTheme","product":"Frames","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-60164","published":"2025-09-26T08:32:02.068Z","updated":"2026-04-28T16:13:56.520Z","title":"WordPress NewsmanApp plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"NewsMAN","product":"NewsmanApp","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-60163","published":"2025-09-26T08:32:01.383Z","updated":"2026-04-28T16:13:56.704Z","title":"WordPress bbp topic count plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Robin W","product":"bbp topic count","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-60162","published":"2025-09-26T08:32:00.580Z","updated":"2026-04-28T16:13:56.304Z","title":"WordPress Job Board Manager Plugin <= 2.1.61 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Job Board Manager","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-60161","published":"2025-09-26T08:31:59.493Z","updated":"2026-04-28T16:13:56.338Z","title":"WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bdthemes","product":"ZoloBlocks","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-60160","published":"2025-09-26T08:31:58.847Z","updated":"2026-04-28T16:13:56.316Z","title":"WordPress Smart Related Products plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"sharkthemes","product":"Smart Related Products","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-60159","published":"2025-09-26T08:31:58.203Z","updated":"2026-04-28T16:13:56.181Z","title":"WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"webmaniabr","product":"Nota Fiscal Eletrônica WooCommerce","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-60158","published":"2025-09-26T08:31:57.502Z","updated":"2026-04-28T16:13:55.873Z","title":"WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"webmaniabr","product":"Nota Fiscal Eletrônica WooCommerce","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-60157","published":"2025-09-26T08:31:56.841Z","updated":"2026-04-28T16:13:55.854Z","title":"WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"emarket-design","product":"WP Ticket Customer Service Software & Support Ticket System","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-60156","published":"2025-09-26T08:31:56.219Z","updated":"2026-04-28T16:13:55.863Z","title":"WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"webandprint","product":"AR For WordPress","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-60155","published":"2025-09-26T08:31:55.610Z","updated":"2026-04-28T16:13:55.850Z","title":"WordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"loopus","product":"WP Virtual Assistant","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60154","published":"2025-09-26T08:31:54.673Z","updated":"2026-04-28T16:13:55.818Z","title":"WordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jennifer Moss","product":"MWW Disclaimer Buttons","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60153","published":"2025-09-26T08:31:53.998Z","updated":"2026-04-28T16:13:55.830Z","title":"WordPress Subscribe To Unlock Plugin <= 1.1.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"wpshuffle","product":"Subscribe To Unlock","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-60152","published":"2025-09-26T08:31:53.335Z","updated":"2026-04-28T16:13:55.754Z","title":"WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpshuffle","product":"Subscribe To Unlock","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60150","published":"2025-09-26T08:31:52.690Z","updated":"2026-04-28T16:13:55.824Z","title":"WordPress Subscribe to Download plugin <= 2.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"wpshuffle","product":"Subscribe to Download","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-60149","published":"2025-09-26T08:31:52.062Z","updated":"2026-04-28T16:13:55.771Z","title":"WordPress Notely plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Rocket Apps","product":"Notely","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60148","published":"2025-09-26T08:31:51.384Z","updated":"2026-04-28T16:13:55.779Z","title":"WordPress Subscribe to Download plugin <= 2.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpshuffle","product":"Subscribe to Download","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60147","published":"2025-09-26T08:31:50.655Z","updated":"2026-04-28T16:13:55.795Z","title":"WordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HT Plugins","product":"HT Feed","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-60146","published":"2025-09-26T08:31:50.016Z","updated":"2026-04-28T16:13:55.756Z","title":"WordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Amit Verma","product":"Map Categories to Pages","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60145","published":"2025-09-26T08:31:49.379Z","updated":"2026-04-28T16:13:55.759Z","title":"WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"yonifre","product":"Lenix scss compiler","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60144","published":"2025-09-26T08:31:48.760Z","updated":"2026-04-28T16:13:55.778Z","title":"WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"yonifre","product":"Lenix scss compiler","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-60143","published":"2025-09-26T08:31:48.179Z","updated":"2026-04-28T16:13:55.717Z","title":"WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"netgsm","product":"Netgsm","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60142","published":"2025-09-26T08:31:47.588Z","updated":"2026-04-28T16:13:55.747Z","title":"WordPress Simple Meta Tags Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DaganLev","product":"Simple Meta Tags","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-60141","published":"2025-09-26T08:31:46.991Z","updated":"2026-04-28T16:13:55.717Z","title":"WordPress The Tribal Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"thetechtribe","product":"The Tribal","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60140","published":"2025-09-26T08:31:46.345Z","updated":"2026-04-28T16:13:55.700Z","title":"WordPress The Tribal Plugin <= 1.3.3 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"thetechtribe","product":"The Tribal","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-60139","published":"2025-09-26T08:31:45.706Z","updated":"2026-04-28T16:13:55.609Z","title":"WordPress Sendle Shipping plugin <= 6.02 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Joovii","product":"Sendle Shipping","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60138","published":"2025-09-26T08:31:45.070Z","updated":"2026-04-28T16:13:55.610Z","title":"WordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Blocks","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-60137","published":"2025-09-26T08:31:44.401Z","updated":"2026-04-28T16:13:55.607Z","title":"WordPress Post Featured Video Plugin <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Galaxy Weblinks","product":"Post Featured Video","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60136","published":"2025-09-26T08:31:43.773Z","updated":"2026-04-28T16:13:55.600Z","title":"WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"cartpauj","product":"User Notes","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60133","published":"2025-09-26T08:31:43.196Z","updated":"2026-04-28T16:13:55.418Z","title":"WordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"DJ-Extensions.com","product":"PE Easy Slider","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60130","published":"2025-09-26T08:31:42.595Z","updated":"2026-04-28T16:13:55.354Z","title":"WordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wedos.com","product":"WEDOS Global","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60129","published":"2025-09-26T08:31:42.001Z","updated":"2026-04-28T16:13:55.346Z","title":"WordPress Yext Plugin <= 1.1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Yext","product":"Yext","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60128","published":"2025-09-26T08:31:41.384Z","updated":"2026-04-28T16:13:55.372Z","title":"WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Delicious","product":"Delisho","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60127","published":"2025-09-26T08:31:40.810Z","updated":"2026-04-28T16:13:55.305Z","title":"WordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ArtistScope","product":"CopySafe Web Protection","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-60126","published":"2025-09-26T08:31:40.209Z","updated":"2026-04-28T16:13:55.332Z","title":"WordPress Testimonial Slider Plugin <= 3.5.8.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.8,"vendor":"PluginOps","product":"Testimonial Slider","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-60125","published":"2025-09-26T08:31:39.629Z","updated":"2026-04-28T16:13:55.693Z","title":"WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themelooks","product":"FoodBook","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-60124","published":"2025-09-26T08:31:38.894Z","updated":"2026-04-28T16:13:55.335Z","title":"WordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ryan Hellyer","product":"Simple Colorbox","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-60123","published":"2025-09-26T08:31:38.284Z","updated":"2026-04-28T16:13:55.298Z","title":"WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress Claim Listings","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60122","published":"2025-09-26T08:31:37.615Z","updated":"2026-04-28T16:13:55.330Z","title":"WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress Claim Listings","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60121","published":"2025-09-26T08:31:36.974Z","updated":"2026-04-28T16:13:55.333Z","title":"WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ex-Themes","product":"WooEvents","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60119","published":"2025-09-26T08:31:36.353Z","updated":"2026-04-28T16:13:55.166Z","title":"WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CoSchedule","product":"CoSchedule","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-60120","published":"2025-09-26T08:31:35.719Z","updated":"2026-04-28T16:13:55.187Z","title":"WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDirectoryKit","product":"WP Directory Kit","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-60118","published":"2025-09-26T08:31:34.998Z","updated":"2026-04-28T16:13:55.180Z","title":"WordPress PGS Core Plugin <= 5.9.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Potenzaglobalsolutions","product":"PGS Core","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-60117","published":"2025-09-26T08:31:34.267Z","updated":"2026-04-28T16:13:55.072Z","title":"WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"TangibleWP","product":"Vehica Core","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60116","published":"2025-09-26T08:31:33.671Z","updated":"2026-04-28T16:13:55.027Z","title":"WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Conference Theme Custom Post Type","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-60115","published":"2025-09-26T08:31:32.900Z","updated":"2026-04-28T16:13:55.178Z","title":"WordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"instapagedev","product":"Instapage Plugin","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60114","published":"2025-09-26T08:31:31.971Z","updated":"2026-04-28T16:13:54.963Z","title":"WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability","severity":"MEDIUM","score":6.6,"vendor":"YayCommerce","product":"YayCurrency","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-60113","published":"2025-09-26T08:31:30.396Z","updated":"2026-04-28T16:13:54.946Z","title":"WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"grooni","product":"Groovy Menu","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60112","published":"2025-09-26T08:31:29.539Z","updated":"2026-04-28T16:13:54.945Z","title":"WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syed Balkhi","product":"aThemes Addons for Elementor","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-60111","published":"2025-09-26T08:31:28.948Z","updated":"2026-04-28T16:13:54.890Z","title":"WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"javothemes","product":"Javo Core","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-60110","published":"2025-09-26T08:31:28.240Z","updated":"2026-04-28T16:13:54.839Z","title":"WordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"AllInOne - Banner Rotator","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-60109","published":"2025-09-26T08:31:27.487Z","updated":"2026-04-28T16:13:54.809Z","title":"WordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Content Slider","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-60108","published":"2025-09-26T08:31:26.732Z","updated":"2026-04-28T16:13:54.820Z","title":"WordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8  - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Banner with Thumbnails","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-60107","published":"2025-09-26T08:31:26.095Z","updated":"2026-04-28T16:13:54.879Z","title":"WordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"LambertGroup - AllInOne - Banner with Playlist","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-60106","published":"2025-09-26T08:31:25.285Z","updated":"2026-04-28T16:13:54.851Z","title":"WordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Roxnor","product":"EmailKit","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-60105","published":"2025-09-26T08:31:24.684Z","updated":"2026-04-28T16:13:54.879Z","title":"WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-60104","published":"2025-09-26T08:31:24.053Z","updated":"2026-04-28T16:13:54.821Z","title":"WordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jordy Meow","product":"Gallery Custom Links","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-60103","published":"2025-09-26T08:31:23.368Z","updated":"2026-04-28T16:13:54.825Z","title":"WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60102","published":"2025-09-26T08:31:22.744Z","updated":"2026-04-28T16:13:54.821Z","title":"WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syam Mohan","product":"WPFront User Role Editor","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-60099","published":"2025-09-26T08:31:22.065Z","updated":"2026-04-28T16:13:54.800Z","title":"WordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"awsm.in","product":"Embed Any Document","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-60100","published":"2025-09-26T08:31:21.432Z","updated":"2026-04-28T16:13:54.811Z","title":"WordPress XStore theme < 9.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"8theme","product":"XStore","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-60101","published":"2025-09-26T08:31:20.783Z","updated":"2026-04-28T16:13:54.760Z","title":"WordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"duongancol","product":"Woostify","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-60098","published":"2025-09-26T08:31:20.167Z","updated":"2026-04-28T16:13:54.742Z","title":"WordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Farthing","product":"Theme My Login","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-60097","published":"2025-09-26T08:31:19.515Z","updated":"2026-04-28T16:13:54.743Z","title":"WordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CodexThemes","product":"TheGem","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60096","published":"2025-09-26T08:31:18.894Z","updated":"2026-04-28T16:13:54.743Z","title":"WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-60095","published":"2025-09-26T08:31:18.257Z","updated":"2026-04-28T16:13:54.744Z","title":"WordPress Stackable Plugin <= 3.18.1 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Benjamin Intal","product":"Stackable","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-60094","published":"2025-09-26T08:31:17.632Z","updated":"2026-04-28T16:13:54.744Z","title":"WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Benjamin Intal","product":"Stackable","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-60093","published":"2025-09-26T08:31:17.060Z","updated":"2026-04-28T16:13:54.726Z","title":"WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-60092","published":"2025-09-26T08:31:16.411Z","updated":"2026-04-28T16:13:54.665Z","title":"WordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-60040","published":"2025-09-26T08:31:15.616Z","updated":"2026-05-13T10:39:11.354Z","title":"WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fkrauthan","product":"wp-mpdf","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-4957","published":"2025-09-26T08:31:14.954Z","updated":"2026-04-28T16:13:05.588Z","title":"WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-27006","published":"2025-09-26T08:31:14.276Z","updated":"2026-04-28T16:11:46.407Z","title":"WordPress Authorsy Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themeplugs","product":"Authorsy","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-48107","published":"2025-09-26T08:31:13.612Z","updated":"2026-04-28T16:12:51.619Z","title":"WordPress Uncode theme < 2.9.4.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"undsgn","product":"Uncode","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-48326","published":"2025-09-26T08:31:12.796Z","updated":"2026-04-28T16:12:56.637Z","title":"WordPress Acclectic Media Organizer Plugin <= 1.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Acclectic Media","product":"Acclectic Media Organizer","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-58914","published":"2025-09-26T08:31:12.200Z","updated":"2026-04-28T16:13:49.392Z","title":"WordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Di Themes","product":"Di Themes Demo Site Importer","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58917","published":"2025-09-26T08:31:11.603Z","updated":"2026-05-12T01:04:48.541Z","title":"WordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nick Verwymeren","product":"Quantities and Units for WooCommerce","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58919","published":"2025-09-26T08:31:11.008Z","updated":"2026-04-28T16:13:49.522Z","title":"WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"guihom","product":"Wide Banner","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-59012","published":"2025-09-26T08:31:10.301Z","updated":"2026-05-12T01:04:56.111Z","title":"WordPress Traveler theme < 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-59002","published":"2025-09-26T08:31:09.406Z","updated":"2026-04-28T16:13:51.749Z","title":"WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"SeaTheme","product":"BM Content Builder","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-59010","published":"2025-09-26T08:31:08.621Z","updated":"2026-04-28T16:13:51.557Z","title":"WordPress Permalink Manager Lite Plugin <= 2.5.1.3 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"Maciej Bis","product":"Permalink Manager Lite","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2025-59011","published":"2025-09-26T08:31:07.930Z","updated":"2026-05-12T01:05:04.059Z","title":"WordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerability","severity":"HIGH","score":7.5,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-58674","published":"2025-09-23T18:47:02.628Z","updated":"2026-04-28T16:13:46.266Z","title":"WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WordPress","product":"WordPress","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-58246","published":"2025-09-23T17:17:12.399Z","updated":"2026-04-28T16:13:42.821Z","title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WordPress","product":"WordPress","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-58915","published":"2025-09-23T02:08:41.364Z","updated":"2026-04-28T16:13:49.319Z","title":"WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"emarket-design","product":"Request a Quote","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-58956","published":"2025-09-22T18:26:14.211Z","updated":"2026-04-28T16:13:50.408Z","title":"WordPress WP Attractive Donations System Plugin < 1.29 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"loopus","product":"WP Attractive Donations System","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58957","published":"2025-09-22T18:26:13.485Z","updated":"2026-05-13T10:37:54.936Z","title":"WordPress VPSUForm Plugin <= 3.2.20 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Vikas Ratudi","product":"VPSUForm","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58960","published":"2025-09-22T18:26:12.788Z","updated":"2026-05-12T01:02:57.791Z","title":"WordPress IP Based Login Plugin <= 2.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"brijeshk89","product":"IP Based Login","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58962","published":"2025-09-22T18:26:12.090Z","updated":"2026-04-28T16:13:50.395Z","title":"WordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":6.4,"vendor":"publitio","product":"Publitio","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58965","published":"2025-09-22T18:26:11.395Z","updated":"2026-04-28T16:13:50.432Z","title":"WordPress Fusion Page Builder : Extension – Gallery Plugin <= 1.7.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Agency Dominion Inc.","product":"Fusion Page Builder : Extension – Gallery","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58968","published":"2025-09-22T18:26:10.587Z","updated":"2026-04-28T16:13:50.535Z","title":"WordPress MaxiBlocks Plugin <= 2.1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5,"vendor":"Christiaan Pieterse","product":"MaxiBlocks","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-58969","published":"2025-09-22T18:26:09.888Z","updated":"2026-04-28T16:13:50.533Z","title":"WordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Greg Winiarski","product":"Custom Login URL","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58973","published":"2025-09-22T18:26:09.078Z","updated":"2026-04-28T16:13:50.817Z","title":"WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"hashthemes","product":"Easy Elementor Addons","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2025-58974","published":"2025-09-22T18:26:08.404Z","updated":"2026-04-28T16:13:50.809Z","title":"WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StellarWP","product":"WPComplete","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58992","published":"2025-09-22T18:26:07.610Z","updated":"2026-04-28T16:13:51.001Z","title":"WordPress Product Catalog Simple Plugin <= 1.8.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"impleCode","product":"Product Catalog Simple","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-59549","published":"2025-09-22T18:26:06.917Z","updated":"2026-04-28T16:13:52.205Z","title":"WordPress GetResponse Forms Plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fatcatapps","product":"GetResponse Forms","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-59551","published":"2025-09-22T18:26:06.203Z","updated":"2026-04-28T16:13:52.204Z","title":"WordPress Revive.so Plugin <= 2.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Revive.so","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-59552","published":"2025-09-22T18:26:05.516Z","updated":"2026-04-28T16:13:52.230Z","title":"WordPress Save as PDF Plugin <= 4.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pdfcrowd Dev Team","product":"Save as PDF","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-59553","published":"2025-09-22T18:26:04.754Z","updated":"2026-04-28T16:13:52.258Z","title":"WordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Coderz Studio","product":"Custom iFrame for Elementor","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-59559","published":"2025-09-22T18:26:04.049Z","updated":"2026-04-28T16:13:52.595Z","title":"WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"payrexx","product":"Payrexx Payment Gateway for WooCommerce","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-59561","published":"2025-09-22T18:26:03.149Z","updated":"2026-04-28T16:13:52.522Z","title":"WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"hashthemes","product":"Smart Blocks","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-59562","published":"2025-09-22T18:26:02.167Z","updated":"2026-04-28T16:13:52.612Z","title":"WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Kodezen LLC","product":"Academy LMS","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-59565","published":"2025-09-22T18:26:01.225Z","updated":"2026-04-28T16:13:52.513Z","title":"WordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-59567","published":"2025-09-22T18:26:00.403Z","updated":"2026-04-28T16:13:52.619Z","title":"WordPress Coupon Affiliates Plugin <= 6.8.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Elliot Sowersby / RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-59568","published":"2025-09-22T18:25:59.396Z","updated":"2026-04-28T16:13:52.743Z","title":"WordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Zoho Flow","product":"Zoho Flow","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-59569","published":"2025-09-22T18:25:58.616Z","updated":"2026-04-28T16:13:52.675Z","title":"WordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-59570","published":"2025-09-22T18:25:57.912Z","updated":"2026-04-28T16:13:52.685Z","title":"WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-59572","published":"2025-09-22T18:25:57.193Z","updated":"2026-04-28T16:13:52.698Z","title":"WordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"purethemes","product":"WorkScout-Core","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-59573","published":"2025-09-22T18:25:56.508Z","updated":"2026-04-28T16:13:52.686Z","title":"WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-59574","published":"2025-09-22T18:25:55.789Z","updated":"2026-04-28T16:13:52.741Z","title":"WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Travel Engine","product":"WP Travel Engine","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59576","published":"2025-09-22T18:25:55.082Z","updated":"2026-04-28T16:13:52.706Z","title":"WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-59577","published":"2025-09-22T18:25:54.337Z","updated":"2026-04-28T16:13:52.760Z","title":"WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-59581","published":"2025-09-22T18:25:53.535Z","updated":"2026-04-28T16:13:52.951Z","title":"WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VW THEMES","product":"Ibtana","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-59582","published":"2025-09-22T18:25:52.818Z","updated":"2026-04-28T16:13:52.928Z","title":"WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Darren Cooney","product":"Ajax Load More","kev":false,"epss":0.00709,"kevAdded":null},{"id":"CVE-2025-59583","published":"2025-09-22T18:25:52.103Z","updated":"2026-04-28T16:13:52.904Z","title":"WordPress Penci Filter Everything Plugin < 1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Filter Everything","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59584","published":"2025-09-22T18:25:51.403Z","updated":"2026-04-28T16:13:53.085Z","title":"WordPress Penci Podcast Plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Podcast","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59585","published":"2025-09-22T18:25:50.704Z","updated":"2026-04-28T16:13:52.996Z","title":"WordPress Penci Recipe Plugin <= 4.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Recipe","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59586","published":"2025-09-22T18:25:49.991Z","updated":"2026-04-28T16:13:53.214Z","title":"WordPress Penci Portfolio Plugin <= 3.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Portfolio","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59587","published":"2025-09-22T18:25:49.252Z","updated":"2026-04-28T16:13:53.021Z","title":"WordPress Penci Shortcodes & Performance Plugin < 6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Penci Shortcodes & Performance","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59588","published":"2025-09-22T18:25:48.562Z","updated":"2026-04-28T16:13:53.031Z","title":"WordPress Soledad Theme <= 8.6.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"PenciDesign","product":"Soledad","kev":false,"epss":0.00531,"kevAdded":null},{"id":"CVE-2025-59589","published":"2025-09-22T18:25:47.876Z","updated":"2026-05-12T01:04:40.552Z","title":"WordPress Soledad Theme <= 8.6.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PenciDesign","product":"Soledad","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-59590","published":"2025-09-22T18:25:47.186Z","updated":"2026-04-28T16:13:52.995Z","title":"WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-59591","published":"2025-09-22T18:25:46.381Z","updated":"2026-04-28T16:13:53.238Z","title":"WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-59592","published":"2025-09-22T18:25:45.095Z","updated":"2026-04-28T16:13:53.008Z","title":"WordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fernando Acosta","product":"Make Column Clickable Elementor","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-53450","published":"2025-09-22T18:25:44.360Z","updated":"2026-04-28T16:13:25.332Z","title":"WordPress Easy Pricing Table WP Plugin <= 1.1.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Pluginwale","product":"Easy Pricing Table WP","kev":false,"epss":0.00853,"kevAdded":null},{"id":"CVE-2025-53452","published":"2025-09-22T18:25:43.639Z","updated":"2026-04-28T16:13:25.363Z","title":"WordPress Event Rocket Plugin <= 3.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Barry","product":"Event Rocket","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-53451","published":"2025-09-22T18:25:42.941Z","updated":"2026-04-28T16:13:25.334Z","title":"WordPress Mihdan: No External Links Plugin <= 5.1.6.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"mihdan","product":"Mihdan: No External Links","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-53454","published":"2025-09-22T18:25:42.249Z","updated":"2026-04-28T16:13:25.509Z","title":"WordPress Ultimate WP Mail Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rustaurius","product":"Ultimate WP Mail","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-53455","published":"2025-09-22T18:25:41.551Z","updated":"2026-04-28T16:13:25.287Z","title":"WordPress CashBill.pl – Płatności WooCommerce Plugin <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CashBill","product":"CashBill.pl – Płatności WooCommerce","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53456","published":"2025-09-22T18:25:40.829Z","updated":"2026-04-28T16:13:25.355Z","title":"WordPress SEO Backlink Monitor plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"activewebsight","product":"SEO Backlink Monitor","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-53457","published":"2025-09-22T18:25:39.964Z","updated":"2026-04-28T16:13:25.400Z","title":"WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"activewebsight","product":"SEO Backlink Monitor","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-53458","published":"2025-09-22T18:25:39.271Z","updated":"2026-04-28T16:13:25.615Z","title":"WordPress Goracash Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"davaxi","product":"Goracash","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53460","published":"2025-09-22T18:25:37.757Z","updated":"2026-04-28T16:13:25.826Z","title":"WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Syed Balkhi","product":"AffiliateWP – External Referral Links","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53461","published":"2025-09-22T18:25:37.045Z","updated":"2026-04-28T16:13:25.557Z","title":"WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Binsaifullah","product":"Beaf","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-53462","published":"2025-09-22T18:25:36.324Z","updated":"2026-04-28T16:13:25.364Z","title":"WordPress SAPO Feed plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SAPO","product":"SAPO Feed","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53463","published":"2025-09-22T18:25:35.584Z","updated":"2026-04-28T16:13:25.585Z","title":"WordPress HT Mega – Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HT Plugins","product":"HT Mega – Absolute Addons for WPBakery Page Builder","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-53464","published":"2025-09-22T18:25:34.869Z","updated":"2026-04-28T16:13:25.754Z","title":"WordPress WP Mailto Links Plugin <= 3.1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Online Optimisation","product":"WP Mailto Links","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53465","published":"2025-09-22T18:25:34.069Z","updated":"2026-04-28T16:13:25.831Z","title":"WordPress GSheets Connector Plugin <= 1.1.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"raoinfotech","product":"GSheets Connector","kev":false,"epss":0.00636,"kevAdded":null},{"id":"CVE-2025-53466","published":"2025-09-22T18:25:33.335Z","updated":"2026-04-28T16:13:25.903Z","title":"WordPress Better Find and Replace Plugin <= 1.7.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CodeSolz","product":"Better Find and Replace","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53467","published":"2025-09-22T18:25:32.600Z","updated":"2026-04-28T16:13:25.900Z","title":"WordPress Login-Logout Plugin <= 3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"webvitaly","product":"Login-Logout","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53468","published":"2025-09-22T18:25:31.789Z","updated":"2026-04-28T16:13:25.863Z","title":"WordPress Wp tabber widget Plugin <= 4.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"gopiplus@hotmail.com","product":"Wp tabber widget","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-53469","published":"2025-09-22T18:25:31.057Z","updated":"2026-04-28T16:13:26.160Z","title":"WordPress BMI Adult & Kid Calculator Plugin <= 1.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Mortgage Calculator","product":"BMI Adult & Kid Calculator","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-53570","published":"2025-09-22T18:25:30.286Z","updated":"2026-04-28T16:13:26.664Z","title":"WordPress DELUCKS SEO Plugin <= 2.7.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DELUCKS","product":"DELUCKS SEO","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-57898","published":"2025-09-22T18:25:29.576Z","updated":"2026-04-28T16:13:37.747Z","title":"WordPress WP Frontend Admin plugin <= 1.22.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jose Vega","product":"WP Frontend Admin","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-57899","published":"2025-09-22T18:25:28.866Z","updated":"2026-04-28T16:13:37.896Z","title":"WordPress WP Compress Plugin <= 6.50.54 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2025-57900","published":"2025-09-22T18:25:28.140Z","updated":"2026-04-28T16:13:37.879Z","title":"WordPress GutenKit Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ataur R","product":"GutenKit","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-57902","published":"2025-09-22T18:25:26.671Z","updated":"2026-04-28T16:13:37.964Z","title":"WordPress RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Md Taufiqur Rahman","product":"RIS Version Switcher – Downgrade or Upgrade WP Versions Easily","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-57903","published":"2025-09-22T18:25:25.931Z","updated":"2026-04-28T16:13:37.915Z","title":"WordPress WooCommerce Additional Fees On Checkout (Free) plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WPSuperiors Developer","product":"WooCommerce Additional Fees On Checkout (Free)","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57904","published":"2025-09-22T18:25:25.201Z","updated":"2026-04-28T16:13:37.924Z","title":"WordPress Sales Count Manager for WooCommerce plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP-EXPERTS.IN","product":"Sales Count Manager for WooCommerce","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57905","published":"2025-09-22T18:25:24.477Z","updated":"2026-04-28T16:13:37.912Z","title":"WordPress AgreeMe Checkboxes For WooCommerce Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Amin Y","product":"AgreeMe Checkboxes For WooCommerce","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-57906","published":"2025-09-22T18:25:23.589Z","updated":"2026-04-28T16:13:37.898Z","title":"WordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"epeken","product":"Epeken All Kurir","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57907","published":"2025-09-22T18:25:22.792Z","updated":"2026-04-28T16:13:38.077Z","title":"WordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Heureka Group","product":"Heureka","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-57908","published":"2025-09-22T18:25:22.068Z","updated":"2026-04-28T16:13:38.055Z","title":"WordPress Product Time Countdown for WooCommerce plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ProWCPlugins","product":"Product Time Countdown for WooCommerce","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57909","published":"2025-09-22T18:25:21.362Z","updated":"2026-04-28T16:13:37.939Z","title":"WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rouergue Création","product":"Editor Custom Color Palette","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-57910","published":"2025-09-22T18:25:20.606Z","updated":"2026-04-28T16:13:37.929Z","title":"WordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AnyClip Video Platform","product":"AnyClip Luminous Studio","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-57911","published":"2025-09-22T18:25:19.904Z","updated":"2026-04-28T16:13:38.026Z","title":"WordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Adverts","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-57912","published":"2025-09-22T18:25:19.218Z","updated":"2026-04-28T16:13:37.933Z","title":"WordPress Dialogity Free Live Chat plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"dialogity","product":"Dialogity Free Live Chat","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57913","published":"2025-09-22T18:25:18.535Z","updated":"2026-04-28T16:13:38.022Z","title":"WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eleopard","product":"Behance Portfolio Manager","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-57914","published":"2025-09-22T18:25:17.769Z","updated":"2026-04-28T16:13:37.987Z","title":"WordPress Deliver via Shipos for WooCommerce plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Matat Technologies","product":"Deliver via Shipos for WooCommerce","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57915","published":"2025-09-22T18:25:17.020Z","updated":"2026-05-13T00:20:52.508Z","title":"WordPress TOCHAT.BE Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"César Martín","product":"TOCHAT.BE","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57916","published":"2025-09-22T18:25:16.284Z","updated":"2026-04-28T16:13:37.994Z","title":"WordPress WP System Information Plugin <= 1.5 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Nurul Amin","product":"WP System Information","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-57917","published":"2025-09-22T18:25:15.574Z","updated":"2026-04-28T16:13:38.304Z","title":"WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"printcart","product":"Printcart Web to Print Product Designer for WooCommerce","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-57918","published":"2025-09-22T18:25:14.854Z","updated":"2026-05-13T00:20:23.545Z","title":"WordPress LinkedInclude Plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ERA404","product":"LinkedInclude","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-57919","published":"2025-09-22T18:25:14.127Z","updated":"2026-04-28T16:13:38.548Z","title":"WordPress ConveyThis plugin <= 269.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ConveyThis","product":"ConveyThis","kev":false,"epss":0.00667,"kevAdded":null},{"id":"CVE-2025-57920","published":"2025-09-22T18:25:13.281Z","updated":"2026-04-28T16:13:38.550Z","title":"WordPress Category Featured Images Extended Plugin <= 1.52 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CK MacLeod","product":"Category Featured Images Extended","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-57921","published":"2025-09-22T18:25:12.385Z","updated":"2026-05-12T00:52:34.963Z","title":"WordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-57922","published":"2025-09-22T18:25:11.627Z","updated":"2026-04-28T16:13:38.489Z","title":"WordPress Envíos Coordinadora Woocommerce plugin <= 1.1.32 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Coordinadora Mercantil S.A.","product":"Envíos Coordinadora Woocommerce","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-57923","published":"2025-09-22T18:25:10.891Z","updated":"2026-04-28T16:13:38.528Z","title":"WordPress UK Address Postcode Validation plugin <= 3.9.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ideal Postcodes","product":"UK Address Postcode Validation","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-57924","published":"2025-09-22T18:25:10.085Z","updated":"2026-04-28T16:13:38.716Z","title":"WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Automattic","product":"Developer","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57925","published":"2025-09-22T18:25:09.285Z","updated":"2026-04-28T16:13:38.728Z","title":"WordPress immonex Kickstart Team Plugin <= 1.6.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"immonex","product":"immonex Kickstart Team","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2025-57926","published":"2025-09-22T18:25:08.523Z","updated":"2026-05-12T00:52:22.101Z","title":"WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-57927","published":"2025-09-22T18:25:07.755Z","updated":"2026-04-28T16:13:38.828Z","title":"WordPress Dashboard Notepad Plugin <= 1.42 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stephanie Leary","product":"Dashboard Notepad","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57928","published":"2025-09-22T18:25:07.052Z","updated":"2026-04-28T16:13:38.753Z","title":"WordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Strategy11 Team","product":"AWP Classifieds","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-57929","published":"2025-09-22T18:25:06.356Z","updated":"2026-05-13T00:19:52.865Z","title":"WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"kanwei_doublethedonation","product":"Double the Donation","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-57930","published":"2025-09-22T18:25:05.643Z","updated":"2026-04-28T16:13:38.779Z","title":"WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"kanwei_doublethedonation","product":"Double the Donation","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57932","published":"2025-09-22T18:25:04.896Z","updated":"2026-04-28T16:13:38.984Z","title":"WordPress PowerFolio Plugin <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Diego Pereira","product":"PowerFolio","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-57933","published":"2025-09-22T18:25:04.138Z","updated":"2026-04-28T16:13:38.898Z","title":"WordPress Piotnet Forms Plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"piotnetdotcom","product":"Piotnet Forms","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57934","published":"2025-09-22T18:25:03.331Z","updated":"2026-05-13T00:20:09.103Z","title":"WordPress LWS Affiliation Plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Aurélien LWS","product":"LWS Affiliation","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-57935","published":"2025-09-22T18:25:02.588Z","updated":"2026-04-28T16:13:38.887Z","title":"WordPress Bot Block – Stop Spam Referrals in Google Analytics Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ricky Dawn","product":"Bot Block – Stop Spam Referrals in Google Analytics","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-57936","published":"2025-09-22T18:25:01.889Z","updated":"2026-04-28T16:13:38.986Z","title":"WordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meitar","product":"Subresource Integrity (SRI) Manager","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-57937","published":"2025-09-22T18:25:01.184Z","updated":"2026-04-28T16:13:39.116Z","title":"WordPress WPeMatico RSS Feed Fetcher Plugin <= 2.8.10 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"etruel","product":"WPeMatico RSS Feed Fetcher","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-57938","published":"2025-09-22T18:25:00.429Z","updated":"2026-04-28T16:13:39.052Z","title":"WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themewant","product":"Easy Hotel Booking","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-57939","published":"2025-09-22T18:24:59.712Z","updated":"2026-04-28T16:13:39.118Z","title":"WordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Blocksera","product":"Image Hover Effects – Elementor Addon","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-57940","published":"2025-09-22T18:24:59.033Z","updated":"2026-04-28T16:13:39.012Z","title":"WordPress Append extensions on Pages Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Suresh Kumar Mukhiya","product":"Append extensions on Pages","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57941","published":"2025-09-22T18:24:58.342Z","updated":"2026-04-28T16:13:39.107Z","title":"WordPress Append Link on Copy Plugin <= 0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"JonathanMH","product":"Append Link on Copy","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57942","published":"2025-09-22T18:24:57.612Z","updated":"2026-05-12T00:52:41.923Z","title":"WordPress Emergency Password Reset plugin <= 9.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"andy_moyle","product":"Emergency Password Reset","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-57943","published":"2025-09-22T18:24:56.905Z","updated":"2026-04-28T16:13:38.991Z","title":"WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Skimlinks","product":"Skimlinks Affiliate Marketing Tool","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-57944","published":"2025-09-22T18:24:56.211Z","updated":"2026-04-28T16:13:38.991Z","title":"WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Skimlinks","product":"Skimlinks Affiliate Marketing Tool","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-57945","published":"2025-09-22T18:24:55.521Z","updated":"2026-04-28T16:13:39.212Z","title":"WordPress WP Advanced PDF Plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"cedcommerce","product":"WP Advanced PDF","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57946","published":"2025-09-22T18:24:54.835Z","updated":"2026-04-28T16:13:39.222Z","title":"WordPress payOS plugin <= 1.0.73 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Loc Bui","product":"payOS","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-57947","published":"2025-09-22T18:24:54.154Z","updated":"2026-04-28T16:13:39.175Z","title":"WordPress Photo Gallery by Ays Plugin <= 6.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ays Pro","product":"Photo Gallery by Ays","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-57948","published":"2025-09-22T18:24:53.448Z","updated":"2026-04-28T16:13:39.186Z","title":"WordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-57949","published":"2025-09-22T18:24:52.763Z","updated":"2026-05-12T00:52:07.680Z","title":"WordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"oggix","product":"Ongkoskirim.id","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-57950","published":"2025-09-22T18:24:52.056Z","updated":"2026-04-28T16:13:39.207Z","title":"WordPress Plugin Security Scanner Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Glen Scott","product":"Plugin Security Scanner","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57951","published":"2025-09-22T18:24:51.370Z","updated":"2026-04-28T16:13:39.198Z","title":"WordPress SiteNarrator Text-to-Speech Widget Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ken107","product":"SiteNarrator Text-to-Speech Widget","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-57952","published":"2025-09-22T18:24:50.625Z","updated":"2026-04-28T16:13:39.229Z","title":"WordPress Maps for WP Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"icopydoc","product":"Maps for WP","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-57953","published":"2025-09-22T18:24:49.806Z","updated":"2026-04-28T16:13:39.286Z","title":"WordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"100plugins","product":"Open User Map","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-57954","published":"2025-09-22T18:24:49.114Z","updated":"2026-04-28T16:13:39.292Z","title":"WordPress Poll Maker Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ays Pro","product":"Poll Maker","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-57955","published":"2025-09-22T18:24:48.410Z","updated":"2026-04-28T16:13:39.308Z","title":"WordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugin Devs","product":"Post Carousel Slider for Elementor","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-57956","published":"2025-09-22T18:24:47.685Z","updated":"2026-04-28T16:13:39.464Z","title":"WordPress WooMS Plugin <= 9.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpcraft","product":"WooMS","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-57957","published":"2025-09-22T18:24:46.921Z","updated":"2026-04-28T16:13:39.346Z","title":"WordPress WooMS Plugin <= 9.12 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpcraft","product":"WooMS","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-57959","published":"2025-09-22T18:24:45.372Z","updated":"2026-04-28T16:13:39.348Z","title":"WordPress Slightly troublesome permalink Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"tmatsuur","product":"Slightly troublesome permalink","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-57960","published":"2025-09-22T18:24:44.565Z","updated":"2026-04-28T16:13:39.335Z","title":"WordPress Travel Map Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"TravelMap","product":"Travel Map","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-57961","published":"2025-09-22T18:24:43.882Z","updated":"2026-04-28T16:13:39.371Z","title":"WordPress CoDesigner plugin <= 4.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codexpert, Inc","product":"CoDesigner","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-57962","published":"2025-09-22T18:24:43.181Z","updated":"2026-04-28T16:13:39.351Z","title":"WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"e4jvikwp","product":"VikRestaurants","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-57963","published":"2025-09-22T18:24:42.363Z","updated":"2026-04-28T16:13:39.447Z","title":"WordPress Zoho Billing Plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Zoho Subscriptions","product":"Zoho Billing","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-57964","published":"2025-09-22T18:24:41.652Z","updated":"2026-04-28T16:13:39.344Z","title":"WordPress Library Bookshelves Plugin <= 5.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"photonicgnostic","product":"Library Bookshelves","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-57965","published":"2025-09-22T18:24:40.957Z","updated":"2026-04-28T16:13:39.601Z","title":"WordPress WP Proposals Plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP CodeUs","product":"WP Proposals","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-57966","published":"2025-09-22T18:24:40.257Z","updated":"2026-04-28T16:13:39.697Z","title":"WordPress Gallery Lightbox plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GhozyLab","product":"Gallery Lightbox","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2025-57967","published":"2025-09-22T18:24:39.559Z","updated":"2026-04-28T16:13:39.600Z","title":"WordPress WPB Quick View for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPBean","product":"WPB Quick View for WooCommerce","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-57968","published":"2025-09-22T18:24:38.846Z","updated":"2026-04-28T16:13:39.655Z","title":"WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRestaurants","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-57969","published":"2025-09-22T18:24:38.158Z","updated":"2026-04-28T16:13:39.693Z","title":"WordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeremy Saxey","product":"Hide WP Toolbar","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-57970","published":"2025-09-22T18:24:37.463Z","updated":"2026-04-28T16:13:39.641Z","title":"WordPress SALESmanago Plugin <= 3.8.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SALESmanago","product":"SALESmanago & Leadoo","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-57971","published":"2025-09-22T18:24:36.790Z","updated":"2026-04-28T16:13:39.665Z","title":"WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SALESmanago","product":"SALESmanago & Leadoo","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-57972","published":"2025-09-22T18:24:36.102Z","updated":"2026-04-28T16:13:39.645Z","title":"WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFactory","product":"Helpdesk Support Ticket System for WooCommerce","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-57973","published":"2025-09-22T18:24:35.408Z","updated":"2026-04-28T16:13:39.716Z","title":"WordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Chad Butler","product":"WP-Members","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-57974","published":"2025-09-22T18:24:34.679Z","updated":"2026-04-28T16:13:39.808Z","title":"WordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"tuyennv","product":"TZ PlusGallery","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-57975","published":"2025-09-22T18:24:33.974Z","updated":"2026-04-28T16:13:39.843Z","title":"WordPress Team Plugin <= 5.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"RadiusTheme","product":"Team","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-57976","published":"2025-09-22T18:24:33.264Z","updated":"2026-04-28T16:13:39.797Z","title":"WordPress CardCom Payment Gateway plugin <= 3.5.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CardCom","product":"CardCom Payment Gateway","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-57977","published":"2025-09-22T18:24:32.572Z","updated":"2026-04-28T16:13:39.798Z","title":"WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdesk","product":"Flexible PDF Invoices for WooCommerce & WordPress","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-57978","published":"2025-09-22T18:24:31.892Z","updated":"2026-04-28T16:13:39.804Z","title":"WordPress Advanced Appointment Booking & Scheduling plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themespride","product":"Advanced Appointment Booking & Scheduling","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-57979","published":"2025-09-22T18:24:31.213Z","updated":"2026-04-28T16:13:39.771Z","title":"WordPress AuthorSure Plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Russell Jamieson","product":"AuthorSure","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-57980","published":"2025-09-22T18:24:30.525Z","updated":"2026-04-28T16:13:39.822Z","title":"WordPress Safety Exit Plugin <= 1.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tomas Cordero","product":"Safety Exit","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-57981","published":"2025-09-22T18:24:29.794Z","updated":"2026-04-28T16:13:39.873Z","title":"WordPress WP Social Widget Plugin <= 2.3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"catchsquare","product":"WP Social Widget","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-57982","published":"2025-09-22T18:24:29.104Z","updated":"2026-05-13T00:20:38.013Z","title":"WordPress Advance Portfolio Grid plugin <= 1.07.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WPBean","product":"Advance Portfolio Grid","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-57983","published":"2025-09-22T18:24:28.401Z","updated":"2026-05-12T00:52:14.610Z","title":"WordPress BP Disable Activation Reloaded Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Damian","product":"BP Disable Activation Reloaded","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-57984","published":"2025-09-22T18:24:27.700Z","updated":"2026-04-28T16:13:40.048Z","title":"WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Pratik Ghela","product":"MakeStories (for Google Web Stories)","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-57985","published":"2025-09-22T18:24:27.010Z","updated":"2026-04-28T16:13:40.066Z","title":"WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"MantraBrain","product":"Ultimate Watermark","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-57986","published":"2025-09-22T18:24:26.244Z","updated":"2026-04-28T16:13:39.969Z","title":"WordPress WP Subtitle plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"husani","product":"WP Subtitle","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-57987","published":"2025-09-22T18:24:25.391Z","updated":"2026-04-28T16:13:39.994Z","title":"WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"WP Events Manager","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-57988","published":"2025-09-22T18:24:24.325Z","updated":"2026-05-12T00:52:28.507Z","title":"WordPress Uncanny Toolkit for LearnDash Plugin <= 3.7.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-57989","published":"2025-09-22T18:24:23.591Z","updated":"2026-04-28T16:13:40.116Z","title":"WordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brajesh Singh","product":"WordPress Widgets Shortcode","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-57990","published":"2025-09-22T18:24:22.882Z","updated":"2026-04-28T16:13:40.057Z","title":"WordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"solwininfotech","product":"Blog Designer","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-57991","published":"2025-09-22T18:24:22.182Z","updated":"2026-04-28T16:13:40.176Z","title":"WordPress Clariti Plugin <= 1.2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Clariti","product":"Clariti","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-57992","published":"2025-09-22T18:24:21.499Z","updated":"2026-04-28T16:13:40.183Z","title":"WordPress Mail Baby SMTP plugin <= 2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"InterServer","product":"Mail Baby SMTP","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-57993","published":"2025-09-22T18:24:20.824Z","updated":"2026-04-28T16:13:40.176Z","title":"WordPress Geolocation IP Detection plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Benjamin Pick","product":"Geolocation IP Detection","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-57994","published":"2025-09-22T18:24:20.112Z","updated":"2026-04-28T16:13:40.197Z","title":"WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Sayful Islam","product":"Upcoming Events Lists","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-57995","published":"2025-09-22T18:24:19.352Z","updated":"2026-04-28T16:13:40.279Z","title":"WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Detheme","product":"DethemeKit For Elementor","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-57996","published":"2025-09-22T18:24:18.579Z","updated":"2026-04-28T16:13:40.341Z","title":"WordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"matthewordie","product":"Buckets","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-57997","published":"2025-09-22T18:24:17.878Z","updated":"2026-05-13T00:21:07.568Z","title":"WordPress Trustpilot Reviews Plugin <= 2.5.925 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Trustpilot","product":"Trustpilot Reviews","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-57998","published":"2025-09-22T18:24:17.180Z","updated":"2026-04-28T16:13:40.375Z","title":"WordPress E-namad & Shamed Logo Manager Plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Hamid Reza Yazdani","product":"E-namad & Shamed Logo Manager","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-57999","published":"2025-09-22T18:24:16.496Z","updated":"2026-04-28T16:13:40.303Z","title":"WordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpkoithemes","product":"WPKoi Templates for Elementor","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58000","published":"2025-09-22T18:24:15.782Z","updated":"2026-04-28T16:13:40.336Z","title":"WordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"memberful","product":"Memberful - Membership Plugin","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58001","published":"2025-09-22T18:24:15.112Z","updated":"2026-04-28T16:13:40.328Z","title":"WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syed Balkhi","product":"Compact Archives","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58002","published":"2025-09-22T18:24:14.421Z","updated":"2026-04-28T16:13:40.297Z","title":"WordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Milan Petrovic","product":"GD bbPress Tools","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58003","published":"2025-09-22T18:24:13.730Z","updated":"2026-04-28T16:13:40.340Z","title":"WordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"javothemes","product":"Javo Core","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-58004","published":"2025-09-22T18:24:13.034Z","updated":"2026-04-28T16:13:40.351Z","title":"WordPress DriCub Theme <= 2.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SmartDataSoft","product":"DriCub","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58005","published":"2025-09-22T18:24:12.246Z","updated":"2026-04-28T16:13:40.380Z","title":"WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SmartDataSoft","product":"DriCub","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-58006","published":"2025-09-22T18:24:11.573Z","updated":"2026-04-28T16:13:40.516Z","title":"WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Keap/Infusionsoft","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-58007","published":"2025-09-22T18:24:10.886Z","updated":"2026-04-28T16:13:40.505Z","title":"WordPress Social Pug Plugin <= 1.35.2 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"NerdPress","product":"Hubbub Lite","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-58008","published":"2025-09-22T18:24:10.219Z","updated":"2026-04-28T16:13:40.561Z","title":"WordPress Participants Database Plugin <= 2.7.6.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58009","published":"2025-09-22T18:24:09.538Z","updated":"2026-04-28T16:13:40.680Z","title":"WordPress CP Multi View Event Calendar  plugin <= 1.4.35 - Broken Access Control vulnerability","severity":"LOW","score":3.8,"vendor":"codepeople","product":"CP Multi View Event Calendar","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-58010","published":"2025-09-22T18:24:08.832Z","updated":"2026-04-28T16:13:40.632Z","title":"WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"straightvisions GmbH","product":"SV Proven Expert","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58011","published":"2025-09-22T18:24:08.133Z","updated":"2026-04-28T16:13:40.686Z","title":"WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Alex","product":"Content Mask","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-58012","published":"2025-09-22T18:24:07.388Z","updated":"2026-04-28T16:13:40.748Z","title":"WordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"LOW","score":3.8,"vendor":"Alex","product":"Content Mask","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-58013","published":"2025-09-22T18:24:06.573Z","updated":"2026-04-28T16:13:40.698Z","title":"WordPress CouponXxL Theme <= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"pebas","product":"CouponXxL","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-58014","published":"2025-09-22T18:24:05.884Z","updated":"2026-04-28T16:13:40.693Z","title":"WordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58015","published":"2025-09-22T18:24:05.202Z","updated":"2026-05-12T00:55:12.035Z","title":"WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-58016","published":"2025-09-22T18:24:04.419Z","updated":"2026-05-12T01:00:53.803Z","title":"WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codexpert, Inc","product":"CF7 Submissions","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58017","published":"2025-09-22T18:24:03.612Z","updated":"2026-05-13T00:29:20.127Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58018","published":"2025-09-22T18:24:02.853Z","updated":"2026-05-12T01:03:42.853Z","title":"WordPress Mail Subscribe List Plugin <= 2.1.10 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Richard Leishman","product":"Mail Subscribe List","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58019","published":"2025-09-22T18:24:02.055Z","updated":"2026-05-12T00:59:35.022Z","title":"WordPress Search Atlas SEO Plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Search Atlas Group","product":"Search Atlas SEO","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58020","published":"2025-09-22T18:24:00.600Z","updated":"2026-05-12T01:03:28.185Z","title":"WordPress Theater for WordPress plugin <= 0.18.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeroen Schmit","product":"Theater for WordPress","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58021","published":"2025-09-22T18:23:59.812Z","updated":"2026-04-28T16:13:40.777Z","title":"WordPress List Child Pages Shortcode Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"douglaskarr","product":"List Child Pages Shortcode","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58022","published":"2025-09-22T18:23:59.129Z","updated":"2026-05-12T00:58:47.638Z","title":"WordPress ShortCode Plugin <= 0.8.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"maxpagels","product":"ShortCode","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58023","published":"2025-09-22T18:23:58.457Z","updated":"2026-04-28T16:13:40.750Z","title":"WordPress Genealogical Tree plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"akdevs","product":"Genealogical Tree","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-58025","published":"2025-09-22T18:23:57.766Z","updated":"2026-05-13T00:24:07.650Z","title":"WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"averta","product":"Master Slider","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-58026","published":"2025-09-22T18:23:57.052Z","updated":"2026-05-13T00:21:52.323Z","title":"WordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"termageddon","product":"Termageddon: Cookie Consent & Privacy Compliance","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58027","published":"2025-09-22T18:23:56.349Z","updated":"2026-05-13T00:21:22.647Z","title":"WordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpo-HR","product":"NGG Smart Image Search","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58028","published":"2025-09-22T18:23:55.622Z","updated":"2026-05-13T00:24:22.676Z","title":"WordPress Designil PDPA Thailand plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aum Watcharapon","product":"Designil PDPA Thailand","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58029","published":"2025-09-22T18:23:54.917Z","updated":"2026-05-13T00:22:06.926Z","title":"WordPress Classic Widgets with Block-based Widgets Plugin <= 1.0.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Sumit Singh","product":"Classic Widgets with Block-based Widgets","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58030","published":"2025-09-22T18:23:54.215Z","updated":"2026-05-12T00:59:42.016Z","title":"WordPress Page-list Plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webvitaly","product":"Page-list","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58031","published":"2025-09-22T18:23:53.495Z","updated":"2026-05-13T00:25:07.723Z","title":"WordPress Nextend Facebook Connect  Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nextendweb","product":"Nextend Facebook Connect","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58032","published":"2025-09-22T18:23:52.786Z","updated":"2026-04-28T16:13:41.220Z","title":"WordPress WP Compiler Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bytes.co","product":"WP Compiler","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58033","published":"2025-09-22T18:23:52.093Z","updated":"2026-05-12T00:59:14.516Z","title":"WordPress Draft Plugin <= 3.0.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"leeshadle","product":"Draft","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58199","published":"2025-09-22T18:23:51.395Z","updated":"2026-05-12T01:00:24.712Z","title":"WordPress Fastly plugin <= 1.2.28 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Fastly","product":"Fastly","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58200","published":"2025-09-22T18:23:50.528Z","updated":"2026-05-12T00:54:30.505Z","title":"WordPress Flexible FAQ Plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bage","product":"Flexible FAQ","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58219","published":"2025-09-22T18:23:49.798Z","updated":"2026-04-28T16:13:42.324Z","title":"WordPress Show Pages List Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"LIJE","product":"Show Pages List","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58220","published":"2025-09-22T18:23:49.105Z","updated":"2026-05-13T00:29:49.619Z","title":"WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Techeshta","product":"Card Elements for WPBakery","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58221","published":"2025-09-22T18:23:48.408Z","updated":"2026-05-13T00:26:22.488Z","title":"WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ONTRAPORT","product":"PilotPress","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58222","published":"2025-09-22T18:23:47.637Z","updated":"2026-10-05T12:05:45.260Z","title":"WordPress Team Manager plugin <= 2.6.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Dynamic Web Lab","product":"Team Manager","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-58224","published":"2025-09-22T18:23:46.918Z","updated":"2026-04-28T16:13:42.512Z","title":"WordPress Printeers Print & Ship Plugin <= 1.17.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Printeers","product":"Printeers Print & Ship","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-58223","published":"2025-09-22T18:23:46.209Z","updated":"2026-05-13T00:28:49.964Z","title":"WordPress VoucherPress Plugin <= 1.5.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Chris Taylor","product":"VoucherPress","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58226","published":"2025-09-22T18:23:45.494Z","updated":"2026-04-28T16:13:42.380Z","title":"WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iberezansky","product":"3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2025-58227","published":"2025-09-22T18:23:44.741Z","updated":"2026-05-13T00:30:06.070Z","title":"WordPress Podlove Subscribe button Plugin <= 1.3.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Alexander Lueken","product":"Podlove Subscribe button","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58228","published":"2025-09-22T18:23:44.038Z","updated":"2026-05-13T00:24:51.653Z","title":"WordPress Quick View for WooCommerce Plugin <= 2.2.16 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShapedPlugin LLC","product":"Quick View for WooCommerce","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58229","published":"2025-09-22T18:23:43.327Z","updated":"2026-05-12T00:55:18.933Z","title":"WordPress Sitekit Plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webvitaly","product":"Sitekit","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58230","published":"2025-09-22T18:23:42.627Z","updated":"2026-05-13T00:27:07.052Z","title":"WordPress ZoloBlocks plugin <= 2.3.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"ZoloBlocks","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58231","published":"2025-09-22T18:23:41.771Z","updated":"2026-04-28T16:13:42.699Z","title":"WordPress Bitly plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bitlydeveloper","product":"Bitly","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58232","published":"2025-09-22T18:23:40.957Z","updated":"2026-05-12T01:02:51.350Z","title":"WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ickata","product":"Image Editor by Pixo","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58233","published":"2025-09-22T18:23:40.223Z","updated":"2026-05-12T00:59:21.632Z","title":"WordPress SQL Chart Builder Plugin <= 2.3.7.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Guaven Labs","product":"SQL Chart Builder","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58234","published":"2025-09-22T18:23:39.537Z","updated":"2026-05-12T00:59:08.056Z","title":"WordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-58235","published":"2025-09-22T18:23:38.834Z","updated":"2026-05-12T00:55:53.089Z","title":"WordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rustaurius","product":"Front End Users","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58236","published":"2025-09-22T18:23:38.145Z","updated":"2026-05-13T00:28:20.486Z","title":"WordPress Force Update Translations plugin <= 0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mayo Moriyama","product":"Force Update Translations","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58237","published":"2025-09-22T18:23:37.472Z","updated":"2026-05-12T00:59:00.996Z","title":"WordPress LC Wizard plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Niaj Morshed","product":"LC Wizard","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58238","published":"2025-09-22T18:23:36.801Z","updated":"2026-05-12T01:01:00.259Z","title":"WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ONTRAPORT","product":"PilotPress","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58239","published":"2025-09-22T18:23:36.097Z","updated":"2026-05-12T00:58:41.213Z","title":"WordPress WP Category Dropdown Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chandrika Sista","product":"WP Category Dropdown","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58240","published":"2025-09-22T18:23:35.382Z","updated":"2026-05-12T01:00:39.212Z","title":"WordPress xili-tidy-tags Plugin <= 1.12.06 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Michel - xiligroup dev","product":"xili-tidy-tags","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-58241","published":"2025-09-22T18:23:34.545Z","updated":"2026-05-12T00:56:39.406Z","title":"WordPress SnapWidget Social Photo Feed Widget Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"snapwidget","product":"SnapWidget Social Photo Feed Widget","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58242","published":"2025-09-22T18:23:33.728Z","updated":"2026-04-28T16:13:42.778Z","title":"WordPress Bg Church Memos Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vadim Bogaiskov","product":"Bg Church Memos","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58244","published":"2025-09-22T18:23:32.971Z","updated":"2026-05-13T00:22:38.128Z","title":"WordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"Anps","product":"Constructo","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-58245","published":"2025-09-22T18:23:32.245Z","updated":"2026-05-12T00:55:46.100Z","title":"WordPress Portfolio  Plugin <= 2.58 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"bestweblayout","product":"Portfolio","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58247","published":"2025-09-22T18:23:31.503Z","updated":"2026-04-28T16:13:42.806Z","title":"WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-58248","published":"2025-09-22T18:23:30.792Z","updated":"2026-05-12T00:54:58.142Z","title":"WordPress Pinterest Pinboard Widget Plugin <= 1.0.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codefish","product":"Pinterest Pinboard Widget","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58249","published":"2025-09-22T18:23:30.092Z","updated":"2026-05-12T00:54:37.367Z","title":"WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Qubely","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-58250","published":"2025-09-22T18:23:29.373Z","updated":"2026-05-12T01:04:04.704Z","title":"WordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"ApusTheme","product":"Findgo","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-58251","published":"2025-09-22T18:23:28.681Z","updated":"2026-05-12T01:00:47.266Z","title":"WordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"POSIMYTH","product":"Sticky Header Effects for Elementor","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58252","published":"2025-09-22T18:23:27.989Z","updated":"2026-05-12T01:04:18.097Z","title":"WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"jetmonsters","product":"Getwid","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-58253","published":"2025-09-22T18:23:27.273Z","updated":"2026-04-28T16:13:43.635Z","title":"WordPress Real Estate Manager Plugin <= 7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58254","published":"2025-09-22T18:23:26.587Z","updated":"2026-05-13T00:24:37.230Z","title":"WordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dtbaker","product":"StylePress for Elementor","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58255","published":"2025-09-22T18:23:25.841Z","updated":"2026-05-12T00:56:32.919Z","title":"WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"CRITICAL","score":9.6,"vendor":"yonisink","product":"Custom Post Type Images","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-58256","published":"2025-09-22T18:23:24.872Z","updated":"2026-04-28T16:13:43.065Z","title":"WordPress DOAJ Export Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jonathan Brinley","product":"DOAJ Export","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58257","published":"2025-09-22T18:23:24.186Z","updated":"2026-05-12T01:03:05.229Z","title":"WordPress Verowa Connect plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Picture-Planet GmbH","product":"Verowa Connect","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58258","published":"2025-09-22T18:23:23.450Z","updated":"2026-04-28T16:13:43.331Z","title":"WordPress Lazy Blocks Plugin <= 4.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"nK","product":"Lazy Blocks","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-58259","published":"2025-09-22T18:23:22.764Z","updated":"2026-04-28T16:13:43.000Z","title":"WordPress Nokri Theme <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"Nokri","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-58260","published":"2025-09-22T18:23:22.061Z","updated":"2026-05-12T00:56:46.289Z","title":"WordPress Highlight and Share – Social Text and Image Sharing plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ronald Huereca","product":"Highlight and Share","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58261","published":"2025-09-22T18:23:21.359Z","updated":"2026-04-28T16:13:43.457Z","title":"WordPress Mavis HTTPS to HTTP Redirection Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"PressPage Entertainment Inc","product":"Mavis HTTPS to HTTP Redirection","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58262","published":"2025-09-22T18:23:20.657Z","updated":"2026-04-28T16:13:43.457Z","title":"WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDirectoryKit","product":"Sweet Energy Efficiency","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58263","published":"2025-09-22T18:23:19.933Z","updated":"2026-05-13T00:27:35.968Z","title":"WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BuddyDev","product":"BuddyPress Notification Widget","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58264","published":"2025-09-22T18:23:19.209Z","updated":"2026-05-12T01:03:49.259Z","title":"WordPress JupiterX Core Plugin <= 4.11.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"artbees","product":"JupiterX Core","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58265","published":"2025-09-22T18:23:18.432Z","updated":"2026-05-12T01:03:12.763Z","title":"WordPress Events Manager – OpenStreetMaps Plugin <= 4.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stonehenge Creations","product":"Events Manager – OpenStreetMaps","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58266","published":"2025-09-22T18:23:17.641Z","updated":"2026-05-13T00:25:52.289Z","title":"WordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Fumiki Takahashi","product":"Gianism","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58267","published":"2025-09-22T18:23:16.939Z","updated":"2026-04-28T16:13:43.418Z","title":"WordPress Stock Message Plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Aftabul Islam","product":"Stock Message","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58268","published":"2025-09-22T18:23:16.256Z","updated":"2026-05-13T00:27:50.490Z","title":"WordPress WPMK PDF Generator Plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMK","product":"WPMK PDF Generator","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58269","published":"2025-09-22T18:23:15.563Z","updated":"2026-05-13T00:21:37.687Z","title":"WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-58270","published":"2025-09-22T18:23:14.848Z","updated":"2026-04-28T16:13:43.804Z","title":"WordPress NIX Anti-Spam Light Plugin <= 0.0.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"NIX Solutions Ltd","product":"NIX Anti-Spam Light","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58271","published":"2025-09-22T18:23:14.150Z","updated":"2026-05-12T01:00:11.157Z","title":"WordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"AnyClip Video Platform","product":"AnyClip Luminous Studio","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58645","published":"2025-09-22T18:23:13.455Z","updated":"2026-05-12T01:00:03.771Z","title":"WordPress Gravitate Automated Tester Plugin <= 1.4.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Gravitate","product":"Gravitate Automated Tester","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58646","published":"2025-09-22T18:23:12.752Z","updated":"2026-05-12T00:56:19.973Z","title":"WordPress Mobi2Go Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"chtombleson","product":"Mobi2Go","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58647","published":"2025-09-22T18:23:12.067Z","updated":"2026-05-13T00:29:35.137Z","title":"WordPress Simple Restaurant Menu Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Will.I.am","product":"Simple Restaurant Menu","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58648","published":"2025-09-22T18:23:11.372Z","updated":"2026-05-13T00:30:50.266Z","title":"WordPress Simple JWT Login plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nicu Micle","product":"Simple JWT Login","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58649","published":"2025-09-22T18:23:10.684Z","updated":"2026-04-28T16:13:45.010Z","title":"WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"All In One SEO Pack","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-58650","published":"2025-09-22T18:23:09.950Z","updated":"2026-05-12T01:04:26.563Z","title":"WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Syed Balkhi","product":"All In One SEO Pack","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58651","published":"2025-09-22T18:23:09.260Z","updated":"2026-05-12T01:04:32.988Z","title":"WordPress PlayerJS Plugin <= 2.24 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PlayerJS","product":"PlayerJS","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58652","published":"2025-09-22T18:23:08.515Z","updated":"2026-05-13T00:28:35.478Z","title":"WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Carousel Ultimate","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58653","published":"2025-09-22T18:23:07.787Z","updated":"2026-05-12T00:54:51.178Z","title":"WordPress JSM file_get_contents() Shortcode Plugin <= 2.7.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"JS Morisset","product":"JSM file_get_contents() Shortcode","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58654","published":"2025-09-22T18:23:07.067Z","updated":"2026-05-13T00:26:37.484Z","title":"WordPress xili-language Plugin <= 2.21.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Michel - xiligroup dev","product":"xili-language","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58655","published":"2025-09-22T18:23:06.341Z","updated":"2026-05-13T00:22:22.579Z","title":"WordPress Category Featured Images Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Mat","product":"Category Featured Images","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58656","published":"2025-09-22T18:23:05.602Z","updated":"2026-05-12T00:55:05.565Z","title":"WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Risto Niinemets","product":"Estonian Shipping Methods for WooCommerce","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-58657","published":"2025-09-22T18:23:04.905Z","updated":"2026-04-28T16:13:45.728Z","title":"WordPress Grid plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"EdwardBock","product":"Grid","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58658","published":"2025-09-22T18:23:04.159Z","updated":"2026-05-12T00:55:38.670Z","title":"WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Proof Factor LLC","product":"Proof Factor – Social Proof Notifications","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58659","published":"2025-09-22T18:23:03.398Z","updated":"2026-05-12T00:56:13.098Z","title":"WordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Essekia","product":"Helpie FAQ","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-58660","published":"2025-09-22T18:23:02.675Z","updated":"2026-05-12T00:56:26.427Z","title":"WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"brandexponents","product":"Oshine Core","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58661","published":"2025-09-22T18:23:01.600Z","updated":"2026-05-13T00:23:37.708Z","title":"WordPress eZee Online Hotel Booking Engine Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"eZee Technosys","product":"eZee Online Hotel Booking Engine","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58662","published":"2025-09-22T18:23:00.733Z","updated":"2026-05-13T00:23:08.190Z","title":"WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":7.2,"vendor":"awesomesupport","product":"Awesome Support","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-58663","published":"2025-09-22T18:22:59.929Z","updated":"2026-05-12T00:59:49.064Z","title":"WordPress Qubely Plugin <= 1.8.14 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Qubely","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58664","published":"2025-09-22T18:22:59.234Z","updated":"2026-05-13T00:22:53.711Z","title":"WordPress Text To Speech TTS Accessibility plugin <= 1.9.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Azizul Hasan","product":"Text To Speech TTS Accessibility","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58665","published":"2025-09-22T18:22:58.496Z","updated":"2026-05-12T00:58:54.557Z","title":"WordPress Form Generator for WordPress Plugin <= 1.52 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"tmontg1","product":"Form Generator for WordPress","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58666","published":"2025-09-22T18:22:57.761Z","updated":"2026-04-28T16:13:46.252Z","title":"WordPress Website Chat Button: Kommo integration Plugin <= 1.3.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kommo","product":"Website Chat Button: Kommo integration","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-58667","published":"2025-09-22T18:22:57.037Z","updated":"2026-05-12T00:56:06.686Z","title":"WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CridioStudio","product":"ListingPro Reviews","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58668","published":"2025-09-22T18:22:56.277Z","updated":"2026-05-13T00:23:23.177Z","title":"WordPress WPLMS  theme <= 4.970 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2025-58669","published":"2025-09-22T18:22:55.556Z","updated":"2026-04-28T16:13:45.917Z","title":"WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Modern Minds","product":"Magento 2 WordPress Integration","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58670","published":"2025-09-22T18:22:54.873Z","updated":"2026-05-12T00:54:44.239Z","title":"WordPress WP Content Protection Plugin <= 1.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Shankaranand Maurya","product":"WP Content Protection","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58671","published":"2025-09-22T18:22:54.155Z","updated":"2026-05-13T10:38:53.593Z","title":"WordPress Auction Feed plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"morganrichards","product":"Auction Feed","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-58672","published":"2025-09-22T18:22:53.444Z","updated":"2026-05-13T10:38:22.225Z","title":"WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58673","published":"2025-09-22T18:22:52.728Z","updated":"2026-05-12T00:59:28.051Z","title":"WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-58675","published":"2025-09-22T18:22:52.004Z","updated":"2026-05-13T10:38:12.255Z","title":"WordPress Interact: Embed A Quiz On Your Site Plugin <= 3.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tryinteract","product":"Interact: Embed A Quiz On Your Site","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58676","published":"2025-09-22T18:22:51.242Z","updated":"2026-05-12T01:03:35.872Z","title":"WordPress HORIZONTAL SLIDER Plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"extendyourweb","product":"HORIZONTAL SLIDER","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58677","published":"2025-09-22T18:22:50.547Z","updated":"2026-05-13T10:37:32.379Z","title":"WordPress ShrinkTheWeb (STW) Website Previews Plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"puravida1976","product":"ShrinkTheWeb (STW) Website Previews","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58678","published":"2025-09-22T18:22:49.836Z","updated":"2026-04-28T16:13:46.323Z","title":"WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-58679","published":"2025-09-22T18:22:49.143Z","updated":"2026-04-28T16:13:46.213Z","title":"WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AppMySite","product":"AppMySite","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-58680","published":"2025-09-22T18:22:48.456Z","updated":"2026-05-12T01:03:21.947Z","title":"WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gutentor","product":"Gutentor","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-58681","published":"2025-09-22T18:22:47.741Z","updated":"2026-05-12T00:55:59.511Z","title":"WordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jürgen Müller","product":"Easy Quotes","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-58682","published":"2025-09-22T18:22:47.027Z","updated":"2026-04-28T16:13:46.350Z","title":"WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Timur Kamaev","product":"Kama Click Counter","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58683","published":"2025-09-22T18:22:46.342Z","updated":"2026-05-12T01:00:31.713Z","title":"WordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Luke Mlsna","product":"Last Updated Shortcode","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58684","published":"2025-09-22T18:22:45.607Z","updated":"2026-05-12T00:55:32.250Z","title":"WordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Logo Showcase","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58685","published":"2025-09-22T18:22:44.927Z","updated":"2026-05-13T00:23:52.157Z","title":"WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"cecabank","product":"Cecabank WooCommerce Plugin","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58686","published":"2025-09-22T18:22:44.235Z","updated":"2026-05-13T10:38:32.784Z","title":"WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"quadlayers","product":"Perfect Brands for WooCommerce","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-58687","published":"2025-09-22T18:22:43.494Z","updated":"2026-05-12T00:55:25.324Z","title":"WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WP CMS Ninja","product":"Current Age Plugin","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58688","published":"2025-09-22T18:22:42.457Z","updated":"2026-05-13T10:38:43.439Z","title":"WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Casengo","product":"Casengo Live Chat Support","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58689","published":"2025-09-22T18:22:41.078Z","updated":"2026-05-13T10:37:41.528Z","title":"WordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tapfiliate","product":"Tapfiliate","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58691","published":"2025-09-22T18:22:39.577Z","updated":"2026-05-12T01:04:11.099Z","title":"WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Russell Jamieson","product":"Genesis Club Lite","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58690","published":"2025-09-22T18:22:38.377Z","updated":"2026-05-12T00:59:55.980Z","title":"WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ptibogxiv","product":"Doliconnect","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58702","published":"2025-09-22T18:22:37.189Z","updated":"2026-05-13T10:39:02.340Z","title":"WordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WebWizards","product":"MarketKing","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58703","published":"2025-09-22T18:22:36.452Z","updated":"2026-04-28T16:13:46.954Z","title":"WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"skyword","product":"Skyword API Plugin","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58704","published":"2025-09-22T18:22:35.609Z","updated":"2026-05-12T01:03:57.417Z","title":"WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ren Ventura","product":"WP Delete User Accounts","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58975","published":"2025-09-09T16:33:19.818Z","updated":"2026-04-28T16:13:50.829Z","title":"WordPress Advanced Settings Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Helmut Wandl","product":"Advanced Settings","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-58976","published":"2025-09-09T16:33:19.215Z","updated":"2026-04-28T16:13:50.851Z","title":"WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Equalize Digital","product":"Accessibility Checker by Equalize Digital","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-58977","published":"2025-09-09T16:33:18.652Z","updated":"2026-04-28T16:13:50.810Z","title":"WordPress WP eBay Product Feeds Plugin <= 3.4.8 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Rhys Wynne","product":"WP eBay Product Feeds","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-58978","published":"2025-09-09T16:33:18.016Z","updated":"2026-04-28T16:13:50.900Z","title":"WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Swings","product":"PDF Generator for WordPress","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-58979","published":"2025-09-09T16:33:17.357Z","updated":"2026-04-28T16:13:50.854Z","title":"WordPress BerqWP Plugin <= 2.2.53 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BerqWP","product":"BerqWP","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58980","published":"2025-09-09T16:33:16.719Z","updated":"2026-04-28T16:13:50.870Z","title":"WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"recorp","product":"Export WP Page to Static HTML/CSS","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-58981","published":"2025-09-09T16:33:16.157Z","updated":"2026-04-28T16:13:50.819Z","title":"WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Equalize Digital","product":"Accessibility Checker by Equalize Digital","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-58982","published":"2025-09-09T16:33:15.530Z","updated":"2026-04-28T16:13:50.830Z","title":"WordPress Pixeline's Email Protector Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"pixeline","product":"Pixeline's Email Protector","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58983","published":"2025-09-09T16:33:14.876Z","updated":"2026-04-28T16:13:50.869Z","title":"WordPress Include Me Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Stefano Lissa","product":"Include Me","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58984","published":"2025-09-09T16:33:14.025Z","updated":"2026-04-28T16:13:50.817Z","title":"WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58985","published":"2025-09-09T16:33:12.994Z","updated":"2026-04-28T16:13:50.806Z","title":"WordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Additional Custom Product Tabs for WooCommerce","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58987","published":"2025-09-09T16:33:11.940Z","updated":"2026-04-28T16:13:50.845Z","title":"WordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AntoineH","product":"Football Pool","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58988","published":"2025-09-09T16:33:10.849Z","updated":"2026-04-28T16:13:50.860Z","title":"WordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Joe Dolson","product":"My Tickets","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58989","published":"2025-09-09T16:33:09.557Z","updated":"2026-04-28T16:13:50.867Z","title":"WordPress Dynamic Text Field For Contact Form 7 Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"silverplugins217","product":"Dynamic Text Field For Contact Form 7","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58991","published":"2025-09-09T16:33:08.560Z","updated":"2026-04-28T16:13:50.947Z","title":"WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Cristiano Zanca","product":"WooCommerce Booking Bundle Hours","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2025-58990","published":"2025-09-09T16:33:07.863Z","updated":"2026-04-28T16:13:50.905Z","title":"WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DevItems","product":"ShopLentor","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-58993","published":"2025-09-09T16:33:07.244Z","updated":"2026-04-28T16:13:51.323Z","title":"WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-58997","published":"2025-09-09T16:33:06.682Z","updated":"2026-04-28T16:13:51.884Z","title":"WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Frenify","product":"Mow","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-53303","published":"2025-09-09T16:26:05.281Z","updated":"2026-04-28T16:13:23.231Z","title":"WordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeMove","product":"ThemeMove Core","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-58215","published":"2025-09-09T16:26:04.720Z","updated":"2026-04-28T16:13:42.298Z","title":"WordPress Ziston Theme < 1.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Ziston","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-48101","published":"2025-09-09T16:26:04.152Z","updated":"2026-04-28T16:12:51.212Z","title":"WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"webdevstudios","product":"Constant Contact for WordPress","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-49430","published":"2025-09-09T16:26:03.584Z","updated":"2026-04-28T16:13:04.761Z","title":"WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"HIGH","score":7.2,"vendor":"FWDesign","product":"Ultimate Video Player","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-30875","published":"2025-09-09T16:25:35.480Z","updated":"2026-04-28T16:11:59.378Z","title":"WordPress WP Weixin plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Alexandre Froger","product":"WP Weixin","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-53291","published":"2025-09-09T16:25:34.828Z","updated":"2026-04-28T16:13:22.736Z","title":"WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"spoddev2021","product":"Spreadconnect","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-53340","published":"2025-09-09T16:25:34.207Z","updated":"2026-05-12T00:51:47.060Z","title":"WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"awesomesupport","product":"Awesome Support","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-53348","published":"2025-09-09T16:25:33.561Z","updated":"2026-04-29T09:51:55.580Z","title":"WordPress Kalium Theme <= 3.18.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Laborator","product":"Kalium","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-54709","published":"2025-09-09T16:25:32.947Z","updated":"2026-04-28T16:13:35.835Z","title":"WordPress Sala Theme <= 1.1.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"uxper","product":"Sala","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-32486","published":"2025-09-09T16:25:32.379Z","updated":"2026-04-28T16:12:22.677Z","title":"WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hossein","product":"Material Dashboard","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-32689","published":"2025-09-09T16:25:31.773Z","updated":"2026-04-29T09:51:54.931Z","title":"WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerability","severity":"HIGH","score":7.5,"vendor":"Convers Lab","product":"WP SmartPay","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-32688","published":"2025-09-09T16:25:31.186Z","updated":"2026-04-28T16:12:28.437Z","title":"WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nebojsa","product":"Target Video Easy Publish","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-39523","published":"2025-09-09T16:25:30.625Z","updated":"2026-04-28T16:12:34.027Z","title":"WordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"GoodBarber","product":"GoodBarber","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-39541","published":"2025-09-09T16:25:30.058Z","updated":"2026-04-28T16:12:34.313Z","title":"WordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roland Murg","product":"WP Simple Booking Calendar","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-39553","published":"2025-09-09T16:25:29.464Z","updated":"2026-04-28T16:12:34.618Z","title":"WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-47437","published":"2025-09-09T16:25:28.839Z","updated":"2026-04-28T16:12:40.745Z","title":"WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"LiteSpeed Technologies","product":"LiteSpeed Cache","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-47569","published":"2025-09-09T16:25:28.252Z","updated":"2026-04-28T16:12:45.018Z","title":"WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPSwings","product":"WooCommerce Ultimate Gift Card","kev":false,"epss":0.00621,"kevAdded":null},{"id":"CVE-2025-47570","published":"2025-09-09T16:25:27.645Z","updated":"2026-04-28T16:12:45.420Z","title":"WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"villatheme","product":"WooCommerce Photo Reviews","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-47571","published":"2025-09-09T16:25:27.014Z","updated":"2026-04-28T16:12:45.340Z","title":"WordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2025-47579","published":"2025-09-09T16:25:26.385Z","updated":"2026-04-28T16:12:45.844Z","title":"WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-47694","published":"2025-09-09T16:25:25.744Z","updated":"2026-04-28T16:12:50.221Z","title":"WordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"solwin","product":"Blog Designer PRO","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-47695","published":"2025-09-09T16:25:25.028Z","updated":"2026-05-12T00:51:53.649Z","title":"WordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"solwin","product":"Blog Designer PRO","kev":false,"epss":0.00641,"kevAdded":null},{"id":"CVE-2025-49860","published":"2025-09-09T16:25:24.391Z","updated":"2026-05-12T00:52:00.316Z","title":"WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-59005","published":"2025-09-09T16:25:21.548Z","updated":"2026-04-28T16:13:51.454Z","title":"WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"frenify","product":"Categorify","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-59008","published":"2025-09-09T16:25:20.873Z","updated":"2026-04-28T16:13:51.876Z","title":"WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PressTigers","product":"ZIP Code Based Content Protection","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-27003","published":"2025-09-05T16:18:21.182Z","updated":"2026-04-28T16:11:46.315Z","title":"WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"fullworks","product":"Quick Paypal Payments","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-53571","published":"2025-09-05T16:18:14.783Z","updated":"2026-04-28T16:13:26.595Z","title":"WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"HAPPY","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-58206","published":"2025-09-05T16:18:13.178Z","updated":"2026-05-12T00:50:31.081Z","title":"WordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"MaxCoach","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-58214","published":"2025-09-05T16:18:12.665Z","updated":"2026-05-12T00:47:48.363Z","title":"WordPress Indutri Theme < 1.3.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Indutri","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-58628","published":"2025-09-05T16:17:55.088Z","updated":"2026-04-28T16:13:44.381Z","title":"WordPress Miraculous Theme < 2.0.9 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"kamleshyadav","product":"Miraculous","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-48102","published":"2025-09-05T16:15:43.514Z","updated":"2026-04-28T16:12:51.255Z","title":"WordPress GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"gourl","product":"GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-48103","published":"2025-09-05T16:15:42.975Z","updated":"2026-05-12T00:51:40.403Z","title":"WordPress Today's Date Inserter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mulscully","product":"Today's Date Inserter","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-48104","published":"2025-09-05T16:15:42.454Z","updated":"2026-04-28T16:12:51.664Z","title":"WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ericzane","product":"Floating Window Music Player","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-48105","published":"2025-09-05T16:15:41.940Z","updated":"2026-04-28T16:12:51.318Z","title":"WordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vincent Boiardt","product":"Easy Flash Embed","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-48317","published":"2025-09-05T16:15:41.410Z","updated":"2026-04-28T16:12:56.126Z","title":"WordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal Vulnerability","severity":"HIGH","score":7.5,"vendor":"Stefan Keller","product":"WooCommerce Payment Gateway for Saferpay","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2025-49401","published":"2025-09-05T16:15:40.868Z","updated":"2026-04-28T16:13:03.429Z","title":"WordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"smart SEO","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2025-53307","published":"2025-09-05T16:15:40.336Z","updated":"2026-04-28T16:13:23.508Z","title":"WordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Beaver Builder","product":"WordPress Assistant","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-54744","published":"2025-09-05T16:15:39.296Z","updated":"2026-04-28T16:13:36.753Z","title":"WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-57889","published":"2025-09-05T16:15:38.723Z","updated":"2026-05-13T00:11:41.122Z","title":"WordPress InPost Gallery Plugin <= 2.1.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"RealMag777","product":"InPost Gallery","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-58887","published":"2025-09-05T13:45:53.670Z","updated":"2026-04-28T16:13:49.173Z","title":"WordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Course Finder | andré martin - it solutions & research UG","product":"Course Booking Platform","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58886","published":"2025-09-05T13:45:53.126Z","updated":"2026-04-28T16:13:49.106Z","title":"WordPress Instant Locations Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tan Nguyen","product":"Instant Locations","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-58884","published":"2025-09-05T13:45:52.562Z","updated":"2026-04-28T16:13:49.106Z","title":"WordPress vipdrv Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ivan Drago","product":"vipdrv","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-58883","published":"2025-09-05T13:45:52.040Z","updated":"2026-04-28T16:13:49.055Z","title":"WordPress Search Cloud One Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Thomas Harris","product":"Search Cloud One","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-58882","published":"2025-09-05T13:45:51.510Z","updated":"2026-04-28T16:13:49.067Z","title":"WordPress Simple Text Slider Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"w1zzard","product":"Simple Text Slider","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58881","published":"2025-09-05T13:45:50.949Z","updated":"2026-04-28T16:13:48.994Z","title":"WordPress New Simple Gallery Plugin <= 8.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"gopiplus","product":"New Simple Gallery","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-58880","published":"2025-09-05T13:45:50.272Z","updated":"2026-05-13T00:15:08.407Z","title":"WordPress Translate This gTranslate Shortcode Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"reubenthiessen","product":"Translate This gTranslate Shortcode","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58878","published":"2025-09-05T13:45:49.748Z","updated":"2026-04-28T16:13:48.942Z","title":"WordPress Woocommerce Gifts Product Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"usamafarooq","product":"Woocommerce Gifts Product","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-58876","published":"2025-09-05T13:45:49.200Z","updated":"2026-05-12T00:46:50.459Z","title":"WordPress Aparat Video Shortcode Plugin <= 0.2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ali Aghdam","product":"Aparat Video Shortcode","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58875","published":"2025-09-05T13:45:48.650Z","updated":"2026-04-28T16:13:48.990Z","title":"WordPress WP Github Gist Plugin <= 0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sudar Muthu","product":"WP Github Gist","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58874","published":"2025-09-05T13:45:48.108Z","updated":"2026-04-28T16:13:48.924Z","title":"WordPress StoryMap Plugin <= 2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"josepsitjar","product":"StoryMap","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58873","published":"2025-09-05T13:45:47.524Z","updated":"2026-05-12T00:42:57.367Z","title":"WordPress Pushe Web Push Notification Plugin <= 0.5.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"pusheco","product":"Pushe Web Push Notification","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-58872","published":"2025-09-05T13:45:46.869Z","updated":"2026-05-12T00:47:55.929Z","title":"WordPress Simple Price Calculator Plugin <= 1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"premiumbizthemes","product":"Simple Price Calculator","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-58871","published":"2025-09-05T13:45:46.319Z","updated":"2026-05-12T00:47:33.703Z","title":"WordPress Master Paper Collapse Toggle Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Luis Rock","product":"Master Paper Collapse Toggle","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58870","published":"2025-09-05T13:45:45.725Z","updated":"2026-05-13T00:19:07.837Z","title":"WordPress WP-GraphViz Plugin <= 1.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DeBAAT","product":"WP-GraphViz","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58869","published":"2025-09-05T13:45:44.576Z","updated":"2026-05-12T00:42:50.425Z","title":"WordPress SimaCookie Plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Simasicher","product":"SimaCookie","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2025-58868","published":"2025-09-05T13:45:44.069Z","updated":"2026-05-13T00:14:22.564Z","title":"WordPress SimaCookie Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Simasicher","product":"SimaCookie","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58867","published":"2025-09-05T13:45:43.560Z","updated":"2026-04-28T16:13:48.748Z","title":"WordPress Easy Download Media Counter Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Remi Corson","product":"Easy Download Media Counter","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58866","published":"2025-09-05T13:45:43.028Z","updated":"2026-05-12T00:47:25.466Z","title":"WordPress Site Info Plugin <= 1.1 - Sensitive Data Exposure Vulnerability","severity":"LOW","score":2.7,"vendor":"Rami Yushuvaev","product":"Site Info","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-58865","published":"2025-09-05T13:45:42.518Z","updated":"2026-05-13T00:12:39.021Z","title":"WordPress Compact Admin plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"reimund","product":"Compact Admin","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-58864","published":"2025-09-05T13:45:41.996Z","updated":"2026-05-13T00:17:50.845Z","title":"WordPress 金数据 Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iamroody","product":"金数据","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58863","published":"2025-09-05T13:45:41.469Z","updated":"2026-04-28T16:13:48.706Z","title":"WordPress Zoomify embed for WP Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SdeWijs","product":"Zoomify embed for WP","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58862","published":"2025-09-05T13:45:40.941Z","updated":"2026-05-13T00:17:35.853Z","title":"WordPress WordPress Events Calendar Plugin – connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"George Sexton","product":"WordPress Events Calendar Plugin – connectDaily","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58861","published":"2025-09-05T13:45:40.419Z","updated":"2026-05-13T00:13:36.869Z","title":"WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Corner","product":"Quick Event Calendar","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-58860","published":"2025-09-05T13:45:39.883Z","updated":"2026-05-12T00:43:45.241Z","title":"WordPress Enable Latex Plugin <= 1.2.16 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"KaizenCoders","product":"Enable Latex","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-58859","published":"2025-09-05T13:45:39.384Z","updated":"2026-04-28T16:13:48.719Z","title":"WordPress Add to Feedly Plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"David Merinas","product":"Add to Feedly","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-58858","published":"2025-09-05T13:45:38.876Z","updated":"2026-05-13T00:11:55.592Z","title":"WordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPBean","product":"WPB Image Widget","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58857","published":"2025-09-05T13:45:38.350Z","updated":"2026-05-12T00:44:49.884Z","title":"WordPress Table of content Plugin <= 1.5.3.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"KaizenCoders","product":"Table of content","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-58856","published":"2025-09-05T13:45:37.815Z","updated":"2026-05-13T00:16:51.306Z","title":"WordPress Woocommerce Notify Updated Product Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ablancodev","product":"Woocommerce Notify Updated Product","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58855","published":"2025-09-05T13:45:37.288Z","updated":"2026-05-13T00:19:38.448Z","title":"WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Denis V (Artprima)","product":"AP HoneyPot WordPress Plugin","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-58854","published":"2025-09-05T13:45:36.764Z","updated":"2026-05-13T00:14:37.080Z","title":"WordPress Ultimate AJAX Login Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Samer Bechara","product":"Ultimate AJAX Login","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58853","published":"2025-09-05T13:45:36.247Z","updated":"2026-05-12T00:48:29.763Z","title":"WordPress Popping Sidebars and Widgets Light Plugin <= 1.27 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Popping Sidebars and Widgets Light","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58852","published":"2025-09-05T13:45:35.725Z","updated":"2026-05-13T00:17:21.390Z","title":"WordPress MSTW League Manager Plugin <= 2.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Mark O'Donnell","product":"MSTW League Manager","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58851","published":"2025-09-05T13:45:35.217Z","updated":"2026-04-28T16:13:48.612Z","title":"WordPress Boxed Content Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DigitalCourt","product":"Boxed Content","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58850","published":"2025-09-05T13:45:34.689Z","updated":"2026-04-28T16:13:48.725Z","title":"WordPress Showpass WordPress Extension Plugin <= 4.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"marcshowpass","product":"Showpass WordPress Extension","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58849","published":"2025-09-05T13:45:34.165Z","updated":"2026-05-12T00:47:40.397Z","title":"WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Deepak S","product":"Hide Real Download Path","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58848","published":"2025-09-05T13:45:33.643Z","updated":"2026-05-13T00:15:37.906Z","title":"WordPress WP likes Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"aakash1911","product":"WP likes","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58847","published":"2025-09-05T13:45:33.129Z","updated":"2026-05-13T00:18:22.320Z","title":"WordPress WN Flipbox Pro Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Yaidier","product":"WN Flipbox Pro","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58846","published":"2025-09-05T13:45:32.601Z","updated":"2026-05-12T00:46:42.858Z","title":"WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin <= 2020.1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Dejan Markovic","product":"WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58845","published":"2025-09-05T13:45:32.083Z","updated":"2026-04-28T16:13:48.320Z","title":"WordPress Bulk Watermark Plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ChrisHurst","product":"Bulk Watermark","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58844","published":"2025-09-05T13:45:31.561Z","updated":"2026-05-12T00:44:43.309Z","title":"WordPress Database to Excel Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Subhash Kumar","product":"Database to Excel","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58843","published":"2025-09-05T13:45:31.044Z","updated":"2026-04-28T16:13:48.309Z","title":"WordPress Auto Last Youtube Video Plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"David Merinas","product":"Auto Last Youtube Video","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58842","published":"2025-09-05T13:45:30.510Z","updated":"2026-05-13T00:13:51.121Z","title":"WordPress Donation Forms WP by Givecloud Plugin <= 1.0.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"givecloud","product":"Donation Forms WP by Givecloud","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58841","published":"2025-09-05T13:45:29.929Z","updated":"2026-04-28T16:13:48.271Z","title":"WordPress Media Author Plugin <= 1.0.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"John Luetke","product":"Media Author","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-58840","published":"2025-09-05T13:45:29.399Z","updated":"2026-05-12T00:51:26.470Z","title":"WordPress Custom Team Manager Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ibnul H.","product":"Custom Team Manager","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58839","published":"2025-09-05T13:45:28.880Z","updated":"2026-05-12T00:44:36.353Z","title":"WordPress eDS Responsive Menu Plugin <= 1.2 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"aThemeArt Translations","product":"eDS Responsive Menu","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-58838","published":"2025-09-05T13:45:28.349Z","updated":"2026-05-13T00:14:52.560Z","title":"WordPress Smooth Accordion Plugin <= 2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Zakir","product":"Smooth Accordion","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-58837","published":"2025-09-05T13:45:27.719Z","updated":"2026-05-12T00:50:38.063Z","title":"WordPress SS Font Awesome Icon Plugin <= 4.1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shiful H","product":"SS Font Awesome Icon","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-58836","published":"2025-09-05T13:45:27.140Z","updated":"2026-05-13T00:18:51.823Z","title":"WordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Franz Wieser","product":"FW Anker","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58835","published":"2025-09-05T13:45:26.626Z","updated":"2026-05-12T00:51:12.333Z","title":"WordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"calliko","product":"Bonus for Woo","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-58834","published":"2025-09-05T13:45:26.105Z","updated":"2026-04-28T16:13:48.182Z","title":"WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gugu","product":"short.io","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-58833","published":"2025-09-05T13:45:25.574Z","updated":"2026-05-12T00:43:24.267Z","title":"WordPress Invelity MyGLS connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"INVELITY","product":"Invelity MyGLS connect","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-58832","published":"2025-09-05T13:45:25.037Z","updated":"2026-05-12T00:44:22.224Z","title":"WordPress Search by Google Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"webvitaly","product":"Search by Google","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58831","published":"2025-09-05T13:45:24.521Z","updated":"2026-05-12T00:43:58.652Z","title":"WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"snagysandor","product":"Parallax Scrolling Enllax.js","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58830","published":"2025-09-05T13:45:24.005Z","updated":"2026-05-12T00:50:58.864Z","title":"WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"snagysandor","product":"Parallax Scrolling Enllax.js","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58829","published":"2025-09-05T13:45:23.496Z","updated":"2026-05-12T00:42:36.552Z","title":"WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"aitool","product":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-58828","published":"2025-09-05T13:45:22.980Z","updated":"2026-05-12T00:43:52.329Z","title":"WordPress 코드엠샵 소셜톡 plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codemstory","product":"코드엠샵 소셜톡","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-58827","published":"2025-09-05T13:45:22.470Z","updated":"2026-04-28T16:13:47.989Z","title":"WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability","severity":"LOW","score":3.8,"vendor":"PickPlugins","product":"Job Board Manager","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-58826","published":"2025-09-05T13:45:21.950Z","updated":"2026-05-13T00:16:07.406Z","title":"WordPress WP Publication Archive  Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Eric Mann","product":"WP Publication Archive","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58825","published":"2025-09-05T13:45:21.417Z","updated":"2026-05-12T00:48:08.868Z","title":"WordPress Comment Form WP – Customize Default Comment Form plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Habibur Rahman","product":"Comment Form WP – Customize Default Comment Form","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58824","published":"2025-09-05T13:45:20.872Z","updated":"2026-05-12T00:43:37.911Z","title":"WordPress Shk Corporate Theme <= 2.4.1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"priyanshumittal","product":"Shk Corporate","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58823","published":"2025-09-05T13:45:20.325Z","updated":"2026-04-28T16:13:47.953Z","title":"WordPress Get Cash plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"The African Boss","product":"Get Cash","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58822","published":"2025-09-05T13:45:19.736Z","updated":"2026-05-12T00:48:02.507Z","title":"WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mndpsingh287","product":"WP Mail","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-58821","published":"2025-09-05T13:45:19.114Z","updated":"2026-05-12T00:43:04.838Z","title":"WordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpdever","product":"WP Notification Bell","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-58820","published":"2025-09-05T13:45:18.586Z","updated":"2026-05-12T00:44:06.679Z","title":"WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Themepoints","product":"Carousel Ultimate","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58819","published":"2025-09-05T13:45:18.000Z","updated":"2026-05-12T00:51:33.490Z","title":"WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"CreedAlly","product":"Bulk Featured Image","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-58818","published":"2025-09-05T13:45:17.453Z","updated":"2026-05-12T00:51:19.941Z","title":"WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SwiftNinjaPro","product":"Developer Tools Blocker","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-58817","published":"2025-09-05T13:45:16.910Z","updated":"2026-05-12T00:48:23.092Z","title":"WordPress SoftMe Theme <= 1.1.27 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"desertthemes","product":"SoftMe","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58816","published":"2025-09-05T13:45:16.319Z","updated":"2026-05-13T00:12:24.573Z","title":"WordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control Vulnerability","severity":"LOW","score":3.5,"vendor":"Plugin Devs","product":"Product Carousel Slider for Elementor","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-58815","published":"2025-09-05T13:45:15.245Z","updated":"2026-05-13T00:12:53.459Z","title":"WordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data Vulnerability","severity":"HIGH","score":7.2,"vendor":"Rubel Miah","product":"Aitasi Coming Soon","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-58814","published":"2025-09-05T13:45:14.697Z","updated":"2026-05-12T00:48:42.708Z","title":"WordPress Stagtools Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ram Ratan Maurya","product":"Stagtools","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58813","published":"2025-09-05T13:45:14.163Z","updated":"2026-05-13T00:16:36.917Z","title":"WordPress Consultstreet Theme <= 3.0.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themearile","product":"Consultstreet","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58812","published":"2025-09-05T13:45:13.632Z","updated":"2026-05-12T00:43:17.651Z","title":"WordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PriceListo","product":"Best Restaurant Menu by PriceListo","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58811","published":"2025-09-05T13:45:13.096Z","updated":"2026-05-13T00:16:21.867Z","title":"WordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP CodeUs","product":"Ultimate Client Dash","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58810","published":"2025-09-05T13:45:12.530Z","updated":"2026-04-28T16:13:47.648Z","title":"WordPress Simple Link List Widget Plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"jimmywb","product":"Simple Link List Widget","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58809","published":"2025-09-05T13:45:11.994Z","updated":"2026-04-28T16:13:47.557Z","title":"WordPress To Lead For Salesforce Plugin <= 2.7.3.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Nick Ciske","product":"To Lead For Salesforce","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58808","published":"2025-09-05T13:45:11.223Z","updated":"2026-05-12T00:48:15.876Z","title":"WordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Babar","product":"prettyPhoto","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58807","published":"2025-09-05T13:45:10.608Z","updated":"2026-05-12T00:48:36.191Z","title":"WordPress Purge Varnish Cache Plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Dsingh","product":"Purge Varnish Cache","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58806","published":"2025-09-05T13:45:10.088Z","updated":"2026-05-12T00:51:05.697Z","title":"WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Tom Longridge","product":"WordPress Error Monitoring by Bugsnag","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-58805","published":"2025-09-05T13:45:09.547Z","updated":"2026-05-12T00:46:58.790Z","title":"WordPress Widgetize Pages Light Plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"OTWthemes","product":"Widgetize Pages Light","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58804","published":"2025-09-05T13:45:08.999Z","updated":"2026-05-13T00:18:37.361Z","title":"WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"brijrajs","product":"WooCommerce Single Page Checkout","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58802","published":"2025-09-05T13:45:08.464Z","updated":"2026-05-13T00:14:07.150Z","title":"WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"michalzagdan","product":"TrustMate.io – WooCommerce integration","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58801","published":"2025-09-05T13:45:07.915Z","updated":"2026-05-12T00:43:11.259Z","title":"WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"KCS","product":"Responder","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-58800","published":"2025-09-05T13:45:07.378Z","updated":"2026-05-13T00:15:52.400Z","title":"WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Steve Truman","product":"WP Email Template","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58799","published":"2025-09-05T13:45:06.746Z","updated":"2026-05-12T00:50:45.322Z","title":"WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themelocation","product":"Custom WooCommerce Checkout Fields Editor","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58798","published":"2025-09-05T13:45:06.214Z","updated":"2026-05-12T00:48:49.681Z","title":"WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bjorn Manintveld","product":"BCM Duplicate Menu","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58797","published":"2025-09-05T13:45:05.665Z","updated":"2026-04-28T16:13:47.268Z","title":"WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mahmudul Hasan Arif","product":"Ninja Charts","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-58796","published":"2025-09-05T13:45:05.107Z","updated":"2026-05-12T00:47:06.971Z","title":"WordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dudaster","product":"Elementor Element Condition","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-58795","published":"2025-09-05T13:45:04.492Z","updated":"2026-05-12T00:44:29.190Z","title":"WordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Payoneer Checkout","product":"Payoneer Checkout","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-58794","published":"2025-09-05T13:45:03.746Z","updated":"2026-05-12T00:46:36.044Z","title":"WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rainafarai","product":"Notification for Telegram","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58793","published":"2025-09-05T13:45:03.116Z","updated":"2026-05-12T00:44:15.157Z","title":"WordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPBean","product":"WPB Elementor Addons","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58792","published":"2025-09-05T13:45:01.955Z","updated":"2026-05-13T00:18:06.295Z","title":"WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPKube","product":"Authors List","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58791","published":"2025-09-05T13:45:00.737Z","updated":"2026-05-12T00:42:43.504Z","title":"WordPress SEO Auto Linker Plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Arjan Olsder","product":"SEO Auto Linker","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58790","published":"2025-09-05T13:44:59.412Z","updated":"2026-05-12T00:43:31.135Z","title":"WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPKube","product":"Kiwi","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58789","published":"2025-09-05T13:44:58.497Z","updated":"2026-05-13T00:12:10.067Z","title":"WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-58788","published":"2025-09-05T13:44:57.285Z","updated":"2026-05-12T00:50:52.218Z","title":"WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Saad Iqbal","product":"License Manager for WooCommerce","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-58787","published":"2025-09-05T13:44:56.560Z","updated":"2026-05-13T00:13:07.881Z","title":"WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themifyme","product":"Themify Popup","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58786","published":"2025-09-05T13:44:56.030Z","updated":"2026-05-13T00:13:22.323Z","title":"WordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VW THEMES","product":"Ibtana – Ecommerce Product Addons","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58785","published":"2025-09-05T13:44:55.462Z","updated":"2026-05-13T00:17:06.941Z","title":"WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Jiro Sasamoto","product":"Ray Enterprise Translation","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-58784","published":"2025-09-05T13:44:54.821Z","updated":"2026-05-13T00:15:22.910Z","title":"WordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"arisoft","product":"ARI Fancy Lightbox","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58783","published":"2025-09-05T13:44:54.238Z","updated":"2026-05-13T00:19:23.451Z","title":"WordPress Gutentor plugin <= 3.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"gutentor","product":"Gutentor","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58644","published":"2025-09-03T14:37:00.218Z","updated":"2026-05-13T00:08:07.717Z","title":"WordPress LTL Freight Quotes - TQL Edition Plugin <= 1.2.6 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"enituretechnology","product":"LTL Freight Quotes - TQL Edition","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-58643","published":"2025-09-03T14:36:59.652Z","updated":"2026-05-12T00:39:57.920Z","title":"WordPress LTL Freight Quotes – Daylight Edition Plugin <= 2.2.7 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"enituretechnology","product":"LTL Freight Quotes – Daylight Edition","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-58642","published":"2025-09-03T14:36:59.117Z","updated":"2026-05-12T00:38:36.687Z","title":"WordPress LTL Freight Quotes – Day & Ross Edition Plugin <= 2.1.11 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"enituretechnology","product":"LTL Freight Quotes – Day & Ross Edition","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-58641","published":"2025-09-03T14:36:58.536Z","updated":"2026-05-12T00:38:30.231Z","title":"WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"kamleshyadav","product":"Exit Intent Popup","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-58640","published":"2025-09-03T14:36:57.946Z","updated":"2026-05-13T00:10:29.224Z","title":"WordPress Document Engine Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MatrixAddons","product":"Document Engine","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58639","published":"2025-09-03T14:36:57.355Z","updated":"2026-05-12T00:39:44.045Z","title":"WordPress Contact Form By Mega Forms Plugin <= 1.6.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ali Khallad","product":"Contact Form By Mega Forms","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-58637","published":"2025-09-03T14:36:56.745Z","updated":"2026-05-13T00:11:12.655Z","title":"WordPress immonex Kickstart Plugin <= 1.11.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"immonex","product":"immonex Kickstart","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-58635","published":"2025-09-03T14:36:56.185Z","updated":"2026-04-28T16:13:44.608Z","title":"WordPress Support Genix Plugin <= 1.4.23 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DevItems","product":"Support Genix","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-58634","published":"2025-09-03T14:36:55.678Z","updated":"2026-04-28T16:13:44.668Z","title":"WordPress PeachPay Payments Plugin <= 1.117.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"peachpay","product":"PeachPay Payments","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-58633","published":"2025-09-03T14:36:55.164Z","updated":"2026-05-13T00:07:36.226Z","title":"WordPress Booking Ultra Pro Plugin <= 1.1.21 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Deetronix","product":"Booking Ultra Pro","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58632","published":"2025-09-03T14:36:54.634Z","updated":"2026-05-12T00:39:10.378Z","title":"WordPress Dadevarzan WordPress Common Plugin <= 2.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dadevarzan","product":"Dadevarzan WordPress Common","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58631","published":"2025-09-03T14:36:54.067Z","updated":"2026-05-13T00:07:21.782Z","title":"WordPress IssueM Plugin <= 2.9.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ZEEN101","product":"IssueM","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58630","published":"2025-09-03T14:36:53.549Z","updated":"2026-04-28T16:13:44.553Z","title":"WordPress Simple Matomo Tracking Code Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"rbaer","product":"Simple Matomo Tracking Code","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-58626","published":"2025-09-03T14:36:53.033Z","updated":"2026-05-13T00:09:44.269Z","title":"WordPress RumbleTalk Live Group Chat Plugin <= 6.3.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RumbleTalk","product":"RumbleTalk Live Group Chat","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58625","published":"2025-09-03T14:36:52.506Z","updated":"2026-04-28T16:13:44.551Z","title":"WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Spiffy Plugins","product":"WP Flow Plus","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58624","published":"2025-09-03T14:36:51.995Z","updated":"2026-05-13T00:07:51.215Z","title":"WordPress Exchange Rates Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"falselight","product":"Exchange Rates","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58623","published":"2025-09-03T14:36:51.466Z","updated":"2026-05-13T00:10:14.266Z","title":"WordPress Event Feed for Eventbrite Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bohemia Plugins","product":"Event Feed for Eventbrite","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58622","published":"2025-09-03T14:36:50.930Z","updated":"2026-04-28T16:13:44.323Z","title":"WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"yydevelopment","product":"Mobile Contact Line","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58621","published":"2025-09-03T14:36:50.352Z","updated":"2026-05-13T00:09:59.282Z","title":"WordPress PuzzleMe for WordPress Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Amuse Labs","product":"PuzzleMe for WordPress","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58620","published":"2025-09-03T14:36:49.757Z","updated":"2026-04-28T16:13:44.341Z","title":"WordPress PDF for WPForms Plugin <= 6.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"add-ons.org","product":"PDF for WPForms","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58618","published":"2025-09-03T14:36:49.169Z","updated":"2026-04-28T16:13:44.258Z","title":"WordPress Pie Calendar Plugin <= 1.2.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jonathan Jernigan","product":"Pie Calendar","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58617","published":"2025-09-03T14:36:48.606Z","updated":"2026-04-28T16:13:44.263Z","title":"WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"FAKTOR VIER","product":"F4 Media Taxonomies","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58616","published":"2025-09-03T14:36:48.093Z","updated":"2026-05-12T00:40:13.554Z","title":"WordPress Frisbii Pay Plugin <= 1.8.2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Frisbii","product":"Frisbii Pay","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-58615","published":"2025-09-03T14:36:47.587Z","updated":"2026-05-12T00:39:50.989Z","title":"WordPress WP Bannerize Pro Plugin <= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"gfazioli","product":"WP Bannerize Pro","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-58614","published":"2025-09-03T14:36:47.066Z","updated":"2026-05-13T00:08:23.094Z","title":"WordPress Tooltipy Plugin <= 5.5.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jamel.Z","product":"Tooltipy","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58613","published":"2025-09-03T14:36:46.534Z","updated":"2026-05-12T00:40:20.000Z","title":"WordPress Posts Table with Search & Sort Plugin <= 1.4.10 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Barn2 Plugins","product":"Posts Table with Search & Sort","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-58612","published":"2025-09-03T14:36:46.019Z","updated":"2026-05-12T00:39:17.338Z","title":"WordPress PropertyHive Plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58611","published":"2025-09-03T14:36:45.494Z","updated":"2026-05-12T00:40:26.492Z","title":"WordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-58610","published":"2025-09-03T14:36:44.976Z","updated":"2026-05-13T00:11:27.296Z","title":"WordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58609","published":"2025-09-03T14:36:44.460Z","updated":"2026-05-12T00:38:43.104Z","title":"WordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Iulia Cazan","product":"Latest Post Shortcode","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58608","published":"2025-09-03T14:36:43.930Z","updated":"2026-05-13T00:09:07.040Z","title":"WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"BuddyDev","product":"MediaPress","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2025-58607","published":"2025-09-03T14:36:43.341Z","updated":"2026-05-12T00:39:30.732Z","title":"WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GDPR Info","product":"Cookie Notice & Consent Banner for GDPR & CCPA Compliance","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58606","published":"2025-09-03T14:36:42.750Z","updated":"2026-05-13T00:10:43.679Z","title":"WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5,"vendor":"cozythemes","product":"SaasLauncher","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58605","published":"2025-09-03T14:36:42.218Z","updated":"2026-05-12T00:40:32.936Z","title":"WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Delicious","product":"WP Delicious","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58604","published":"2025-09-03T14:36:41.655Z","updated":"2026-05-12T00:39:37.199Z","title":"WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-58603","published":"2025-09-03T14:36:41.143Z","updated":"2026-05-12T00:38:49.549Z","title":"WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Surfer","product":"Surfer","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-58602","published":"2025-09-03T14:36:40.603Z","updated":"2026-05-13T00:08:37.565Z","title":"WordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-58601","published":"2025-09-03T14:36:39.999Z","updated":"2026-05-12T00:40:39.455Z","title":"WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58600","published":"2025-09-03T14:36:39.436Z","updated":"2026-05-13T00:07:07.369Z","title":"WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-58599","published":"2025-09-03T14:36:38.925Z","updated":"2026-05-12T00:40:05.911Z","title":"WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tychesoftwares","product":"Order Delivery Date for WooCommerce","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58598","published":"2025-09-03T14:36:38.410Z","updated":"2026-05-13T00:08:52.556Z","title":"WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Klarna","product":"Klarna Order Management for WooCommerce","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-58597","published":"2025-09-03T14:36:37.890Z","updated":"2026-05-12T00:39:03.392Z","title":"WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-58596","published":"2025-09-03T14:36:37.384Z","updated":"2026-05-13T00:09:29.285Z","title":"WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"properfraction","product":"MailOptin","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-58594","published":"2025-09-03T14:36:36.858Z","updated":"2026-05-12T00:40:46.447Z","title":"WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themefusecom","product":"Brizy","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-58593","published":"2025-09-03T14:36:36.291Z","updated":"2026-05-13T00:10:58.128Z","title":"WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeisle","product":"Orbit Fox by ThemeIsle","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-3701","published":"2025-09-03T12:50:27.597Z","updated":"2026-04-28T16:12:29.054Z","title":"WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Malcure Web Security","product":"Malcure Malware Scanner","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-58210","published":"2025-09-03T06:58:57.138Z","updated":"2026-05-12T00:38:56.517Z","title":"WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeMove","product":"Makeaholic","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2024-32444","published":"2025-09-03T06:55:35.317Z","updated":"2026-04-28T16:09:35.593Z","title":"WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"InspiryThemes","product":"RealHomes","kev":false,"epss":0.00688,"kevAdded":null},{"id":"CVE-2025-31100","published":"2025-08-31T03:48:27.965Z","updated":"2026-04-28T16:12:05.222Z","title":"WordPress School Management Plugin <= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Mojoomla","product":"School Management","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-47696","published":"2025-08-31T03:48:03.893Z","updated":"2026-04-28T16:12:50.334Z","title":"WordPress Blog Designer PRO plugin <= 3.4.7 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"solwin","product":"Blog Designer PRO","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2024-32832","published":"2025-08-31T03:47:28.414Z","updated":"2026-04-28T16:09:42.024Z","title":"WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2024-32589","published":"2025-08-31T03:46:56.764Z","updated":"2026-04-28T16:09:37.965Z","title":"WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-4956","published":"2025-08-30T01:49:20.408Z","updated":"2026-04-28T16:13:05.682Z","title":"WordPress Pro Bulk Watermark Plugin for WordPress Theme <= 2.0 - Path Traversal Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AA-Team","product":"Pro Bulk Watermark Plugin for WordPress","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-54742","published":"2025-08-28T12:37:40.246Z","updated":"2026-04-28T16:13:36.761Z","title":"WordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-54738","published":"2025-08-28T12:37:39.678Z","updated":"2026-04-28T16:13:36.862Z","title":"WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-54734","published":"2025-08-28T12:37:39.117Z","updated":"2026-04-28T16:13:36.736Z","title":"WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.8,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-54733","published":"2025-08-28T12:37:38.529Z","updated":"2026-05-13T00:06:51.788Z","title":"WordPress All Bootstrap Blocks Plugin <= 1.3.28 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"all_bootstrap_blocks","product":"All Bootstrap Blocks","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-54731","published":"2025-08-28T12:37:37.895Z","updated":"2026-04-28T16:13:36.755Z","title":"WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.1,"vendor":"emarket-design","product":"YouTube Showcase","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2025-54725","published":"2025-08-28T12:37:37.318Z","updated":"2026-04-28T16:13:35.872Z","title":"WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-54724","published":"2025-08-28T12:37:36.762Z","updated":"2026-04-28T16:13:35.876Z","title":"WordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Golo","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-54720","published":"2025-08-28T12:37:36.205Z","updated":"2026-04-28T16:13:35.888Z","title":"WordPress Nest Addons Plugin <= 1.6.3 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"SteelThemes","product":"Nest Addons","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-54716","published":"2025-08-28T12:37:35.635Z","updated":"2026-04-28T16:13:35.860Z","title":"WordPress Ireca Theme <= 1.8.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"Ireca","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-54714","published":"2025-08-28T12:37:35.049Z","updated":"2026-04-28T16:13:35.887Z","title":"WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan James","product":"Zephyr Project Manager","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-54710","published":"2025-08-28T12:37:34.462Z","updated":"2026-04-28T16:13:35.876Z","title":"WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Tiktok Feed","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-54029","published":"2025-08-28T12:37:33.849Z","updated":"2026-04-28T16:13:29.123Z","title":"WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"extendons","product":"WooCommerce csv import export","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-53588","published":"2025-08-28T12:37:33.246Z","updated":"2026-04-28T16:13:26.997Z","title":"WordPress UPC/EAN/GTIN Code Generator Plugin <= 2.0.2 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"UPC/EAN/GTIN Code Generator","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-53584","published":"2025-08-28T12:37:32.675Z","updated":"2026-04-28T16:13:27.916Z","title":"WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.1,"vendor":"emarket-design","product":"WP Ticket Customer Service Software & Support Ticket System","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-53583","published":"2025-08-28T12:37:32.036Z","updated":"2026-04-28T16:13:26.998Z","title":"WordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.1,"vendor":"emarket-design","product":"Employee Spotlight","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-53579","published":"2025-08-28T12:37:31.389Z","updated":"2026-04-28T16:13:26.748Z","title":"WordPress Captcha.eu Plugin < 1.0.61 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"captcha.eu","product":"Captcha.eu","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-53578","published":"2025-08-28T12:37:30.841Z","updated":"2026-04-28T16:13:26.705Z","title":"WordPress Kipso Theme <= 1.3.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Kipso","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53576","published":"2025-08-28T12:37:30.232Z","updated":"2026-04-28T16:13:26.705Z","title":"WordPress Ovatheme Events Plugin <= 1.2.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"Ovatheme Events","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53572","published":"2025-08-28T12:37:29.520Z","updated":"2026-04-28T16:13:26.630Z","title":"WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.1,"vendor":"emarket-design","product":"WP Easy Contact","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-53337","published":"2025-08-28T12:37:28.948Z","updated":"2026-04-28T16:13:24.053Z","title":"WordPress LifePress plugin <= 2.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ashan Perera","product":"LifePress","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-53334","published":"2025-08-28T12:37:28.356Z","updated":"2026-04-28T16:13:24.072Z","title":"WordPress Jannah Theme < 7.5.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-53328","published":"2025-08-28T12:37:27.714Z","updated":"2026-04-28T16:13:23.918Z","title":"WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin <= 19.11.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Opinion Stage","product":"Poll, Survey & Quiz Maker Plugin by Opinion Stage","kev":false,"epss":0.00624,"kevAdded":null},{"id":"CVE-2025-53326","published":"2025-08-28T12:37:27.073Z","updated":"2026-04-28T16:13:23.918Z","title":"WordPress Gutenify Plugin <= 1.5.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"CodeYatri","product":"Gutenify","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2025-53289","published":"2025-08-28T12:37:26.507Z","updated":"2026-04-28T16:13:22.779Z","title":"WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Jason","product":"Theme Blvd Widget Areas","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53250","published":"2025-08-28T12:37:25.910Z","updated":"2026-04-28T16:13:21.824Z","title":"WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Chartbeat","product":"Chartbeat","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-53248","published":"2025-08-28T12:37:24.887Z","updated":"2026-04-28T16:13:21.819Z","title":"WordPress Magazine Theme <= 1.2.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magazine","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53247","published":"2025-08-28T12:37:24.304Z","updated":"2026-04-28T16:13:21.792Z","title":"WordPress BlogMarks Theme <= 1.0.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"wpinterface","product":"BlogMarks","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53244","published":"2025-08-28T12:37:23.679Z","updated":"2026-04-28T16:13:21.773Z","title":"WordPress Magazine Elite Theme <= 1.2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magazine Elite","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53243","published":"2025-08-28T12:37:23.019Z","updated":"2026-04-28T16:13:21.654Z","title":"WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"emarket-design","product":"Employee Directory – Staff Listing & Team Directory Plugin for WordPress","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-53230","published":"2025-08-28T12:37:22.433Z","updated":"2026-04-28T16:13:21.544Z","title":"WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerability","severity":"HIGH","score":7.6,"vendor":"honzat","product":"Page Manager for Elementor","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-53227","published":"2025-08-28T12:37:21.849Z","updated":"2026-04-28T16:13:21.507Z","title":"WordPress Magazine Saga Theme <= 1.2.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magazine Saga","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-53225","published":"2025-08-28T12:37:21.237Z","updated":"2026-04-28T16:13:21.507Z","title":"WordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"eboekhouden","product":"e-Boekhouden.nl","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53224","published":"2025-08-28T12:37:20.632Z","updated":"2026-04-28T16:13:21.293Z","title":"WordPress NextGEN Gallery Search Plugin <= 2.12 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Koen Schuit","product":"NextGEN Gallery Search","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53223","published":"2025-08-28T12:37:20.029Z","updated":"2026-04-28T16:13:21.475Z","title":"WordPress Theme Switcher Reloaded Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"undoIT","product":"Theme Switcher Reloaded","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53220","published":"2025-08-28T12:37:19.380Z","updated":"2026-04-28T16:13:21.295Z","title":"WordPress XmasB Quotes Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"XmasB","product":"XmasB Quotes","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53216","published":"2025-08-28T12:37:18.763Z","updated":"2026-04-28T16:13:20.911Z","title":"WordPress Glamer Theme <= 1.0.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"themeuniver","product":"Glamer","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-53215","published":"2025-08-28T12:37:18.162Z","updated":"2026-04-28T16:13:21.039Z","title":"WordPress Yahoo! WebPlayer Plugin <=  2.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"8bitkid","product":"Yahoo! WebPlayer","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-52761","published":"2025-08-28T12:37:17.522Z","updated":"2026-04-28T16:13:18.370Z","title":"WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"manfcarlo","product":"WP Funnel Manager","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2025-49407","published":"2025-08-28T12:37:16.404Z","updated":"2026-04-28T16:13:03.578Z","title":"WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":8.8,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-49405","published":"2025-08-28T12:37:15.723Z","updated":"2026-04-28T16:13:03.898Z","title":"WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Favethemes","product":"Houzez","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-49404","published":"2025-08-28T12:37:15.058Z","updated":"2026-04-28T16:13:03.668Z","title":"WordPress Listeo-Core Plugin < 2.0.7 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"purethemes","product":"Listeo Core","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-49402","published":"2025-08-28T12:37:14.405Z","updated":"2026-04-28T16:13:03.159Z","title":"WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"scriptsbundle","product":"Exertio Framework","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-49388","published":"2025-08-28T12:37:13.815Z","updated":"2026-04-28T16:13:02.828Z","title":"WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"kamleshyadav","product":"Miraculous Core Plugin","kev":false,"epss":0.06597,"kevAdded":null},{"id":"CVE-2025-49387","published":"2025-08-28T12:37:13.181Z","updated":"2026-04-28T16:13:02.831Z","title":"WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"add-ons.org","product":"Drag and Drop File Upload for Elementor Forms","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-49383","published":"2025-08-28T12:37:12.575Z","updated":"2026-04-28T16:13:02.791Z","title":"WordPress Neresa Theme <= 1.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Neresa","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-48365","published":"2025-08-28T12:37:11.934Z","updated":"2026-04-28T16:12:57.573Z","title":"WordPress Custom Comment plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"imaprogrammer","product":"Custom Comment","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48364","published":"2025-08-28T12:37:11.279Z","updated":"2026-04-28T16:12:57.597Z","title":"WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"vEnCa-X","product":"rajce","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-48363","published":"2025-08-28T12:37:10.659Z","updated":"2026-04-28T16:12:57.482Z","title":"WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metin Saraç","product":"Popup for CF7 with Sweet Alert","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-48362","published":"2025-08-28T12:37:10.106Z","updated":"2026-04-28T16:12:57.344Z","title":"WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Saeed Sattar Beglou","product":"Hesabfa Accounting","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-48361","published":"2025-08-28T12:37:09.524Z","updated":"2026-04-28T16:12:57.356Z","title":"WordPress Hesabfa Accounting plugin <= 2.2.5 - Sensitive Data Exposure via Log File vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saeed Sattar Beglou","product":"Hesabfa Accounting","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-48360","published":"2025-08-28T12:37:08.905Z","updated":"2026-04-28T16:12:57.275Z","title":"WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Razvan Stanga","product":"Varnish/Nginx Proxy Caching","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48359","published":"2025-08-28T12:37:08.340Z","updated":"2026-05-12T00:37:23.149Z","title":"WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"thaihavnn07","product":"ATT YouTube Widget","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48358","published":"2025-08-28T12:37:07.703Z","updated":"2026-04-28T16:12:57.357Z","title":"WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"everythingwp","product":"Risk Free Cash On Delivery (COD) – WooCommerce","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48357","published":"2025-08-28T12:37:07.117Z","updated":"2026-04-28T16:12:57.414Z","title":"WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Theme Century","product":"Century ToolKit","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-48356","published":"2025-08-28T12:37:06.561Z","updated":"2026-04-28T16:12:57.391Z","title":"WordPress Kanpress plugin <= 1.1   - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Isra","product":"Kanpress","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48354","published":"2025-08-28T12:37:05.974Z","updated":"2026-04-28T16:12:57.383Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48353","published":"2025-08-28T12:37:05.396Z","updated":"2026-04-28T16:12:57.380Z","title":"WordPress Clickbank WordPress Plugin (Niche Storefront) plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dactum","product":"Clickbank WordPress Plugin (Niche Storefront)","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48352","published":"2025-08-28T12:37:04.772Z","updated":"2026-04-28T16:12:57.438Z","title":"WordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"sitesearch-yandex","product":"Yandex Site search pinger","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48351","published":"2025-08-28T12:37:04.134Z","updated":"2026-05-12T00:37:09.672Z","title":"WordPress Kento Splash Screen plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginsPoint","product":"Kento Splash Screen","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48350","published":"2025-08-28T12:37:03.559Z","updated":"2026-04-28T16:12:57.343Z","title":"WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Basar Ventures","product":"AutoWP","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-48349","published":"2025-08-28T12:37:02.975Z","updated":"2026-04-28T16:12:57.266Z","title":"WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"origincode","product":"Video Gallery – Vimeo and YouTube Gallery","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48348","published":"2025-08-28T12:37:02.392Z","updated":"2026-04-28T16:12:57.237Z","title":"WordPress Site Offline plugin <= 1.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"chandrashekharsahu","product":"Site Offline","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-48347","published":"2025-08-28T12:37:01.740Z","updated":"2026-04-28T16:12:57.181Z","title":"WordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vincent Mimoun-Prat","product":"bxSlider integration for WordPress","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48343","published":"2025-08-28T12:37:01.120Z","updated":"2026-04-28T16:12:56.914Z","title":"WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Aaron Axelsen","product":"WPMU Ldap Authentication","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-48327","published":"2025-08-28T12:37:00.500Z","updated":"2026-04-28T16:12:56.623Z","title":"WordPress WP Mailgun SMTP plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"inkthemes","product":"WP Mailgun SMTP","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-48325","published":"2025-08-28T12:36:59.873Z","updated":"2026-04-28T16:12:56.248Z","title":"WordPress WP Admin Theme plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"shmish111","product":"WP Admin Theme","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48324","published":"2025-08-28T12:36:59.287Z","updated":"2026-04-28T16:12:56.304Z","title":"WordPress tli.tl auto Twitter poster plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"khashabawy","product":"tli.tl auto Twitter poster","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48323","published":"2025-08-28T12:36:58.705Z","updated":"2026-04-28T16:12:56.361Z","title":"WordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Md Abunaser Khan","product":"Advance Food Menu","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48322","published":"2025-08-28T12:36:58.108Z","updated":"2026-05-12T00:37:16.158Z","title":"WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Finn Dohrn","product":"Statify Widget","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48321","published":"2025-08-28T12:36:57.446Z","updated":"2026-04-28T16:12:56.821Z","title":"WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dyiosah","product":"Ultimate twitter profile widget","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48320","published":"2025-08-28T12:36:56.810Z","updated":"2026-04-28T16:12:56.639Z","title":"WordPress 百度分享按钮 plugin <= 1.0.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"cuckoohello","product":"百度分享按钮","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48319","published":"2025-08-28T12:36:56.244Z","updated":"2026-04-28T16:12:56.573Z","title":"WordPress Mesa Mesa Reservation Widget plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"gslauraspeck","product":"Mesa Mesa Reservation Widget","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-48318","published":"2025-08-28T12:36:55.685Z","updated":"2026-04-28T16:12:56.127Z","title":"WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"shen2","product":"多说社会化评论框","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-48316","published":"2025-08-28T12:36:55.124Z","updated":"2026-05-12T00:37:30.076Z","title":"WordPress Responsive Mobile-Friendly Tooltip plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ItayXD","product":"Responsive Mobile-Friendly Tooltip","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-48315","published":"2025-08-28T12:36:54.491Z","updated":"2026-04-28T16:12:56.656Z","title":"WordPress WordPress HTML plugin <= 0.51 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"stanton119","product":"WordPress HTML","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-48314","published":"2025-08-28T12:36:53.893Z","updated":"2026-04-28T16:12:56.311Z","title":"WordPress Add Code To Head plugin <= 1.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"salubrio","product":"Add Code To Head","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-48313","published":"2025-08-28T12:36:53.293Z","updated":"2026-04-28T16:12:55.910Z","title":"WordPress Tripadvisor Shortcode plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"kevin heath","product":"Tripadvisor Shortcode","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-48312","published":"2025-08-28T12:36:52.634Z","updated":"2026-04-28T16:12:55.899Z","title":"WordPress WPAvatar plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"文派翻译（WP Chinese Translation）","product":"WPAvatar","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-48311","published":"2025-08-28T12:36:52.053Z","updated":"2026-05-12T00:37:36.463Z","title":"WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"OffClicks","product":"Invisible Optin","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-48310","published":"2025-08-28T12:36:51.433Z","updated":"2026-04-28T16:12:55.909Z","title":"WordPress Table Editor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wptableeditor","product":"Table Editor","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-48309","published":"2025-08-28T12:36:50.787Z","updated":"2026-04-28T16:12:55.832Z","title":"WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"web-able","product":"BetPress","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-48308","published":"2025-08-28T12:36:50.175Z","updated":"2026-04-28T16:12:55.866Z","title":"WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"nonletter","product":"Newsletter subscription optin module","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-48307","published":"2025-08-28T12:36:49.558Z","updated":"2026-04-28T16:12:55.822Z","title":"WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"kasonzhao","product":"SEO For Images","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48306","published":"2025-08-28T12:36:48.919Z","updated":"2026-04-28T16:12:55.794Z","title":"WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"developers savyour","product":"Savyour Affiliate Partner","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-48305","published":"2025-08-28T12:36:48.279Z","updated":"2026-04-28T16:12:55.797Z","title":"WordPress Goal Tracker for Patreon plugin <= 0.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"vikingjs","product":"Goal Tracker for Patreon","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-48304","published":"2025-08-28T12:36:47.674Z","updated":"2026-04-28T16:12:55.784Z","title":"WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Gary Illyes","product":"Google XML News Sitemap plugin","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-48110","published":"2025-08-28T12:36:47.016Z","updated":"2026-04-28T16:12:51.696Z","title":"WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mibuthu","product":"Link View","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-48109","published":"2025-08-28T12:36:46.381Z","updated":"2026-04-28T16:12:51.664Z","title":"WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Xavier Media","product":"XM-Backup","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-48100","published":"2025-08-28T12:36:45.662Z","updated":"2026-04-28T16:12:51.217Z","title":"WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"extremeidea","product":"bidorbuy Store Integrator","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-39496","published":"2025-08-28T11:41:43.877Z","updated":"2026-04-28T16:12:32.864Z","title":"WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW","product":"WooBeWoo Product Filter Pro","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-58218","published":"2025-08-27T17:45:51.650Z","updated":"2026-04-28T16:13:42.365Z","title":"WordPress Small Package Quotes – USPS Edition Plugin <= 1.3.9 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"enituretechnology","product":"Small Package Quotes – USPS Edition","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2025-58217","published":"2025-08-27T17:45:50.965Z","updated":"2026-04-28T16:13:42.330Z","title":"WordPress Instant Breaking News Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"GeroNikolov","product":"Instant Breaking News","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2025-58216","published":"2025-08-27T17:45:50.336Z","updated":"2026-05-12T00:36:23.297Z","title":"WordPress WP Thumbtack Review Slider Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"jgwhite33","product":"WP Thumbtack Review Slider","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-58213","published":"2025-08-27T17:45:49.658Z","updated":"2026-05-12T00:36:09.851Z","title":"WordPress Booking System Trafft Plugin <= 1.0.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ameliabooking","product":"Booking System Trafft","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58212","published":"2025-08-27T17:45:48.980Z","updated":"2026-05-12T00:35:23.677Z","title":"WordPress Epeken All Kurir Plugin <= 2.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"epeken","product":"Epeken All Kurir","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58211","published":"2025-08-27T17:45:48.240Z","updated":"2026-05-12T00:35:30.116Z","title":"WordPress Chatbox Manager Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"alexvtn","product":"Chatbox Manager","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58209","published":"2025-08-27T17:45:47.581Z","updated":"2026-05-12T00:36:29.823Z","title":"WordPress Transcoder Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"rtCamp","product":"Transcoder","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58208","published":"2025-08-27T17:45:46.928Z","updated":"2026-05-12T00:35:49.522Z","title":"WordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"add-ons.org","product":"PDF for Elementor Forms + Drag And Drop Template Builder","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58205","published":"2025-08-27T17:45:46.238Z","updated":"2026-05-12T00:35:16.214Z","title":"WordPress ElementInvader Addons for Elementor Plugin <= 1.3.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Element Invader","product":"ElementInvader Addons for Elementor","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58204","published":"2025-08-27T17:45:45.516Z","updated":"2026-05-13T00:06:21.951Z","title":"WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Eric Teubert","product":"Podlove Podcast Publisher","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-58203","published":"2025-08-27T17:45:44.499Z","updated":"2026-05-12T00:36:03.974Z","title":"WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"solacewp","product":"Solace Extra","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-58202","published":"2025-08-27T17:45:43.824Z","updated":"2026-05-12T00:35:36.567Z","title":"WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Plugins and Snippets","product":"Simple Page Access Restriction","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-58201","published":"2025-08-27T17:45:43.190Z","updated":"2026-05-13T00:06:36.856Z","title":"WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AfterShip & Automizely","product":"AfterShip Tracking","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-58198","published":"2025-08-27T17:45:42.536Z","updated":"2026-05-12T00:36:36.752Z","title":"WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xpro","product":"Xpro Theme Builder","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-58197","published":"2025-08-27T17:45:41.882Z","updated":"2026-05-12T00:35:42.986Z","title":"WordPress Simple Download Monitor Plugin <= 3.9.34 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mra13","product":"Simple Download Monitor","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58196","published":"2025-08-27T17:45:41.225Z","updated":"2026-04-28T16:13:41.618Z","title":"WordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"uicore","product":"UiCore Elements","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58195","published":"2025-08-27T17:45:40.585Z","updated":"2026-05-12T00:36:16.304Z","title":"WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58194","published":"2025-08-27T17:45:39.929Z","updated":"2026-05-12T00:36:43.267Z","title":"WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-58193","published":"2025-08-27T17:45:39.273Z","updated":"2026-05-12T00:35:09.247Z","title":"WordPress Uncanny Automator Plugin <= 6.7.0.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-58192","published":"2025-08-27T17:45:38.564Z","updated":"2026-05-12T00:35:56.102Z","title":"WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Xylus Themes","product":"WP Bulk Delete","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2025-48081","published":"2025-08-27T05:03:53.571Z","updated":"2026-04-28T16:12:50.380Z","title":"WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Printeers","product":"Printeers Print & Ship","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-49035","published":"2025-08-27T03:26:16.618Z","updated":"2026-04-28T16:12:57.794Z","title":"WordPress Admin Menu Groups plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"chaimchaikin","product":"Admin Menu Groups","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-49039","published":"2025-08-27T03:25:25.765Z","updated":"2026-04-28T16:12:57.902Z","title":"WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"mibuthu","product":"Link View","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-49040","published":"2025-08-27T03:24:25.693Z","updated":"2026-04-28T16:12:57.901Z","title":"WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Backup Bolt","product":"Backup Bolt","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-48108","published":"2025-08-26T09:41:50.512Z","updated":"2026-04-28T16:12:51.669Z","title":"WordPress School Management Plugin <= 93.2.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mojoomla","product":"School Management","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-48303","published":"2025-08-25T10:10:03.184Z","updated":"2026-04-28T16:12:55.737Z","title":"WordPress Post Type Converter plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kevin Langley Jr.","product":"Post Type Converter","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-57896","published":"2025-08-22T12:00:03.838Z","updated":"2026-04-28T16:13:37.687Z","title":"WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-57895","published":"2025-08-22T11:59:59.400Z","updated":"2026-04-28T16:13:37.716Z","title":"WordPress JobWP Plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hossni Mubarak","product":"JobWP","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-57894","published":"2025-08-22T11:59:58.767Z","updated":"2026-04-28T16:13:37.767Z","title":"WordPress WPPizza Plugin <= 3.19.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ollybach","product":"WPPizza","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-57893","published":"2025-08-22T11:59:58.108Z","updated":"2026-05-12T00:34:55.252Z","title":"WordPress WP Fast Total Search Plugin <= 1.79.270 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Epsiloncool","product":"WP Fast Total Search","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-57892","published":"2025-08-22T11:59:57.464Z","updated":"2026-04-28T16:13:37.666Z","title":"WordPress Simple Statistics for Feeds Plugin <= 20250322 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeff Starr","product":"Simple Statistics for Feeds","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-57891","published":"2025-08-22T11:59:56.714Z","updated":"2026-04-28T16:13:37.604Z","title":"WordPress Recurring PayPal Donations Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpecommerce","product":"Recurring PayPal Donations","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-57890","published":"2025-08-22T11:59:55.966Z","updated":"2026-05-12T00:35:01.722Z","title":"WordPress Sessions Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Pierre Lannoy","product":"Sessions","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-57888","published":"2025-08-22T11:59:55.223Z","updated":"2026-04-28T16:13:37.339Z","title":"WordPress Jobmonster Theme <= 4.8.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-57887","published":"2025-08-22T11:59:54.465Z","updated":"2026-04-28T16:13:37.319Z","title":"WordPress Jobmonster Theme <= 4.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-57886","published":"2025-08-22T11:59:53.722Z","updated":"2026-04-28T16:13:37.472Z","title":"WordPress Accessibility Checker by Equalize Digital Plugin <= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Equalize Digital","product":"Accessibility Checker by Equalize Digital","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-57885","published":"2025-08-22T11:59:52.952Z","updated":"2026-04-28T16:13:37.343Z","title":"WordPress Fluent Support Plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjahan Jewel","product":"Fluent Support","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-57884","published":"2025-08-22T11:59:52.112Z","updated":"2026-04-28T16:13:37.419Z","title":"WordPress Greenshift Plugin <= 12.1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpsoul","product":"Greenshift","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-53251","published":"2025-08-21T14:43:32.778Z","updated":"2026-04-28T16:13:21.888Z","title":"WordPress Pin WP theme < 7.2 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"An-Themes","product":"Pin WP","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-48355","published":"2025-08-21T03:27:53.141Z","updated":"2026-04-28T16:12:57.527Z","title":"WordPress ProveSource Social Proof plugin <= 3.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ProveSource LTD","product":"ProveSource Social Proof","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-49381","published":"2025-08-20T08:03:55.230Z","updated":"2026-04-28T16:13:02.928Z","title":"WordPress ads.txt Guru Connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"CRITICAL","score":9.6,"vendor":"ads.txt Guru","product":"ads.txt Guru Connect","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-49382","published":"2025-08-20T08:03:54.651Z","updated":"2026-04-28T16:13:02.801Z","title":"WordPress JobZilla - Job Board WordPress Theme Theme <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"DexignZone","product":"JobZilla - Job Board WordPress Theme","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-49389","published":"2025-08-20T08:03:54.057Z","updated":"2026-04-28T16:13:02.901Z","title":"WordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WEN Solutions","product":"Notice Bar","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-49391","published":"2025-08-20T08:03:53.490Z","updated":"2026-04-28T16:13:02.915Z","title":"WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Fetch Designs","product":"Sign-up Sheets","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-49392","published":"2025-08-20T08:03:52.968Z","updated":"2026-04-28T16:13:03.089Z","title":"WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"themifyme","product":"Themify Audio Dock","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-49395","published":"2025-08-20T08:03:52.402Z","updated":"2026-04-28T16:13:03.918Z","title":"WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themifyme","product":"Themify Icons","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-49396","published":"2025-08-20T08:03:51.751Z","updated":"2026-04-28T16:13:03.461Z","title":"WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themifyme","product":"Themify Builder","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-49397","published":"2025-08-20T08:03:51.138Z","updated":"2026-04-28T16:13:03.639Z","title":"WordPress Colorbox Lightbox Plugin <= 1.1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"Colorbox Lightbox","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-49399","published":"2025-08-20T08:03:50.441Z","updated":"2026-04-28T16:13:03.180Z","title":"WordPress NEX-Forms Plugin <= 9.1.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-49400","published":"2025-08-20T08:03:49.869Z","updated":"2026-04-28T16:13:03.174Z","title":"WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"osama.esh","product":"WP Visitor Statistics (Real Time Traffic)","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-49406","published":"2025-08-20T08:03:49.295Z","updated":"2026-04-28T16:13:04.018Z","title":"WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability","severity":"HIGH","score":8.5,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-49408","published":"2025-08-20T08:03:48.674Z","updated":"2026-04-28T16:13:04.127Z","title":"WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure Vulnerability","severity":"CRITICAL","score":10,"vendor":"WPDeveloper","product":"Templately","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2025-28977","published":"2025-08-20T08:03:48.107Z","updated":"2026-04-28T16:11:52.106Z","title":"WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-30975","published":"2025-08-20T08:03:47.588Z","updated":"2026-04-28T16:12:02.482Z","title":"WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.5,"vendor":"SaifuMak","product":"Add Custom Codes","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-47650","published":"2025-08-20T08:03:47.050Z","updated":"2026-04-28T16:12:48.004Z","title":"WordPress Infility Global <= 2.15.06 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-49409","published":"2025-08-20T08:03:46.507Z","updated":"2026-04-28T16:13:04.000Z","title":"WordPress SensorPress plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"CRITICAL","score":9.8,"vendor":"brewlabs","product":"SensorPress","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-49410","published":"2025-08-20T08:03:45.980Z","updated":"2026-04-28T16:13:03.895Z","title":"WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"CRITICAL","score":10,"vendor":"Imran Emu","product":"TC Testimonials","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-49411","published":"2025-08-20T08:03:45.380Z","updated":"2026-04-28T16:13:03.875Z","title":"WordPress iFrame Block plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Vikas Sharma","product":"iFrame Block","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49412","published":"2025-08-20T08:03:44.742Z","updated":"2026-04-28T16:13:03.940Z","title":"WordPress Page Transition plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"numixtech","product":"Page Transition","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-49413","published":"2025-08-20T08:03:44.211Z","updated":"2026-05-12T00:34:35.949Z","title":"WordPress Super Store Finder Plugin <= 7.6 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2025-49420","published":"2025-08-20T08:03:43.644Z","updated":"2026-04-28T16:13:04.220Z","title":"WordPress Ultra Portfolio - WordPress Plugin <= 6.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themepassion","product":"Ultra Portfolio","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49422","published":"2025-08-20T08:03:43.024Z","updated":"2026-04-28T16:13:04.295Z","title":"WordPress Support Ticket Plugin <= 1.9 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themepassion","product":"Support Ticket","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2025-49424","published":"2025-08-20T08:03:42.325Z","updated":"2026-04-28T16:13:04.262Z","title":"WordPress Support Ticket Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themepassion","product":"Support Ticket","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49426","published":"2025-08-20T08:03:41.692Z","updated":"2026-04-28T16:13:04.364Z","title":"WordPress Kitring Theme <= 2.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Dahz","product":"Kitring","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2025-49428","published":"2025-08-20T08:03:41.172Z","updated":"2026-04-28T16:13:04.328Z","title":"WordPress Cookie Warning plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.5,"vendor":"Dourou","product":"Cookie Warning","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-49434","published":"2025-08-20T08:03:40.552Z","updated":"2026-04-28T16:13:04.864Z","title":"WordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Cars4Rent","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-49436","published":"2025-08-20T08:03:39.986Z","updated":"2026-04-28T16:13:04.903Z","title":"WordPress Anotte theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Anotte","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2025-49438","published":"2025-08-20T08:03:39.479Z","updated":"2026-04-28T16:13:04.757Z","title":"WordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Max Chirkov","product":"Simple Login Log","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-49889","published":"2025-08-20T08:03:38.918Z","updated":"2026-04-28T16:13:07.124Z","title":"WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Edge CPT","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2025-49890","published":"2025-08-20T08:03:38.386Z","updated":"2026-04-28T16:13:07.320Z","title":"WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Organic Beauty","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-49891","published":"2025-08-20T08:03:37.807Z","updated":"2026-04-28T16:13:07.321Z","title":"WordPress Uxper Booking Plugin <= 1.3.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"uxper","product":"Uxper Booking","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-49892","published":"2025-08-20T08:03:37.294Z","updated":"2026-04-28T16:13:07.266Z","title":"WordPress Uxper Booking Plugin <= 1.3.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"uxper","product":"Uxper Booking","kev":false,"epss":0.00836,"kevAdded":null},{"id":"CVE-2025-49893","published":"2025-08-20T08:03:36.738Z","updated":"2026-04-28T16:13:07.341Z","title":"WordPress Nuss Theme <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Nuss","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-49894","published":"2025-08-20T08:03:36.141Z","updated":"2026-04-28T16:13:07.429Z","title":"WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"uxper","product":"Nuss","kev":false,"epss":0.00934,"kevAdded":null},{"id":"CVE-2025-49896","published":"2025-08-20T08:03:35.576Z","updated":"2026-04-28T16:13:07.331Z","title":"WordPress WP Discord Post Plus –  Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wptasker","product":"WP Discord Post Plus –  Supports Unlimited Channels","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-48142","published":"2025-08-20T08:03:35.039Z","updated":"2026-04-28T16:12:52.319Z","title":"WordPress Bookify <= 1.0.9 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Saad Iqbal","product":"Bookify","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-48148","published":"2025-08-20T08:03:34.428Z","updated":"2026-04-28T16:12:52.643Z","title":"WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"StoreKeeper B.V.","product":"StoreKeeper for WooCommerce","kev":false,"epss":0.16882,"kevAdded":null},{"id":"CVE-2025-48149","published":"2025-08-20T08:03:33.707Z","updated":"2026-04-28T16:12:52.575Z","title":"WordPress Cook&Meal <= 1.2.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"dedalx","product":"Cook&Meal","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2025-48151","published":"2025-08-20T08:03:33.138Z","updated":"2026-04-28T16:12:52.815Z","title":"WordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"CreativeMindsSolutions","product":"CM Map Locations","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48152","published":"2025-08-20T08:03:32.616Z","updated":"2026-04-28T16:12:52.804Z","title":"WordPress Rentsyst Plugin <= 2.0.100 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"dimafreund","product":"Rentsyst","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48154","published":"2025-08-20T08:03:32.088Z","updated":"2026-05-12T00:34:42.368Z","title":"WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin <= 2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Multimedia Playlist Slider Addon for WPBakery Page Builder","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48157","published":"2025-08-20T08:03:31.534Z","updated":"2026-04-28T16:12:52.851Z","title":"WordPress Formality <= 1.5.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Michele Giorgi","product":"Formality","kev":false,"epss":0.02733,"kevAdded":null},{"id":"CVE-2025-48158","published":"2025-08-20T08:03:31.014Z","updated":"2026-04-28T16:12:52.960Z","title":"WordPress BuddyPress XProfile Custom Image Field Plugin <= 3.0.1 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"Alex Githatu","product":"BuddyPress XProfile Custom Image Field","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2025-48159","published":"2025-08-20T08:03:30.498Z","updated":"2026-04-28T16:12:52.861Z","title":"WordPress Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Youtube Vimeo Video Player and Slider WP Plugin","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48160","published":"2025-08-20T08:03:29.955Z","updated":"2026-04-28T16:12:52.878Z","title":"WordPress Caliris <= 1.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Caliris","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2025-48162","published":"2025-08-20T08:03:29.447Z","updated":"2026-04-28T16:12:53.172Z","title":"WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"quantumcloud","product":"Simple Business Directory Pro","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48163","published":"2025-08-20T08:03:28.903Z","updated":"2026-04-28T16:12:53.322Z","title":"WordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-48164","published":"2025-08-20T08:03:28.341Z","updated":"2026-04-28T16:12:53.208Z","title":"WordPress SureDash <= 1.0.3 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-48165","published":"2025-08-20T08:03:27.796Z","updated":"2026-04-28T16:12:53.141Z","title":"WordPress DELUCKS SEO Plugin <= 2.6.0 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"DELUCKS","product":"DELUCKS SEO","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-48168","published":"2025-08-20T08:03:27.240Z","updated":"2026-04-28T16:12:53.344Z","title":"WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Apollo - Sticky Full Width HTML5 Audio Player","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-48169","published":"2025-08-20T08:03:26.706Z","updated":"2026-04-28T16:12:53.144Z","title":"WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Jordy Meow","product":"Code Engine","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-48170","published":"2025-08-20T08:03:26.142Z","updated":"2026-04-28T16:12:53.349Z","title":"WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player - Addon for WPBakery Page Builder","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-48171","published":"2025-08-20T08:03:25.615Z","updated":"2026-04-28T16:12:53.172Z","title":"WordPress Cena Store <= 2.11.26 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Cena Store","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2025-48296","published":"2025-08-20T08:03:25.030Z","updated":"2026-04-28T16:12:55.679Z","title":"WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"UpStore","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-48297","published":"2025-08-20T08:03:24.518Z","updated":"2026-04-28T16:12:55.649Z","title":"WordPress Simple Link Directory < 14.8.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"quantumcloud","product":"Simple Link Directory","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-48298","published":"2025-08-20T08:03:23.991Z","updated":"2026-04-28T16:12:55.752Z","title":"WordPress SEOPress for MainWP <= 1.4  - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Benjamin Denis","product":"SEOPress for MainWP","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-48302","published":"2025-08-20T08:03:23.473Z","updated":"2026-04-28T16:12:55.723Z","title":"WordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2025-53194","published":"2025-08-20T08:03:22.956Z","updated":"2026-04-28T16:13:20.077Z","title":"WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-53195","published":"2025-08-20T08:03:22.441Z","updated":"2026-04-28T16:13:20.071Z","title":"WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-53196","published":"2025-08-20T08:03:21.927Z","updated":"2026-04-29T09:51:56.722Z","title":"WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-53198","published":"2025-08-20T08:03:21.413Z","updated":"2026-04-28T16:13:20.161Z","title":"WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2025-53201","published":"2025-08-20T08:03:20.894Z","updated":"2026-04-28T16:13:20.228Z","title":"WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NooTheme","product":"Jobmonster","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-53204","published":"2025-08-20T08:03:20.380Z","updated":"2026-04-28T16:13:20.749Z","title":"WordPress eventlist plugin <= 1.9.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"eventlist","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2025-53205","published":"2025-08-20T08:03:19.865Z","updated":"2026-04-28T16:13:20.870Z","title":"WordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Radio Player Shoutcast & Icecast","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53207","published":"2025-08-20T08:03:19.328Z","updated":"2026-04-28T16:13:21.138Z","title":"WordPress WP Travel Gutenberg Blocks plugin <= 3.9.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"WP Travel","product":"WP Travel Gutenberg Blocks","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-53208","published":"2025-08-20T08:03:18.776Z","updated":"2026-04-28T16:13:20.954Z","title":"WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability","severity":"HIGH","score":7.5,"vendor":"paymayapg","product":"Maya Business","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-53210","published":"2025-08-20T08:03:18.255Z","updated":"2026-05-12T00:34:09.418Z","title":"WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"bdthemes","product":"ZoloBlocks","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2025-53212","published":"2025-08-20T08:03:17.725Z","updated":"2026-05-12T00:34:22.518Z","title":"WordPress Revolution Video Player With Bottom Playlist <= 2.9.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Revolution Video Player With Bottom Playlist","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53213","published":"2025-08-20T08:03:17.156Z","updated":"2026-04-28T16:13:20.824Z","title":"WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"ELEXtensions","product":"ReachShip WooCommerce Multi-Carrier & Conditional Shipping","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-53226","published":"2025-08-20T08:03:16.587Z","updated":"2026-04-28T16:13:21.676Z","title":"WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"digitalzoomstudio","product":"Comments Capcha Box","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53299","published":"2025-08-20T08:03:15.926Z","updated":"2026-04-28T16:13:23.526Z","title":"WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeMakers","product":"ThemeMakers Visual Content Composer","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2025-53319","published":"2025-08-20T08:03:15.362Z","updated":"2026-04-29T09:51:55.656Z","title":"WordPress Raptive Ads Plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Raptive","product":"Raptive Ads","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53559","published":"2025-08-20T08:03:14.840Z","updated":"2026-04-28T16:13:26.238Z","title":"WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player - Addon for WPBakery Page Builder","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-53560","published":"2025-08-20T08:03:14.302Z","updated":"2026-04-28T16:13:26.614Z","title":"WordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Noisa","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-53561","published":"2025-08-20T08:03:13.729Z","updated":"2026-04-28T16:13:26.616Z","title":"WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"Prevent files / folders access","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-53562","published":"2025-08-20T08:03:13.165Z","updated":"2026-05-13T00:05:50.841Z","title":"WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player - Addon for WPBakery Page Builder","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53563","published":"2025-08-20T08:03:12.638Z","updated":"2026-04-28T16:13:26.347Z","title":"WordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Youtube Vimeo Video Player and Slider","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53564","published":"2025-08-20T08:03:12.063Z","updated":"2026-04-28T16:13:26.613Z","title":"WordPress HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"HTML5 Radio Player - WPBakery Page Builder Addon","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53565","published":"2025-08-20T08:03:11.564Z","updated":"2026-04-28T16:13:26.588Z","title":"WordPress Widget for Google Reviews <= 1.0.15 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"RadiusTheme","product":"Widget for Google Reviews","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2025-53567","published":"2025-08-20T08:03:11.051Z","updated":"2026-04-28T16:13:26.621Z","title":"WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"nK","product":"Ghost Kit","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2025-53577","published":"2025-08-20T08:03:10.517Z","updated":"2026-04-28T16:13:26.715Z","title":"WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":10,"vendor":"thehp","product":"Global DNS","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2025-53580","published":"2025-08-20T08:03:09.920Z","updated":"2026-04-28T16:13:26.711Z","title":"WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"quantumcloud","product":"Simple Business Directory Pro","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2025-53983","published":"2025-08-20T08:03:09.330Z","updated":"2026-04-29T09:51:55.603Z","title":"WordPress JetElements For Elementor <= 2.7.7 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-53985","published":"2025-08-20T08:03:08.749Z","updated":"2026-04-29T09:51:55.595Z","title":"WordPress JetTabs <= 2.2.9 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-53987","published":"2025-08-20T08:03:08.179Z","updated":"2026-05-13T00:06:06.331Z","title":"WordPress JetMenu <= 2.4.11.1 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetMenu","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-53988","published":"2025-08-20T08:03:07.609Z","updated":"2026-04-29T09:51:55.724Z","title":"WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-53992","published":"2025-08-20T08:03:07.085Z","updated":"2026-04-29T09:51:55.893Z","title":"WordPress JetTricks <= 1.5.4.1 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTricks","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-53993","published":"2025-08-20T08:03:06.499Z","updated":"2026-04-29T09:51:55.938Z","title":"WordPress JetPopup plugin <= 2.0.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-53998","published":"2025-08-20T08:03:05.932Z","updated":"2026-04-29T09:51:56.040Z","title":"WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetWooBuilder","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-54007","published":"2025-08-20T08:03:05.419Z","updated":"2026-05-13T00:05:06.943Z","title":"WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"PickPlugins","product":"Post Grid and Gutenberg Blocks","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-54008","published":"2025-08-20T08:03:04.925Z","updated":"2026-05-13T00:04:51.484Z","title":"WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-54012","published":"2025-08-20T08:03:04.359Z","updated":"2026-04-28T16:13:28.085Z","title":"WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-54014","published":"2025-08-20T08:03:03.735Z","updated":"2026-04-28T16:13:28.353Z","title":"WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"QuanticaLabs","product":"MediCenter - Health Medical Clinic","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-54017","published":"2025-08-20T08:03:03.218Z","updated":"2026-04-28T16:13:28.662Z","title":"WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-54019","published":"2025-08-20T08:03:02.660Z","updated":"2026-05-13T00:05:36.392Z","title":"WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Beplusthemes","product":"Alone","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-54021","published":"2025-08-20T08:03:02.155Z","updated":"2026-04-28T16:13:28.810Z","title":"WordPress Simple File List plugin <= 6.1.14 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2025-54025","published":"2025-08-20T08:03:01.620Z","updated":"2026-04-28T16:13:28.978Z","title":"WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elliot Sowersby / RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-54027","published":"2025-08-20T08:03:01.080Z","updated":"2026-04-28T16:13:28.914Z","title":"WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Schiocco","product":"Support Board","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-54028","published":"2025-08-20T08:03:00.560Z","updated":"2026-04-28T16:13:29.140Z","title":"WordPress CF7 WOW Styler Plugin <= 1.7.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Saleswonder Team: Tobias","product":"CF7 WOW Styler","kev":false,"epss":0.00567,"kevAdded":null},{"id":"CVE-2025-54031","published":"2025-08-20T08:02:59.891Z","updated":"2026-04-28T16:13:29.200Z","title":"WordPress Support Board <= 3.8.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Schiocco","product":"Support Board","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2025-54032","published":"2025-08-20T08:02:59.315Z","updated":"2026-04-28T16:13:29.424Z","title":"WordPress Real Estate Manager Pro Plugin <= 12.7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WebCodingPlace","product":"Real Estate Manager Pro","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-54034","published":"2025-08-20T08:02:58.773Z","updated":"2026-04-28T16:13:29.216Z","title":"WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00567,"kevAdded":null},{"id":"CVE-2025-54040","published":"2025-08-20T08:02:58.162Z","updated":"2026-04-28T16:13:29.370Z","title":"WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2025-54044","published":"2025-08-20T08:02:57.647Z","updated":"2026-04-28T16:13:29.770Z","title":"WordPress Elite Video Player <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"_CreativeMedia_","product":"Elite Video Player","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-54046","published":"2025-08-20T08:02:57.124Z","updated":"2026-04-28T16:13:29.774Z","title":"WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"QuanticaLabs","product":"Cost Calculator","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-54048","published":"2025-08-20T08:02:56.540Z","updated":"2026-04-28T16:13:29.799Z","title":"WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"miniOrange","product":"Custom API for WP","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-54049","published":"2025-08-20T08:02:55.961Z","updated":"2026-04-28T16:13:29.775Z","title":"WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"miniOrange","product":"Custom API for WP","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-54052","published":"2025-08-20T08:02:55.255Z","updated":"2026-04-28T16:13:30.444Z","title":"WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Realtyna","product":"Realtyna Organic IDX plugin","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-54053","published":"2025-08-20T08:02:54.742Z","updated":"2026-04-28T16:13:33.816Z","title":"WordPress Groundhogg  plugin <= 4.2.2 - PHP Object Injection vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-54055","published":"2025-08-20T08:02:54.222Z","updated":"2026-05-13T00:04:37.009Z","title":"WordPress Druco <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"skygroup","product":"Druco","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-54056","published":"2025-08-20T08:02:53.635Z","updated":"2026-04-28T16:13:33.834Z","title":"WordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Responsive HTML5 Audio Player PRO With Playlist","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-54670","published":"2025-08-20T08:02:53.018Z","updated":"2026-04-28T16:13:34.234Z","title":"WordPress oik Plugin <= 4.15.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-54677","published":"2025-08-20T08:02:52.476Z","updated":"2026-04-28T16:13:33.894Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2025-54713","published":"2025-08-20T08:02:51.904Z","updated":"2026-04-28T16:13:35.836Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"magepeopleteam","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2025-54726","published":"2025-08-20T08:02:51.388Z","updated":"2026-04-28T16:13:36.451Z","title":"WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Miguel Useche","product":"JS Archive List","kev":false,"epss":0.01514,"kevAdded":null},{"id":"CVE-2025-54735","published":"2025-08-20T08:02:50.749Z","updated":"2026-04-28T16:13:36.767Z","title":"WordPress CubeWP Framework Plugin <= 1.1.24 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2025-54750","published":"2025-08-20T08:02:50.191Z","updated":"2026-05-13T00:05:21.405Z","title":"WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Aman","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2025-55715","published":"2025-08-20T08:02:49.588Z","updated":"2026-05-12T00:34:48.801Z","title":"WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeisle","product":"Otter - Gutenberg Block","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-49895","published":"2025-08-16T02:34:50.784Z","updated":"2026-04-28T16:13:07.331Z","title":"WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iThemes","product":"ServerBuddy by PluginBuddy.com","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-49898","published":"2025-08-15T15:41:55.857Z","updated":"2026-04-28T16:13:07.386Z","title":"WordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.6,"vendor":"Xolluteon","product":"Dropshix","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-49432","published":"2025-08-15T15:13:13.782Z","updated":"2026-04-28T16:13:04.575Z","title":"WordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"FWDesign","product":"Ultimate Video Player","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49897","published":"2025-08-15T15:13:13.206Z","updated":"2026-04-28T16:13:07.336Z","title":"WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"gopiplus","product":"Vertical scroll slideshow gallery v2","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-52765","published":"2025-08-14T18:22:06.364Z","updated":"2026-04-28T16:13:18.602Z","title":"WordPress NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"lisensee","product":"NetInsight Analytics Implementation Plugin","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52767","published":"2025-08-14T18:22:05.767Z","updated":"2026-04-28T16:13:18.567Z","title":"WordPress NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"lisensee","product":"NetInsight Analytics Implementation Plugin","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-52769","published":"2025-08-14T18:22:05.239Z","updated":"2026-04-28T16:13:18.420Z","title":"WordPress flexo-social-gallery Plugin <= 1.0006 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"flexostudio","product":"flexo-social-gallery","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-52771","published":"2025-08-14T18:22:04.708Z","updated":"2026-04-28T16:13:18.711Z","title":"WordPress Video Expander Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bcupham","product":"Video Expander","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-52797","published":"2025-08-14T18:22:04.151Z","updated":"2026-04-28T16:13:18.999Z","title":"WordPress StoryMap Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.2,"vendor":"josepsitjar","product":"StoryMap","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-53219","published":"2025-08-14T18:22:02.343Z","updated":"2026-04-28T16:13:20.827Z","title":"WordPress WP-Database-Optimizer-Tools Plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pl4g4","product":"WP-Database-Optimizer-Tools","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-53221","published":"2025-08-14T18:22:01.641Z","updated":"2026-04-28T16:13:21.203Z","title":"WordPress CodeablePress plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"codeablepress","product":"CodeablePress","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-53241","published":"2025-08-14T18:22:00.994Z","updated":"2026-05-12T00:32:01.937Z","title":"WordPress Simplified plugin <= 1.0.11 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"kodeshpa","product":"Simplified","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53249","published":"2025-08-14T18:22:00.287Z","updated":"2026-04-28T16:13:21.820Z","title":"WordPress Build App Online Plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hakeemnala","product":"Build App Online","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-53330","published":"2025-08-14T18:21:59.485Z","updated":"2026-05-12T00:31:55.517Z","title":"WordPress WP Rentals theme <= 3.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WpEstate","product":"WP Rentals","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-53341","published":"2025-08-14T18:21:57.476Z","updated":"2026-09-14T10:19:09.284Z","title":"WordPress Stratus theme <= 4.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Pixel Makers Creative INC.","product":"App, SaaS & Software Startup Tech Theme - Stratus","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-53342","published":"2025-08-14T18:21:56.161Z","updated":"2026-04-28T16:13:24.044Z","title":"WordPress Modernize Theme <= 3.4.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GoodLayers","product":"Modernize","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-53343","published":"2025-08-14T18:21:55.110Z","updated":"2026-04-28T16:13:24.083Z","title":"WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"GoodLayers","product":"Modernize","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-53347","published":"2025-08-14T18:21:54.102Z","updated":"2026-04-28T16:13:24.211Z","title":"WordPress Kalium Theme <= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Laborator","product":"Kalium","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-53575","published":"2025-08-14T18:21:53.588Z","updated":"2026-04-28T16:13:26.640Z","title":"WordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"primersoftware","product":"Primer MyData for Woocommerce","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-53581","published":"2025-08-14T18:21:53.038Z","updated":"2026-04-28T16:13:26.984Z","title":"WordPress RSS Feed Pro Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"artiosmedia","product":"RSS Feed Pro","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-53582","published":"2025-08-14T18:21:52.363Z","updated":"2026-04-28T16:13:26.953Z","title":"WordPress WordLift Plugin <= 3.54.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WordLift","product":"WordLift","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-53587","published":"2025-08-14T18:21:51.256Z","updated":"2026-04-28T16:13:27.014Z","title":"WordPress Findgo Theme <= 1.3.57 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"ApusTheme","product":"Findgo","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-54054","published":"2025-08-14T18:21:48.649Z","updated":"2026-04-28T16:13:30.163Z","title":"WordPress 12 Step Meeting List Plugin <= 3.18.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AA Web Servant","product":"12 Step Meeting List","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-54708","published":"2025-08-14T18:21:47.472Z","updated":"2026-05-12T00:31:15.824Z","title":"WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-54712","published":"2025-08-14T18:21:46.895Z","updated":"2026-04-28T16:13:35.828Z","title":"WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"hashthemes","product":"Easy Elementor Addons","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-54715","published":"2025-08-14T18:21:46.363Z","updated":"2026-04-28T16:13:35.887Z","title":"WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.9.0 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-54717","published":"2025-08-14T18:21:45.839Z","updated":"2026-04-28T16:13:35.848Z","title":"WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"e-plugins","product":"WP Membership","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-54727","published":"2025-08-14T18:21:45.295Z","updated":"2026-04-28T16:13:36.619Z","title":"WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CreativeMindsSolutions","product":"CM On Demand Search And Replace","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-54728","published":"2025-08-14T18:21:43.685Z","updated":"2026-04-28T16:13:36.872Z","title":"WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreativeMindsSolutions","product":"CM On Demand Search And Replace","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-54729","published":"2025-08-14T18:21:41.050Z","updated":"2026-05-12T00:30:42.984Z","title":"WordPress Webba Booking Plugin <= 6.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-54730","published":"2025-08-14T18:21:40.043Z","updated":"2026-05-12T00:31:02.869Z","title":"WordPress Embedder for Google Reviews Plugin <= 1.7.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PARETO Digital","product":"Embedder for Google Reviews","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-54732","published":"2025-08-14T18:21:39.427Z","updated":"2026-04-28T16:13:36.885Z","title":"WordPress WPDM – Premium Packages Plugin <= 6.0.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjada","product":"WPDM – Premium Packages","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-54736","published":"2025-08-14T18:21:38.816Z","updated":"2026-04-28T16:13:36.767Z","title":"WordPress Savoy Theme <= 3.0.8 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NordicMade","product":"Savoy","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-54739","published":"2025-08-14T18:21:38.205Z","updated":"2026-04-28T16:13:36.760Z","title":"WordPress Nexter Blocks Plugin <= 4.5.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"POSIMYTH","product":"Nexter Blocks","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-54740","published":"2025-08-14T18:21:37.483Z","updated":"2026-05-12T00:31:49.063Z","title":"WordPress Print My Blog Plugin <= 3.27.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Michael Nelson","product":"Print My Blog","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-54746","published":"2025-08-14T18:21:36.347Z","updated":"2026-04-28T16:13:36.847Z","title":"WordPress Shortcode Redirect Plugin <= 1.0.02 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"cartpauj","product":"Shortcode Redirect","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-54747","published":"2025-08-14T18:21:35.789Z","updated":"2026-04-28T16:13:37.092Z","title":"WordPress Templatera Plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpbakery","product":"Templatera","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-54749","published":"2025-08-14T18:21:35.192Z","updated":"2026-04-28T16:13:37.153Z","title":"WordPress JetProductGallery Plugin <= 2.2.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetProductGallery","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-55708","published":"2025-08-14T18:21:34.645Z","updated":"2026-04-28T16:13:37.171Z","title":"WordPress Quiz And Survey Master Plugin <= 10.2.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-55709","published":"2025-08-14T18:21:31.435Z","updated":"2026-04-28T16:13:37.165Z","title":"WordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-55710","published":"2025-08-14T18:21:29.824Z","updated":"2026-04-28T16:13:37.201Z","title":"WordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Steve Burge","product":"TaxoPress","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-55711","published":"2025-08-14T18:21:28.502Z","updated":"2026-04-28T16:13:37.224Z","title":"WordPress WP Table Builder Plugin <= 2.0.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Table Builder","product":"WP Table Builder","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-55712","published":"2025-08-14T18:21:26.040Z","updated":"2026-04-28T16:13:37.292Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 6.3.13 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-55713","published":"2025-08-14T18:21:25.460Z","updated":"2026-04-28T16:13:37.517Z","title":"WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"creativethemeshq","product":"Blocksy","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-55714","published":"2025-08-14T18:21:24.869Z","updated":"2026-04-28T16:13:37.418Z","title":"WordPress JetElements For Elementor Plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-55716","published":"2025-08-14T18:21:23.962Z","updated":"2026-04-28T16:13:37.332Z","title":"WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2024-37945","published":"2025-08-14T17:15:51.397Z","updated":"2026-05-13T00:04:22.557Z","title":"WordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpbits","product":"WPBITS Addons For Elementor Page Builder","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-54707","published":"2025-08-14T10:34:59.518Z","updated":"2026-04-28T16:13:35.838Z","title":"WordPress MDTF Plugin <= 1.3.3.7 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"MDTF","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-54706","published":"2025-08-14T10:34:58.971Z","updated":"2026-04-28T16:13:35.700Z","title":"WordPress Magical Posts Display Plugin plugin <= 1.2.52 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"Magical Posts Display","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-54705","published":"2025-08-14T10:34:58.440Z","updated":"2026-05-12T00:31:43.074Z","title":"WordPress WpEvently plugin <= 4.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-54704","published":"2025-08-14T10:34:57.899Z","updated":"2026-05-12T00:30:56.495Z","title":"WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hashthemes","product":"Easy Elementor Addons","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-54703","published":"2025-08-14T10:34:57.381Z","updated":"2026-04-28T16:13:34.934Z","title":"WordPress Integrate Google Drive plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"princeahmed","product":"Integrate Google Drive","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-54702","published":"2025-08-14T10:34:56.861Z","updated":"2026-04-28T16:13:34.988Z","title":"WordPress Ebook Store Plugin plugin <= 5.8013 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-54701","published":"2025-08-14T10:34:56.302Z","updated":"2026-04-28T16:13:34.923Z","title":"WordPress Unicamp Theme <= 2.6.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Unicamp","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-54700","published":"2025-08-14T10:34:55.769Z","updated":"2026-04-28T16:13:34.986Z","title":"WordPress Makeaholic Theme <= 1.8.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Makeaholic","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-54699","published":"2025-08-14T10:34:55.202Z","updated":"2026-04-28T16:13:34.988Z","title":"WordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-54698","published":"2025-08-14T10:34:54.692Z","updated":"2026-04-28T16:13:35.001Z","title":"WordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-54697","published":"2025-08-14T10:34:54.167Z","updated":"2026-04-28T16:13:35.057Z","title":"WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability","severity":"HIGH","score":7.2,"vendor":"StellarWP","product":"Kadence WooCommerce Email Designer","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-54696","published":"2025-08-14T10:34:53.631Z","updated":"2026-04-28T16:13:34.934Z","title":"WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-54695","published":"2025-08-14T10:34:53.074Z","updated":"2026-04-28T16:13:34.980Z","title":"WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"DevItems","product":"HT Mega","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-54694","published":"2025-08-14T10:34:52.521Z","updated":"2026-04-28T16:13:34.992Z","title":"WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-54693","published":"2025-08-14T10:34:51.992Z","updated":"2026-04-28T16:13:34.992Z","title":"WordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9,"vendor":"epiphyt","product":"Form Block","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-54692","published":"2025-08-14T10:34:51.406Z","updated":"2026-05-12T00:31:09.372Z","title":"WordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Membership For WooCommerce","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-54691","published":"2025-08-14T10:34:50.849Z","updated":"2026-04-28T16:13:35.044Z","title":"WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-54690","published":"2025-08-14T10:34:50.330Z","updated":"2026-04-28T16:13:34.936Z","title":"WordPress Xinterio Theme <= 4.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"themeStek","product":"Xinterio","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2025-54689","published":"2025-08-14T10:34:49.815Z","updated":"2026-04-28T16:13:34.965Z","title":"WordPress Urna Theme <= 2.5.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Urna","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-54688","published":"2025-08-14T10:34:49.257Z","updated":"2026-04-28T16:13:34.906Z","title":"WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-54687","published":"2025-08-14T10:34:48.750Z","updated":"2026-05-12T00:31:36.190Z","title":"WordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-54686","published":"2025-08-14T10:34:48.233Z","updated":"2026-04-28T16:13:34.984Z","title":"WordPress Exertio Theme <= 1.3.2 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Exertio","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-54685","published":"2025-08-14T10:34:47.697Z","updated":"2026-04-28T16:13:34.260Z","title":"WordPress SureDash Plugin <= 1.1.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-54684","published":"2025-08-14T10:34:47.187Z","updated":"2026-04-28T16:13:33.997Z","title":"WordPress Integration for Contact Form 7 and Constant Contact Plugin plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CRM Perks","product":"Integration for Contact Form 7 and Constant Contact","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-54683","published":"2025-08-14T10:34:46.673Z","updated":"2026-04-28T16:13:34.244Z","title":"WordPress WP Modal Popup with Cookie Integration Plugin plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Astoundify","product":"WP Modal Popup with Cookie Integration","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-54682","published":"2025-08-14T10:34:46.106Z","updated":"2026-04-28T16:13:34.266Z","title":"WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CRM Perks","product":"Connector for Gravity Forms and Google Sheets","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-54681","published":"2025-08-14T10:34:44.536Z","updated":"2026-04-28T16:13:34.015Z","title":"WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"Connector for Gravity Forms and Google Sheets","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-54680","published":"2025-08-14T10:34:44.021Z","updated":"2026-04-28T16:13:33.846Z","title":"WordPress Blogger Buzz Theme theme <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sparklewpthemes","product":"Blogger Buzz","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-54679","published":"2025-08-14T10:34:43.500Z","updated":"2026-04-28T16:13:33.948Z","title":"WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability","severity":"HIGH","score":7.5,"vendor":"vertim","product":"Neon Channel Product Customizer Free","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-54678","published":"2025-08-14T10:34:42.955Z","updated":"2026-04-28T16:13:33.940Z","title":"WordPress Easy Form Builder Plugin <= 3.8.15 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"hassantafreshi","product":"Easy Form Builder","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-54676","published":"2025-08-14T10:34:42.416Z","updated":"2026-04-28T16:13:34.237Z","title":"WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-54675","published":"2025-08-14T10:34:41.898Z","updated":"2026-05-12T00:31:22.324Z","title":"WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"YITHEMES","product":"YITH WooCommerce Popup","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-54674","published":"2025-08-14T10:34:41.383Z","updated":"2026-04-28T16:13:34.257Z","title":"WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"mklacroix","product":"Product Configurator for WooCommerce","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-54673","published":"2025-08-14T10:34:40.829Z","updated":"2026-04-28T16:13:33.976Z","title":"WordPress Chartify plugin <= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Chartify","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-54672","published":"2025-08-14T10:34:40.287Z","updated":"2026-04-28T16:13:33.949Z","title":"WordPress Photo Engine Plugin plugin <= 6.4.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jordy Meow","product":"Photo Engine","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-54671","published":"2025-08-14T10:34:39.773Z","updated":"2026-05-12T00:31:29.000Z","title":"WordPress oik plugin <= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-54669","published":"2025-08-14T10:34:39.239Z","updated":"2026-05-12T00:30:49.518Z","title":"WordPress MapSVG Plugin < 8.7.4 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-54668","published":"2025-08-14T10:34:38.390Z","updated":"2026-04-28T16:13:34.156Z","title":"WordPress myCred plugin <= 2.9.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-54667","published":"2025-08-14T10:34:37.828Z","updated":"2026-04-28T16:13:34.224Z","title":"WordPress myCred plugin <= 2.9.4.3 - Race Condition Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-3703","published":"2025-08-14T10:34:37.304Z","updated":"2026-04-28T16:12:29.126Z","title":"WordPress CSS & JavaScript Toolbox plugin < 12.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"wipeoutmedia","product":"CSS & JavaScript Toolbox","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2025-24766","published":"2025-08-14T10:34:36.787Z","updated":"2026-04-28T16:11:34.362Z","title":"WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"wproyal","product":"News Magazine X","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-24775","published":"2025-08-14T10:34:36.243Z","updated":"2026-04-28T16:11:34.345Z","title":"WordPress Forms <= 2.9.0 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Made I.T.","product":"Forms","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-25172","published":"2025-08-14T10:34:35.681Z","updated":"2026-04-28T16:11:37.638Z","title":"WordPress VidMov <= 1.9.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"beeteam368","product":"VidMov","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2025-25174","published":"2025-08-14T10:34:35.115Z","updated":"2026-04-28T16:11:37.648Z","title":"WordPress BeeTeam368 Extensions Plugin <= 1.9.4 - Local File Inclusion Vulnerability","severity":"CRITICAL","score":10,"vendor":"beeteam368","product":"BeeTeam368 Extensions","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-28962","published":"2025-08-14T10:34:34.593Z","updated":"2026-04-28T16:11:51.858Z","title":"WordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"stefanoai","product":"Advanced Google Universal Analytics","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-28975","published":"2025-08-14T10:34:34.059Z","updated":"2026-04-28T16:11:52.040Z","title":"WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"redqteam","product":"Alike - WordPress Custom Post Comparison","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-28979","published":"2025-08-14T10:34:33.537Z","updated":"2026-04-28T16:11:52.183Z","title":"WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2025-28987","published":"2025-08-14T10:34:32.614Z","updated":"2026-04-28T16:11:52.348Z","title":"WordPress PressForward <= 5.9.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"PressForward","product":"PressForward","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-28999","published":"2025-08-14T10:34:32.081Z","updated":"2026-04-28T16:11:52.624Z","title":"WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ZoomIt","product":"WooCommerce Shop Page Builder","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-29014","published":"2025-08-14T10:34:31.546Z","updated":"2026-04-28T16:11:53.066Z","title":"WordPress FoodMenu <= 1.20 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ZoomIt","product":"FoodMenu","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-30626","published":"2025-08-14T10:34:30.974Z","updated":"2026-04-28T16:11:56.480Z","title":"WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Multimedia Playlist Slider Addon for WPBakery Page Builder","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-30635","published":"2025-08-14T10:34:30.395Z","updated":"2026-04-28T16:11:56.536Z","title":"WordPress IDonatePro <= 2.1.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeAtelier","product":"IDonatePro","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2025-30639","published":"2025-08-14T10:34:29.865Z","updated":"2026-04-28T16:11:56.731Z","title":"WordPress IDonatePro Plugin <= 2.1.9 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeAtelier","product":"IDonatePro","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2025-30993","published":"2025-08-14T10:34:29.320Z","updated":"2026-04-28T16:12:03.271Z","title":"WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-30998","published":"2025-08-14T10:34:28.774Z","updated":"2026-04-28T16:12:03.309Z","title":"WordPress WP Links Page plugin <= 4.9.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Rico Macchi","product":"WP Links Page","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-31007","published":"2025-08-14T10:34:28.245Z","updated":"2026-04-28T16:12:03.670Z","title":"WordPress Billplz Addon for Contact Form 7 Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Alvind","product":"Billplz Addon for Contact Form 7","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-31425","published":"2025-08-14T10:34:27.684Z","updated":"2026-05-12T00:33:29.646Z","title":"WordPress WP Lead Capturing Pages plugin < 2.6 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"kamleshyadav","product":"WP Lead Capturing Pages","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-32288","published":"2025-08-14T10:34:27.157Z","updated":"2026-05-12T00:32:54.842Z","title":"WordPress RT-Theme 18 | Extensions plugin <= 2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"stmcan","product":"RT-Theme 18 | Extensions","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-39483","published":"2025-08-14T10:34:26.628Z","updated":"2026-04-28T16:12:32.646Z","title":"WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"imithemes","product":"Eventer","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-39510","published":"2025-08-14T10:34:26.102Z","updated":"2026-04-28T16:12:33.892Z","title":"WordPress Pinterest Automatic Pin plugin < 4.19.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ValvePress","product":"Pinterest Automatic Pin","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-47536","published":"2025-08-14T10:34:25.579Z","updated":"2026-04-28T16:12:44.509Z","title":"WordPress Content Egg plugin <= 7.0.0 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"keywordrush","product":"Content Egg","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-47610","published":"2025-08-14T10:34:24.864Z","updated":"2026-04-28T16:12:46.983Z","title":"WordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wetail","product":"WooCommerce Fortnox Integration","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-47689","published":"2025-08-14T10:34:24.327Z","updated":"2026-04-28T16:12:49.792Z","title":"WordPress Video Blogster Lite plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"johnh10","product":"Video Blogster Lite","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-48293","published":"2025-08-14T10:34:23.777Z","updated":"2026-04-28T16:12:55.348Z","title":"WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-48332","published":"2025-08-14T10:34:23.230Z","updated":"2026-05-12T00:32:48.248Z","title":"WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"PublishPress","product":"Gutenberg Blocks","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-49033","published":"2025-08-14T10:34:22.669Z","updated":"2026-04-28T16:12:57.824Z","title":"WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-49036","published":"2025-08-14T10:34:22.147Z","updated":"2026-04-28T16:12:57.769Z","title":"WordPress Premium Addons for KingComposer Plugin <= 1.1.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"octagonwebstudio","product":"Premium Addons for KingComposer","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-49037","published":"2025-08-14T10:34:21.603Z","updated":"2026-05-12T00:32:08.434Z","title":"WordPress Authentication and xmlrpc log writer plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Federico Rota","product":"Authentication and xmlrpc log writer","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-49038","published":"2025-08-14T10:34:21.050Z","updated":"2026-04-28T16:12:58.067Z","title":"WordPress WP Dynamic Links plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Soflyy","product":"WP Dynamic Links","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49044","published":"2025-08-14T10:34:20.493Z","updated":"2026-05-12T00:32:28.399Z","title":"WordPress Simple Poll plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"tosend.it","product":"Simple Poll","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-49047","published":"2025-08-14T10:34:19.931Z","updated":"2026-04-28T16:12:58.072Z","title":"WordPress DigitalOcean Spaces Sync plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"keeross","product":"DigitalOcean Spaces Sync","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-49048","published":"2025-08-14T10:34:19.394Z","updated":"2026-04-28T16:12:57.908Z","title":"WordPress Inspectlet – User Session Recording and Heatmaps plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"inspectlet","product":"Inspectlet – User Session Recording and Heatmaps","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-49051","published":"2025-08-14T10:34:18.826Z","updated":"2026-04-28T16:12:58.030Z","title":"WordPress Hide Text Shortcode plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"biscia7","product":"Hide Text Shortcode","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-49052","published":"2025-08-14T10:34:18.280Z","updated":"2026-04-28T16:12:58.159Z","title":"WordPress Netease Music plugin <= 3.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dariolee","product":"Netease Music","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-49053","published":"2025-08-14T10:34:17.757Z","updated":"2026-05-12T00:32:41.245Z","title":"WordPress WP Airdrop Manager plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"kadesthemes","product":"WP Airdrop Manager","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-49054","published":"2025-08-14T10:34:16.023Z","updated":"2026-04-28T16:12:58.143Z","title":"WordPress Time Sheets plugin <= 2.1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mrdenny","product":"Time Sheets","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49056","published":"2025-08-14T10:34:15.436Z","updated":"2026-04-28T16:12:58.268Z","title":"WordPress 多说社会化评论框 Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"shen2","product":"多说社会化评论框","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49057","published":"2025-08-14T10:34:14.890Z","updated":"2026-04-28T16:12:58.233Z","title":"WordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Ko Min","product":"WP Voting","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49058","published":"2025-08-14T10:34:14.370Z","updated":"2026-04-28T16:12:58.420Z","title":"WordPress SoundSt SEO Search plugin <= 1.2.3  - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sound Strategies","product":"SoundSt SEO Search","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-49059","published":"2025-08-14T10:34:13.819Z","updated":"2026-04-28T16:12:58.596Z","title":"WordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CleverReach®","product":"CleverReach® WP","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-49061","published":"2025-08-14T10:34:13.291Z","updated":"2026-04-28T16:12:58.604Z","title":"WordPress Porn Videos Embed plugin <= 0.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"perteus","product":"Porn Videos Embed","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-49062","published":"2025-08-14T10:34:12.705Z","updated":"2026-04-28T16:12:58.568Z","title":"WordPress WP-jScrollPane plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"cornfeed","product":"WP-jScrollPane","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49063","published":"2025-08-14T10:34:12.190Z","updated":"2026-04-28T16:12:58.724Z","title":"WordPress BaiduXZH Submit(百度熊掌号) plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"i3geek","product":"BaiduXZH Submit(百度熊掌号)","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49064","published":"2025-08-14T10:34:11.643Z","updated":"2026-05-12T00:32:15.403Z","title":"WordPress User Language Switch plugin <= 1.6.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Webilop","product":"User Language Switch","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49065","published":"2025-08-14T10:34:11.102Z","updated":"2026-04-28T16:12:58.545Z","title":"WordPress Visit Counter Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"BestiaDurmiente","product":"Visit Counter","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-49264","published":"2025-08-14T10:34:10.536Z","updated":"2026-04-28T16:12:59.484Z","title":"WordPress Cloud SAML SSO - Single Sign On Login <= 1.0.18 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Cloud Infrastructure Services","product":"Cloud SAML SSO - Single Sign On Login","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2025-49267","published":"2025-08-14T10:34:10.018Z","updated":"2026-04-28T16:12:59.508Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.28.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-49271","published":"2025-08-14T10:34:09.459Z","updated":"2026-05-12T00:32:34.814Z","title":"WordPress GravityWP - Merge Tags <= 1.4.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"GravityWP","product":"GravityWP - Merge Tags","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-49433","published":"2025-08-14T10:34:08.924Z","updated":"2026-04-29T09:51:55.663Z","title":"WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThanhD","product":"Supermalink","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-49437","published":"2025-08-14T10:34:08.095Z","updated":"2026-04-29T09:51:55.313Z","title":"WordPress WP LOL Rotation <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"worstguy","product":"WP LOL Rotation","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-49869","published":"2025-08-14T10:34:07.565Z","updated":"2026-05-12T00:32:21.848Z","title":"WordPress Eventin Plugin <= 4.0.31 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-49887","published":"2025-08-14T10:34:06.810Z","updated":"2026-04-28T16:13:07.077Z","title":"WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPFactory","product":"Product XML Feed Manager for WooCommerce","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-50029","published":"2025-08-14T10:34:06.255Z","updated":"2026-04-28T16:13:16.396Z","title":"WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ashish","product":"AI Tools","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-50031","published":"2025-08-14T10:34:05.698Z","updated":"2026-04-28T16:13:16.407Z","title":"WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"syedamirhussain91","product":"DB Backup","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-50040","published":"2025-08-14T10:34:05.173Z","updated":"2026-04-28T16:13:16.836Z","title":"WordPress CF7 Spreadsheets Plugin <= 2.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"moshensky","product":"CF7 Spreadsheets","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-52712","published":"2025-08-14T10:34:04.649Z","updated":"2026-04-28T16:13:17.196Z","title":"WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability","severity":"MEDIUM","score":4.2,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-52716","published":"2025-08-14T10:34:04.110Z","updated":"2026-04-28T16:13:17.309Z","title":"WordPress WP REST Cache <= 2025.1.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Acato","product":"WP REST Cache","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2025-52720","published":"2025-08-14T10:34:03.399Z","updated":"2026-04-28T16:13:17.607Z","title":"WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-52721","published":"2025-08-14T10:34:02.844Z","updated":"2026-04-28T16:13:17.579Z","title":"WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LCweb","product":"Global Gallery","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-52728","published":"2025-08-14T10:34:02.317Z","updated":"2026-04-28T16:13:17.683Z","title":"WordPress Responsive Posts Carousel WordPress Plugin Plugin <= 15.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WebCodingPlace","product":"Responsive Posts Carousel Pro","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2025-52730","published":"2025-08-14T10:34:01.776Z","updated":"2026-05-12T00:33:08.735Z","title":"WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themefunction","product":"WordPress Event Manager, Event Calendar and Booking Plugin","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-52731","published":"2025-08-14T10:34:01.225Z","updated":"2026-04-28T16:13:17.770Z","title":"WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion Vulnerability","severity":"HIGH","score":7.5,"vendor":"themefunction","product":"WordPress Event Manager, Event Calendar and Booking Plugin","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-52732","published":"2025-08-14T10:34:00.681Z","updated":"2026-04-28T16:13:17.667Z","title":"WordPress Google Map Targeting Plugin <= 1.1.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.8,"vendor":"RealMag777","product":"GMap Targeting","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-52775","published":"2025-08-14T10:34:00.145Z","updated":"2026-04-28T16:13:18.703Z","title":"WordPress Project Cost Calculator Plugin <= 1.0.0 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"Ronik@UnlimitedWP","product":"Project Cost Calculator","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-52785","published":"2025-08-14T10:33:59.436Z","updated":"2026-04-28T16:13:19.033Z","title":"WordPress SMM API plugin <= 6.0.31 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"softnwords","product":"SMM API","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-52788","published":"2025-08-14T10:33:58.848Z","updated":"2026-05-12T00:33:15.166Z","title":"WordPress CaptionPix <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Russell Jamieson","product":"CaptionPix","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-52800","published":"2025-08-14T10:33:58.298Z","updated":"2026-04-28T16:13:19.018Z","title":"WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability","severity":"HIGH","score":7.3,"vendor":"Unity Business Technology Pty Ltd","product":"The E-Commerce ERP","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-52801","published":"2025-08-14T10:33:57.635Z","updated":"2026-05-12T00:33:23.139Z","title":"WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability","severity":"HIGH","score":7.3,"vendor":"VonStroheim","product":"TheBooking","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-52806","published":"2025-08-14T10:33:57.075Z","updated":"2026-04-28T16:13:19.463Z","title":"WordPress JobSearch Plugin < 3.0.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2025-52820","published":"2025-08-14T10:33:56.543Z","updated":"2026-04-28T16:13:19.695Z","title":"WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"infosoftplugin","product":"WooCommerce Point Of Sale (POS)","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-52823","published":"2025-08-14T10:33:55.958Z","updated":"2026-05-12T00:33:01.257Z","title":"WordPress Cube Portfolio Plugin <= 1.16.8 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"ovatheme","product":"Cube Portfolio","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-47444","published":"2025-08-12T06:37:11.075Z","updated":"2026-04-28T16:12:40.879Z","title":"WordPress FiboSearch plugin <= 1.32.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Damian Góra","product":"FiboSearch","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-24000","published":"2025-08-07T16:58:28.884Z","updated":"2026-05-13T00:04:08.090Z","title":"WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability","severity":"HIGH","score":8.8,"vendor":"Saad Iqbal","product":"Post SMTP","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-24759","published":"2025-07-16T11:28:14.460Z","updated":"2026-04-28T16:11:34.077Z","title":"WordPress WP-BusinessDirectory <= 3.1.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CMSJunkie - WordPress Business Directory Plugins","product":"WP-BusinessDirectory","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2025-24777","published":"2025-07-16T11:28:13.994Z","updated":"2026-04-28T16:11:34.304Z","title":"WordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"awethemes","product":"Hillter","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-24779","published":"2025-07-16T11:28:13.539Z","updated":"2026-04-28T16:11:34.519Z","title":"WordPress Yogi theme < 2.9.3 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"NooTheme","product":"Yogi","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-28955","published":"2025-07-16T11:28:13.092Z","updated":"2026-04-28T16:11:51.623Z","title":"WordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"FWDesign","product":"Easy Video Player Wordpress & WooCommerce","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2025-28959","published":"2025-07-16T11:28:12.621Z","updated":"2026-04-28T16:11:51.708Z","title":"WordPress URL Shortener <= 3.0.7 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Md Yeasin Ul Haider","product":"URL Shortener","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-28961","published":"2025-07-16T11:28:12.145Z","updated":"2026-04-28T16:11:51.884Z","title":"WordPress URL Shortener <= 3.0.7 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Md Yeasin Ul Haider","product":"URL Shortener","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-28965","published":"2025-07-16T11:28:11.680Z","updated":"2026-04-28T16:11:52.063Z","title":"WordPress URL Shortener <= 3.0.7 - Broken Access Control Vulnerability","severity":"HIGH","score":8.6,"vendor":"Md Yeasin Ul Haider","product":"URL Shortener","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2025-28982","published":"2025-07-16T11:28:11.175Z","updated":"2026-04-28T16:11:52.496Z","title":"WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2025-29000","published":"2025-07-16T11:28:10.658Z","updated":"2026-04-28T16:11:52.604Z","title":"WordPress Multi-language Responsive Contact Form plugin <= 2.8 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"August Infotech","product":"Multi-language Responsive Contact Form","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-29009","published":"2025-07-16T11:28:10.176Z","updated":"2026-04-28T16:11:52.824Z","title":"WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"Webkul","product":"Medical Prescription Attachment Plugin for WooCommerce","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-30936","published":"2025-07-16T11:28:09.604Z","updated":"2026-04-28T16:12:01.248Z","title":"WordPress Torod plugin <= 2.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Torod Company for Information Technology","product":"Torod","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-30949","published":"2025-07-16T11:28:09.137Z","updated":"2026-04-28T16:12:02.016Z","title":"WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Guru Team","product":"Site Chat on Telegram","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-30955","published":"2025-07-16T11:28:08.661Z","updated":"2026-04-28T16:12:02.053Z","title":"WordPress ListingEasy theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GT3themes","product":"ListingEasy","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-30959","published":"2025-07-16T11:28:08.195Z","updated":"2026-04-28T16:12:02.174Z","title":"WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Product XML Feed Manager for WooCommerce","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-30973","published":"2025-07-16T11:28:07.716Z","updated":"2026-04-28T16:12:02.388Z","title":"WordPress CoSchool LMS plugin <= 1.4.3 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Codexpert, Inc","product":"CoSchool LMS","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31055","published":"2025-07-16T11:28:07.238Z","updated":"2026-05-12T00:30:23.184Z","title":"WordPress Electrician - Electrical Service WordPress theme <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"vergatheme","product":"Electrician - Electrical Service WordPress","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31070","published":"2025-07-16T11:28:06.767Z","updated":"2026-04-28T16:12:04.763Z","title":"WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin <= 2.5 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"LambertGroup","product":"HTML5 Radio Player - WPBakery Page Builder Addon","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2025-31072","published":"2025-07-16T11:28:06.277Z","updated":"2026-04-28T16:12:04.810Z","title":"WordPress Ofiz - Business Consulting Theme plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"Ofiz - WordPress Business Consulting Theme","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31422","published":"2025-07-16T11:28:05.668Z","updated":"2026-04-28T16:12:06.776Z","title":"WordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Visual Art | Gallery WordPress Theme","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2025-31427","published":"2025-07-16T11:28:05.193Z","updated":"2026-04-28T16:12:06.903Z","title":"WordPress Invico - WordPress Consulting Business Theme <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"Invico - WordPress Consulting Business Theme","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-32574","published":"2025-07-16T11:28:04.716Z","updated":"2026-04-28T16:12:24.332Z","title":"WordPress WPGYM plugin <= 65.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"mojoomla","product":"WPGYM","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-46500","published":"2025-07-16T11:28:04.238Z","updated":"2026-04-28T16:12:39.572Z","title":"WordPress Wordpress Auto Spinner plugin <= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ValvePress","product":"Wordpress Auto Spinner","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-47554","published":"2025-07-16T11:28:03.786Z","updated":"2026-04-28T16:12:44.862Z","title":"WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuanticaLabs","product":"CSS3 Compare Pricing Tables for WordPress","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-47645","published":"2025-07-16T11:28:03.281Z","updated":"2026-04-28T16:12:47.923Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-47652","published":"2025-07-16T11:28:02.774Z","updated":"2026-05-12T00:30:04.075Z","title":"WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-48291","published":"2025-07-16T11:28:02.305Z","updated":"2026-04-28T16:12:55.349Z","title":"WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Wasiliy Strecker / ContestGallery developer","product":"Contest Gallery","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-48300","published":"2025-07-16T11:28:01.803Z","updated":"2026-04-28T16:12:55.732Z","title":"WordPress Groundhogg plugin <= 4.2.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2025-48339","published":"2025-07-16T11:28:01.316Z","updated":"2026-04-28T16:12:56.764Z","title":"WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"activity-log.com","product":"Profiler - What Slowing Down Your WP","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-48345","published":"2025-07-16T11:28:00.737Z","updated":"2026-05-12T00:30:09.174Z","title":"WordPress Contact Form 7 Editor Button plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"arisoft","product":"Contact Form 7 Editor Button","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-49031","published":"2025-07-16T11:28:00.228Z","updated":"2026-04-28T16:12:57.723Z","title":"WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stefan M.","product":"SMu Manual DoFollow","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-49034","published":"2025-07-16T11:27:59.710Z","updated":"2026-04-28T16:12:57.795Z","title":"WordPress Funnel Builder by FunnelKit plugin <= 3.10.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Aman","product":"Funnel Builder by FunnelKit","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-49319","published":"2025-07-16T11:27:59.235Z","updated":"2026-04-28T16:13:00.836Z","title":"WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Wishlist for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49876","published":"2025-07-16T11:27:58.713Z","updated":"2026-04-28T16:13:06.707Z","title":"WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-49884","published":"2025-07-16T11:27:58.254Z","updated":"2026-04-28T16:13:06.734Z","title":"WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"alexvtn","product":"Internal Linking of Related Contents","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49888","published":"2025-07-16T11:27:57.729Z","updated":"2026-04-28T16:13:07.129Z","title":"WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"pimwick","product":"PW WooCommerce On Sale!","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-50028","published":"2025-07-16T11:27:57.237Z","updated":"2026-05-12T00:29:08.153Z","title":"WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodeSolz","product":"Ultimate Push Notifications","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-52714","published":"2025-07-16T11:27:56.743Z","updated":"2026-04-28T16:13:17.342Z","title":"WordPress Traveler theme < 3.2.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"shinetheme","product":"Traveler","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-52777","published":"2025-07-16T11:27:56.274Z","updated":"2026-04-28T16:13:18.736Z","title":"WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"cmsMinds","product":"Pay with Contact Form 7","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-52779","published":"2025-07-16T11:27:55.807Z","updated":"2026-04-28T16:13:18.697Z","title":"WordPress Dot html,php,xml etc pages plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"karimmughal","product":"Dot html,php,xml etc pages","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-52786","published":"2025-07-16T11:27:55.315Z","updated":"2026-04-28T16:13:19.075Z","title":"WordPress Media Folder plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Kingdom Creation","product":"Media Folder","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52787","published":"2025-07-16T11:27:54.842Z","updated":"2026-04-28T16:13:19.100Z","title":"WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"EZiHosting","product":"Tennis Court Bookings","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-52803","published":"2025-07-16T11:27:54.296Z","updated":"2026-04-28T16:13:19.397Z","title":"WordPress Sala theme <= 1.1.3 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"uxper","product":"Sala","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-52804","published":"2025-07-16T11:27:53.783Z","updated":"2026-04-28T16:13:19.221Z","title":"WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"uxper","product":"Nuss","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-52819","published":"2025-07-16T11:27:53.288Z","updated":"2026-04-28T16:13:19.662Z","title":"WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"pakkemx","product":"Pakke Envíos","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-52836","published":"2025-07-16T11:27:52.763Z","updated":"2026-04-28T16:13:20.050Z","title":"WordPress The E-Commerce ERP <= 2.1.1.3 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Unity Business Technology Pty Ltd","product":"The E-Commerce ERP","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2025-48150","published":"2025-07-16T10:36:58.318Z","updated":"2026-04-28T16:12:52.787Z","title":"WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sminozzi","product":"Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-48153","published":"2025-07-16T10:36:57.831Z","updated":"2026-04-28T16:12:52.793Z","title":"WordPress Import CDN-Remote Images plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Atakan Au","product":"Import CDN-Remote Images","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-48155","published":"2025-07-16T10:36:57.300Z","updated":"2026-04-28T16:12:52.815Z","title":"WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"enituretechnology","product":"Residential Address Detection","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-48156","published":"2025-07-16T10:36:56.689Z","updated":"2026-04-28T16:12:52.836Z","title":"WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Parakoos","product":"Image Wall","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-48161","published":"2025-07-16T10:36:56.225Z","updated":"2026-05-12T00:30:16.119Z","title":"WordPress YaySMTP plugin <= 1.3 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YaySMTP","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-48166","published":"2025-07-16T10:36:55.741Z","updated":"2026-04-28T16:12:53.348Z","title":"WordPress Stop and Block bots plugin Anti bots <= 1.48 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sminozzi","product":"Stop and Block bots plugin Anti bots","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-48167","published":"2025-07-16T10:36:55.259Z","updated":"2026-04-28T16:12:53.306Z","title":"WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"alexvtn","product":"Chatbox Manager","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-48294","published":"2025-07-16T10:36:54.686Z","updated":"2026-04-28T16:12:55.440Z","title":"WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Kerfred","product":"FG Drupal to WordPress","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-48295","published":"2025-07-16T10:36:54.182Z","updated":"2026-04-28T16:12:55.456Z","title":"WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hashthemes","product":"Easy Elementor Addons","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-48299","published":"2025-07-16T10:36:53.680Z","updated":"2026-04-28T16:12:55.760Z","title":"WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YayExtra","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-48301","published":"2025-07-16T10:36:53.201Z","updated":"2026-04-28T16:12:55.738Z","title":"WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"SMTP for SendGrid – YaySMTP","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-54051","published":"2025-07-16T10:36:52.703Z","updated":"2026-04-28T16:13:29.788Z","title":"WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-54050","published":"2025-07-16T10:36:52.246Z","updated":"2026-04-28T16:13:29.802Z","title":"WordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyberChimps","product":"Responsive Addons for Elementor","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-54047","published":"2025-07-16T10:36:51.744Z","updated":"2026-04-28T16:13:29.794Z","title":"WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"QuanticaLabs","product":"Cost Calculator","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-54043","published":"2025-07-16T10:36:51.266Z","updated":"2026-05-13T00:02:51.535Z","title":"WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"SMTP for Amazon SES","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-54042","published":"2025-07-16T10:36:50.745Z","updated":"2026-04-28T16:13:29.809Z","title":"WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Xfinitysoft","product":"WP Post Hide","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54041","published":"2025-07-16T10:36:50.294Z","updated":"2026-04-28T16:13:29.789Z","title":"WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Swings","product":"Wallet System for WooCommerce","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54039","published":"2025-07-16T10:36:49.823Z","updated":"2026-04-28T16:13:29.646Z","title":"WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Toast Plugins","product":"Animator","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54038","published":"2025-07-16T10:36:49.236Z","updated":"2026-04-28T16:13:29.802Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-54037","published":"2025-07-16T10:36:48.754Z","updated":"2026-04-28T16:13:29.668Z","title":"WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-54036","published":"2025-07-16T10:36:48.274Z","updated":"2026-04-28T16:13:29.717Z","title":"WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54035","published":"2025-07-16T10:36:47.797Z","updated":"2026-04-28T16:13:29.770Z","title":"WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54033","published":"2025-07-16T10:36:47.331Z","updated":"2026-04-28T16:13:29.505Z","title":"WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BlocksWP","product":"Theme Builder For Elementor","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-54030","published":"2025-07-16T10:36:46.861Z","updated":"2026-04-28T16:13:29.672Z","title":"WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WesternDeal","product":"WooCommerce Google Sheet Connector","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-54026","published":"2025-07-16T10:36:46.387Z","updated":"2026-05-13T00:03:23.595Z","title":"WordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"QuanticaLabs","product":"GymBase Theme Classes","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-54024","published":"2025-07-16T10:36:45.935Z","updated":"2026-04-28T16:13:28.973Z","title":"WordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-54023","published":"2025-07-16T10:36:45.434Z","updated":"2026-04-28T16:13:28.943Z","title":"WordPress WP Delicious plugin <= 1.8.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Delicious","product":"WP Delicious","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-54022","published":"2025-07-16T10:36:44.696Z","updated":"2026-04-28T16:13:29.251Z","title":"WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elliot Sowersby / RelyWP","product":"Coupon Affiliates","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-54020","published":"2025-07-16T10:36:44.237Z","updated":"2026-04-28T16:13:28.963Z","title":"WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Erik","product":"AntiSpam for Contact Form 7","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-54018","published":"2025-07-16T10:36:43.743Z","updated":"2026-05-13T00:02:21.620Z","title":"WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreativeMindsSolutions","product":"CM Pop-Up banners","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-54016","published":"2025-07-16T10:36:43.275Z","updated":"2026-04-28T16:13:28.681Z","title":"WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kyle Gilman","product":"Videopack","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-54015","published":"2025-07-16T10:36:42.762Z","updated":"2026-04-28T16:13:28.497Z","title":"WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"HT Plugins","product":"HT Contact Form 7","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2025-54013","published":"2025-07-16T10:36:42.275Z","updated":"2026-04-28T16:13:28.579Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-54011","published":"2025-07-16T10:36:41.796Z","updated":"2026-05-13T00:03:06.541Z","title":"WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SMTP2GO","product":"SMTP2GO","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-54010","published":"2025-07-16T10:36:41.326Z","updated":"2026-04-28T16:13:28.275Z","title":"WordPress FluentSnippets plugin <= 10.50 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Shahjahan Jewel","product":"FluentSnippets","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-54009","published":"2025-07-16T10:36:40.855Z","updated":"2026-04-28T16:13:28.351Z","title":"WordPress JetSmartFilters plugin <= 3.6.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-54006","published":"2025-07-16T10:36:40.381Z","updated":"2026-05-13T00:02:36.561Z","title":"WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53997","published":"2025-07-16T10:36:39.895Z","updated":"2026-04-28T16:13:28.084Z","title":"WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"favethemes","product":"Houzez","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-53996","published":"2025-07-16T10:36:39.427Z","updated":"2026-04-28T16:13:27.982Z","title":"WordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSearch","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53995","published":"2025-07-16T10:36:38.974Z","updated":"2026-05-13T00:03:53.508Z","title":"WordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53994","published":"2025-07-16T10:36:38.504Z","updated":"2026-05-13T00:03:38.567Z","title":"WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53991","published":"2025-07-16T10:36:37.678Z","updated":"2026-04-28T16:13:27.219Z","title":"WordPress JetTricks plugin <= 1.5.4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTricks","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53990","published":"2025-07-16T10:36:37.220Z","updated":"2026-04-28T16:13:27.077Z","title":"WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2025-53989","published":"2025-07-16T10:36:36.693Z","updated":"2026-04-28T16:13:27.116Z","title":"WordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53986","published":"2025-07-16T10:36:11.412Z","updated":"2026-04-28T16:13:26.969Z","title":"WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeisle","product":"Hestia","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-53984","published":"2025-07-16T10:36:10.911Z","updated":"2026-04-28T16:13:27.026Z","title":"WordPress JetTabs plugin <= 2.2.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-53982","published":"2025-07-16T10:36:10.369Z","updated":"2026-04-28T16:13:27.132Z","title":"WordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2024-43334","published":"2025-07-07T09:53:15.596Z","updated":"2026-04-28T16:10:13.267Z","title":"WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gavias","product":"Zilom","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-23970","published":"2025-07-04T11:18:11.730Z","updated":"2026-05-12T00:28:53.077Z","title":"WordPress Service Finder Booking plugin <= 6.1 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"aonetheme","product":"Service Finder Booking","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2025-24771","published":"2025-07-04T11:18:11.236Z","updated":"2026-04-28T16:11:34.252Z","title":"WordPress Content Manager Light plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Content Manager Light","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-24780","published":"2025-07-04T11:18:10.723Z","updated":"2026-04-28T16:11:34.480Z","title":"WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"printcart","product":"Printcart Web to Print Product Designer for WooCommerce","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-28968","published":"2025-07-04T11:18:10.219Z","updated":"2026-05-12T00:28:04.701Z","title":"WordPress WP Wall plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Vladimir Prelovac","product":"WP Wall","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-28976","published":"2025-07-04T11:18:09.708Z","updated":"2026-04-28T16:11:52.035Z","title":"WordPress Email Address Security by WebEmailProtector plugin <= 3.3.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dsrodzin","product":"Email Address Security by WebEmailProtector","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-28978","published":"2025-07-04T11:18:09.217Z","updated":"2026-04-28T16:11:51.966Z","title":"WordPress SB Breadcrumbs plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hung Trang Si","product":"SB Breadcrumbs","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-28980","published":"2025-07-04T11:18:08.713Z","updated":"2026-04-28T16:11:52.012Z","title":"WordPress Aviation Weather from NOAA plugin <= 0.7.2 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"machouinard","product":"Aviation Weather from NOAA","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-28983","published":"2025-07-04T11:18:08.175Z","updated":"2026-04-28T16:11:52.385Z","title":"WordPress Click & Pledge Connect plugin <= 25.04010101-WP6.8 - Privilege Escalation via SQL Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ClickandPledge","product":"Click & Pledge Connect","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-30933","published":"2025-07-04T11:18:07.633Z","updated":"2026-04-28T16:12:00.961Z","title":"WordPress LogisticsHub theme <= 1.1.6 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"LiquidThemes","product":"LogisticsHub","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-31037","published":"2025-07-04T11:18:07.116Z","updated":"2026-04-28T16:12:03.954Z","title":"WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"favethemes","product":"Homey","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-32297","published":"2025-07-04T11:18:06.614Z","updated":"2026-04-28T16:12:21.362Z","title":"WordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"quantumcloud","product":"Simple Link Directory","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-32311","published":"2025-07-04T11:18:06.106Z","updated":"2026-04-28T16:12:22.112Z","title":"WordPress Pressroom theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuanticaLabs","product":"Pressroom","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-39487","published":"2025-07-04T11:18:05.595Z","updated":"2026-05-12T00:27:58.315Z","title":"WordPress Rankie plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ValvePress","product":"Rankie","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-47479","published":"2025-07-04T11:18:05.067Z","updated":"2026-04-28T16:12:42.471Z","title":"WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-47565","published":"2025-07-04T11:18:04.563Z","updated":"2026-04-28T16:12:45.114Z","title":"WordPress EventON plugin <= 4.9.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"ashanjay","product":"EventON","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-47627","published":"2025-07-04T11:18:03.991Z","updated":"2026-04-28T16:12:47.452Z","title":"WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"LCweb","product":"PrivateContent - Mail Actions","kev":false,"epss":0.00619,"kevAdded":null},{"id":"CVE-2025-47634","published":"2025-07-04T11:18:03.484Z","updated":"2026-04-28T16:12:47.881Z","title":"WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Keylor Mendoza","product":"WC Pickup Store","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-48231","published":"2025-07-04T11:18:02.980Z","updated":"2026-04-28T16:12:53.652Z","title":"WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Booking Calendar Contact Form","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-49245","published":"2025-07-04T11:18:02.470Z","updated":"2026-04-28T16:12:58.920Z","title":"WordPress Testimonials Showcase plugin <= 1.9.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"cmoreira","product":"Testimonials Showcase","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49247","published":"2025-07-04T11:18:01.892Z","updated":"2026-04-28T16:12:58.988Z","title":"WordPress Team Showcase plugin < 25.05.13 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"cmoreira","product":"Team Showcase","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49274","published":"2025-07-04T11:18:01.333Z","updated":"2026-04-28T16:12:59.878Z","title":"WordPress Neom Blog theme <= 0.0.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"awordpresslife","product":"Neom Blog","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49302","published":"2025-07-04T11:18:00.821Z","updated":"2026-05-12T00:28:24.876Z","title":"WordPress Easy Stripe plugin <= 1.1 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":10,"vendor":"Scott Paterson","product":"Easy Stripe","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-49303","published":"2025-07-04T11:18:00.311Z","updated":"2026-05-12T00:28:11.190Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-49866","published":"2025-07-04T11:17:59.523Z","updated":"2026-04-29T09:51:56.106Z","title":"WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Nikel","product":"Beautiful Cookie Consent Banner","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-49867","published":"2025-07-04T11:17:59.003Z","updated":"2026-04-28T16:13:06.546Z","title":"WordPress RealHomes theme <= 4.4.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"InspiryThemes","product":"RealHomes","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-49870","published":"2025-07-04T11:17:58.496Z","updated":"2026-05-12T00:28:18.170Z","title":"WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-50032","published":"2025-07-04T11:17:57.979Z","updated":"2026-04-28T16:13:16.370Z","title":"WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Paytiko - Payment Orchestration Platform","product":"Paytiko for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-50039","published":"2025-07-04T11:17:57.478Z","updated":"2026-04-28T16:13:16.901Z","title":"WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"vgwort","product":"VG WORT METIS","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-52718","published":"2025-07-04T11:17:56.975Z","updated":"2026-04-28T16:13:17.420Z","title":"WordPress Alone theme <= 7.8.2 - Arbitrary Code Execution Vulnerability","severity":"HIGH","score":7.2,"vendor":"Beplusthemes","product":"Alone","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-52776","published":"2025-07-04T11:17:56.485Z","updated":"2026-04-28T16:13:18.635Z","title":"WordPress Video List Manager plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"thanhtungtnt","product":"Video List Manager","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52796","published":"2025-07-04T11:17:55.974Z","updated":"2026-04-28T16:13:19.383Z","title":"WordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"tggfref","product":"WP-Recall","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52798","published":"2025-07-04T11:17:55.451Z","updated":"2026-04-28T16:13:18.984Z","title":"WordPress JobSearch plugin < 3.0.6 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52805","published":"2025-07-04T11:17:54.954Z","updated":"2026-04-28T16:13:19.286Z","title":"WordPress Leyka plugin <= 3.32.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2025-52807","published":"2025-07-04T11:17:54.384Z","updated":"2026-04-28T16:13:19.535Z","title":"WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusWP","product":"Kossy - Minimalist eCommerce WordPress Theme","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52813","published":"2025-07-04T11:17:53.778Z","updated":"2026-04-28T16:13:19.359Z","title":"WordPress MobiLoud <= 4.6.5 - Broken Access Control Vulnerability","severity":"HIGH","score":8.1,"vendor":"pietro","product":"MobiLoud","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-52828","published":"2025-07-04T11:17:53.262Z","updated":"2026-05-12T00:28:59.997Z","title":"WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Red Art","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2025-52830","published":"2025-07-04T11:17:52.757Z","updated":"2026-04-28T16:13:20.167Z","title":"WordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"bSecure – Your Universal Checkout","product":"bSecure – Your Universal Checkout","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-52831","published":"2025-07-04T11:17:52.250Z","updated":"2026-04-28T16:13:19.926Z","title":"WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"thanhtungtnt","product":"Video List Manager","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-52832","published":"2025-07-04T11:17:51.739Z","updated":"2026-04-28T16:13:20.111Z","title":"WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpo-HR","product":"NGG Smart Image Search","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-52833","published":"2025-07-04T11:17:51.226Z","updated":"2026-04-28T16:13:20.151Z","title":"WordPress LMS theme <= 9.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"designthemes","product":"LMS","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-4414","published":"2025-07-04T11:17:50.701Z","updated":"2026-04-28T16:12:36.640Z","title":"WordPress CMSMasters Content Composer plugin < 2.5.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"cmsmasters","product":"CMSMasters Content Composer","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49070","published":"2025-07-04T11:17:50.195Z","updated":"2026-04-28T16:12:58.656Z","title":"WordPress Elessi < 6.4.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"NasaTheme","product":"Elessi","kev":false,"epss":0.00674,"kevAdded":null},{"id":"CVE-2025-49414","published":"2025-07-04T11:17:49.681Z","updated":"2026-05-12T00:28:31.684Z","title":"WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"Fastw3b LLC","product":"FW Gallery","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-49417","published":"2025-07-04T11:17:49.191Z","updated":"2026-04-28T16:13:04.120Z","title":"WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BestWpDeveloper","product":"WooCommerce Product Multi-Action","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-49418","published":"2025-07-04T11:17:48.696Z","updated":"2026-04-28T16:13:04.195Z","title":"WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"HIGH","score":7.2,"vendor":"TeconceTheme","product":"Allmart","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49431","published":"2025-07-04T11:17:48.158Z","updated":"2026-05-12T00:28:38.602Z","title":"WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gnuget","product":"MF Plus WPML","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-30983","published":"2025-07-04T08:42:24.773Z","updated":"2026-04-28T16:12:02.992Z","title":"WordPress Card flip image slideshow plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gopiplus","product":"Card flip image slideshow","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-30979","published":"2025-07-04T08:42:23.838Z","updated":"2026-04-28T16:12:02.977Z","title":"WordPress Pixelating image slideshow gallery plugin <= 8.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"gopiplus","product":"Pixelating image slideshow gallery","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-30969","published":"2025-07-04T08:42:22.887Z","updated":"2026-04-28T16:12:02.297Z","title":"WordPress iFrame Images Gallery plugin <= 9.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"gopiplus","product":"iFrame Images Gallery","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-30947","published":"2025-07-04T08:42:21.913Z","updated":"2026-04-28T16:12:01.758Z","title":"WordPress Cool fade popup plugin <= 10.1 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"gopiplus","product":"Cool fade popup","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-30943","published":"2025-07-04T08:42:20.966Z","updated":"2026-04-28T16:12:01.723Z","title":"WordPress Posts Slider Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aakif Kadiwala","product":"Posts Slider Shortcode","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-30929","published":"2025-07-04T08:42:20.051Z","updated":"2026-04-28T16:12:00.945Z","title":"WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"amazewp","product":"fluXtore","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-29012","published":"2025-07-04T08:42:18.959Z","updated":"2026-04-28T16:11:53.164Z","title":"WordPress CF7 7 Mailchimp Add-on plugin < 2.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kamleshyadav","product":"CF7 7 Mailchimp Add-on","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-29007","published":"2025-07-04T08:42:18.029Z","updated":"2026-04-28T16:11:52.765Z","title":"WordPress LMSACE Connect plugin <= 3.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"LMSACE","product":"LMSACE Connect","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-29001","published":"2025-07-04T08:42:17.062Z","updated":"2026-04-28T16:11:52.655Z","title":"WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ZoomIt","product":"WooCommerce Shop Page Builder","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-28971","published":"2025-07-04T08:42:16.120Z","updated":"2026-04-28T16:11:52.021Z","title":"WordPress Easy Elements Hider plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"CWD Web Designer","product":"Easy Elements Hider","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-28969","published":"2025-07-04T08:42:15.118Z","updated":"2026-04-28T16:11:52.026Z","title":"WordPress Gallery Widget plugin <= 1.2.1 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"cybio","product":"Gallery Widget","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-28967","published":"2025-07-04T08:42:14.131Z","updated":"2026-04-28T16:11:52.072Z","title":"WordPress Contact Us page - Contact people LITE plugin <= 3.7.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Steve Truman","product":"Contact Us page - Contact people LITE","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-28963","published":"2025-07-04T08:42:13.146Z","updated":"2026-04-28T16:11:51.957Z","title":"WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Md Yeasin Ul Haider","product":"URL Shortener","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-28957","published":"2025-07-04T08:42:12.148Z","updated":"2026-04-28T16:11:51.657Z","title":"WordPress OwnerRez API plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OwnerRez","product":"OwnerRez API","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-28951","published":"2025-07-04T08:42:11.196Z","updated":"2026-04-28T16:11:51.628Z","title":"WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"CreedAlly","product":"Bulk Featured Image","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-27358","published":"2025-07-04T08:42:10.238Z","updated":"2026-04-28T16:11:49.020Z","title":"WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability","severity":"MEDIUM","score":4.6,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-27326","published":"2025-07-04T08:42:09.296Z","updated":"2026-04-28T16:11:48.252Z","title":"WordPress Video Gallery Block plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-26591","published":"2025-07-04T08:42:08.372Z","updated":"2026-04-28T16:11:39.484Z","title":"WordPress WP fancybox plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"WP fancybox","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-24764","published":"2025-07-04T08:42:07.391Z","updated":"2026-04-28T16:11:34.200Z","title":"WordPress (Simply) Guest Author Name plugin <= 4.36 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"A. Jones","product":"(Simply) Guest Author Name","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-24757","published":"2025-07-04T08:42:06.451Z","updated":"2026-04-28T16:11:33.915Z","title":"WordPress uDesign theme <= 4.11.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AndonDesign","product":"uDesign","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-24748","published":"2025-07-04T08:42:05.486Z","updated":"2026-04-28T16:11:33.929Z","title":"WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeFusion","product":"Avada","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-24735","published":"2025-07-04T08:42:04.568Z","updated":"2026-04-28T16:11:33.252Z","title":"WordPress Chatra Live Chat + ChatBot + Cart Saver plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.7,"vendor":"Chatra","product":"Chatra Live Chat + ChatBot + Cart Saver","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2025-23972","published":"2025-07-04T08:42:03.564Z","updated":"2026-05-12T00:28:46.002Z","title":"WordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brian S. Reed","product":"Contact Form 7 reCAPTCHA","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53569","published":"2025-07-04T08:42:02.508Z","updated":"2026-04-28T16:13:26.665Z","title":"WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Trust Payments","product":"Trust Payments Gateway for WooCommerce (JavaScript Library)","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-53568","published":"2025-07-04T08:42:01.451Z","updated":"2026-04-28T16:13:26.482Z","title":"WordPress Radio Station plugin <= 2.5.12 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tony Zeoli","product":"Radio Station","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-53566","published":"2025-07-04T08:42:00.471Z","updated":"2026-04-28T16:13:26.689Z","title":"WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 7.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"osama.esh","product":"WP Visitor Statistics (Real Time Traffic)","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-23968","published":"2025-07-03T18:49:18.872Z","updated":"2026-05-12T00:27:51.906Z","title":"WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"WebFactory","product":"AiBud WP","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2025-3702","published":"2025-07-03T12:14:04.205Z","updated":"2026-04-28T16:12:29.115Z","title":"WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Melapress","product":"Melapress File Monitor","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-49032","published":"2025-07-03T12:09:15.820Z","updated":"2026-04-28T16:12:57.727Z","title":"WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"Gutenberg Blocks","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-39362","published":"2025-07-02T10:59:06.466Z","updated":"2026-04-28T16:12:29.394Z","title":"WordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mollie","product":"Mollie Payments for WooCommerce","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2025-46259","published":"2025-07-01T19:10:23.281Z","updated":"2026-04-28T16:12:37.043Z","title":"WordPress The Plus Addons for Elementor - Pro Plugin < 6.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"POSIMYTH Innovation","product":"The Plus Addons for Elementor Pro","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-49029","published":"2025-07-01T13:27:47.139Z","updated":"2026-04-28T16:12:57.574Z","title":"WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":9.1,"vendor":"bitto.kazi","product":"Custom Login And Signup Widget","kev":false,"epss":0.02359,"kevAdded":null},{"id":"CVE-2025-53339","published":"2025-06-27T13:21:45.198Z","updated":"2026-04-28T16:13:24.024Z","title":"WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"devnex","product":"Devnex Addons For Elementor","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2025-53338","published":"2025-06-27T13:21:44.386Z","updated":"2026-04-28T16:13:24.050Z","title":"WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"dor","product":"re.place","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-53336","published":"2025-06-27T13:21:43.714Z","updated":"2026-04-28T16:13:24.112Z","title":"WordPress My Resume Builder plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"abditsori","product":"My Resume Builder","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-53332","published":"2025-06-27T13:21:43.053Z","updated":"2026-04-28T16:13:23.887Z","title":"WordPress Track Everything plugin <=  2.0.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ethoseo","product":"Track Everything","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-53331","published":"2025-06-27T13:21:42.417Z","updated":"2026-04-28T16:13:23.904Z","title":"WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"samcharrington","product":"RSS Digest","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-53329","published":"2025-06-27T13:21:41.831Z","updated":"2026-04-28T16:13:23.942Z","title":"WordPress Społecznościowa 6 PL 2013 plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"szajenw","product":"Społecznościowa 6 PL 2013","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-53327","published":"2025-06-27T13:21:41.244Z","updated":"2026-05-13T00:01:37.733Z","title":"WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rui_mashita","product":"Aioseo Multibyte Descriptions","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-53325","published":"2025-06-27T13:21:40.682Z","updated":"2026-04-28T16:13:23.994Z","title":"WordPress Beauty Contact Popup Form plugin <= 6.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Dilip kumar","product":"Beauty Contact Popup Form","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-53323","published":"2025-06-27T13:21:40.027Z","updated":"2026-04-28T16:13:23.713Z","title":"WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"danbriapps","product":"Pre-Publish Post Checklist","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-53322","published":"2025-06-27T13:21:39.459Z","updated":"2026-04-28T16:13:23.644Z","title":"WordPress Accept Authorize.NET Payments Using Contact Form 7 plugin <= 2.5 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ZealousWeb","product":"Accept Authorize.NET Payments Using Contact Form 7","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-53321","published":"2025-06-27T13:21:38.849Z","updated":"2026-04-28T16:13:23.648Z","title":"WordPress Raise The Money plugin <= 5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Raise The Money","product":"Raise The Money","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-53320","published":"2025-06-27T13:21:38.269Z","updated":"2026-04-28T16:13:23.690Z","title":"WordPress Free Downloads EDD plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wp Enhanced","product":"Free Downloads EDD","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-53318","published":"2025-06-27T13:21:37.649Z","updated":"2026-04-28T16:13:23.610Z","title":"WordPress WP DB Booster plugin <= 1.0.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPManiax","product":"WP DB Booster","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-53317","published":"2025-06-27T13:21:37.070Z","updated":"2026-04-28T16:13:23.585Z","title":"WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"AcmeeDesign","product":"WPShapere - WordPress admin theme","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53315","published":"2025-06-27T13:21:36.449Z","updated":"2026-04-28T16:13:23.567Z","title":"WordPress Relocate Upload plugin <= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"alanft","product":"Relocate Upload","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53314","published":"2025-06-27T13:21:35.871Z","updated":"2026-04-28T16:13:23.463Z","title":"WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"sh1zen","product":"WP Optimizer","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-53313","published":"2025-06-27T13:21:35.249Z","updated":"2026-04-28T16:13:23.549Z","title":"WordPress Twitch TV Embed Suite plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"plumwd","product":"Twitch TV Embed Suite","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53312","published":"2025-06-27T13:21:34.658Z","updated":"2026-04-28T16:13:23.496Z","title":"WordPress OnionBuzz plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Looks Awesome","product":"OnionBuzz","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53311","published":"2025-06-27T13:21:34.036Z","updated":"2026-04-28T16:13:23.559Z","title":"WordPress Navayan Subscribe plugin <= 1.13 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Amol Nirmala Waman","product":"Navayan Subscribe","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53310","published":"2025-06-27T13:21:33.433Z","updated":"2026-04-28T16:13:23.510Z","title":"WordPress HidePost plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Funnnny","product":"HidePost","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53309","published":"2025-06-27T13:21:32.847Z","updated":"2026-05-13T00:01:08.330Z","title":"WordPress Accept Stripe Payments Using Contact Form 7 plugin <= 3.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ZealousWeb","product":"Accept Stripe Payments Using Contact Form 7","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-53308","published":"2025-06-27T13:21:32.265Z","updated":"2026-04-28T16:13:23.507Z","title":"WordPress Image Slider With Description plugin <= 9.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"gopi_plus","product":"Image Slider With Description","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53306","published":"2025-06-27T13:21:31.643Z","updated":"2026-04-28T16:13:23.331Z","title":"WordPress WP Forum  Server plugin <= 1.8.2 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"lucidcrew","product":"WP Forum  Server","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-53305","published":"2025-06-27T13:21:30.908Z","updated":"2026-04-28T16:13:23.266Z","title":"WordPress WP Forum  Server plugin <= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"lucidcrew","product":"WP Forum  Server","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-53304","published":"2025-06-27T13:21:30.285Z","updated":"2026-04-28T16:13:23.263Z","title":"WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Rohil","product":"Contact Form – 7 : Hide Success Message","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-53301","published":"2025-06-27T13:21:29.640Z","updated":"2026-04-28T16:13:23.508Z","title":"WordPress Theme Junkie Team Content plugin <= 0.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Theme Junkie","product":"Theme Junkie Team Content","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53300","published":"2025-06-27T13:21:29.043Z","updated":"2026-04-28T16:13:23.258Z","title":"WordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"douglaskarr","product":"Podcast Feed Player Widget and Shortcode","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53298","published":"2025-06-27T13:21:28.458Z","updated":"2026-04-28T16:13:23.093Z","title":"WordPress Plugin Inspector plugin <= 1.5 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"gioni","product":"Plugin Inspector","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-53296","published":"2025-06-27T13:21:27.832Z","updated":"2026-04-28T16:13:23.001Z","title":"WordPress EC Stars Rating plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"ecoal95","product":"EC Stars Rating","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-53295","published":"2025-06-27T13:21:27.192Z","updated":"2026-04-28T16:13:22.973Z","title":"WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iCount","product":"iCount Payment Gateway","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-53294","published":"2025-06-27T13:21:26.556Z","updated":"2026-04-28T16:13:22.847Z","title":"WordPress Smart Agenda plugin <= 4.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Smart Agenda","product":"Smart Agenda","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53293","published":"2025-06-27T13:21:25.951Z","updated":"2026-04-28T16:13:22.841Z","title":"WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Morten Dalgaard Johansen","product":"Dashboard Widget Sidebar","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-53292","published":"2025-06-27T13:21:25.342Z","updated":"2026-04-28T16:13:22.856Z","title":"WordPress WP DataTable plugin <= 0.2.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"samsk","product":"WP DataTable","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53290","published":"2025-06-27T13:21:24.708Z","updated":"2026-04-28T16:13:22.747Z","title":"WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MS","product":"WP Visual Sitemap","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53288","published":"2025-06-27T13:21:23.887Z","updated":"2026-04-28T16:13:22.777Z","title":"WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Adrian Ladó","product":"PlatiOnline Payments","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-53287","published":"2025-06-27T13:21:23.212Z","updated":"2026-05-13T00:00:38.965Z","title":"WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Robert Cummings","product":"Quick Favicon","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-53285","published":"2025-06-27T13:21:22.551Z","updated":"2026-04-28T16:13:22.740Z","title":"WordPress Add & Replace Affiliate Links for Amazon plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"The Website Flip","product":"Add & Replace Affiliate Links for Amazon","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-53284","published":"2025-06-27T13:21:21.898Z","updated":"2026-04-28T16:13:22.732Z","title":"WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pankaj.sakaria","product":"CMS Blocks","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2025-53282","published":"2025-06-27T13:21:21.314Z","updated":"2026-04-28T16:13:22.820Z","title":"WordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aviplugins.com","product":"Thumbnail Editor","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53281","published":"2025-06-27T13:21:20.736Z","updated":"2026-04-28T16:13:22.736Z","title":"WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WPBean","product":"WPB Category Slider for WooCommerce","kev":false,"epss":0.00691,"kevAdded":null},{"id":"CVE-2025-53280","published":"2025-06-27T13:21:20.119Z","updated":"2026-04-28T16:13:22.855Z","title":"WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AntoineH","product":"Football Pool","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-53279","published":"2025-06-27T13:21:19.513Z","updated":"2026-04-28T16:13:22.742Z","title":"WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aman","product":"Popup addon for Ninja Forms","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53278","published":"2025-06-27T13:21:18.848Z","updated":"2026-04-28T16:13:22.714Z","title":"WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPeka","product":"WP AdCenter","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-53277","published":"2025-06-27T13:21:18.230Z","updated":"2026-04-28T16:13:22.695Z","title":"WordPress IS-theme-companion plugin <= 1.59 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Infigo Software","product":"IS-theme-companion","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-53276","published":"2025-06-27T13:21:17.487Z","updated":"2026-05-13T00:01:52.196Z","title":"WordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"omnipressteam","product":"Omnipress","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53275","published":"2025-06-27T13:21:16.830Z","updated":"2026-04-28T16:13:22.820Z","title":"WordPress Leyka plugin <= 3.32.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53274","published":"2025-06-27T13:21:16.249Z","updated":"2026-04-28T16:13:22.254Z","title":"WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Hossin Asaadi","product":"WP Permalink Translator","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-53273","published":"2025-06-27T13:21:15.669Z","updated":"2026-04-28T16:13:22.204Z","title":"WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Slickstream","product":"Slickstream","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53272","published":"2025-06-27T13:21:14.996Z","updated":"2026-04-28T16:13:22.188Z","title":"WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"opicron","product":"Image Cleanup","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53271","published":"2025-06-27T13:21:14.348Z","updated":"2026-04-28T16:13:22.200Z","title":"WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability","severity":"HIGH","score":7.1,"vendor":"Anton Bond","product":"Additional Order Filters for WooCommerce","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-53270","published":"2025-06-27T13:21:13.717Z","updated":"2026-04-28T16:13:22.150Z","title":"WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Blend Media","product":"WordPress CTA","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53269","published":"2025-06-27T13:21:13.051Z","updated":"2026-05-13T00:01:22.835Z","title":"WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"imw3","product":"My Wp Brand","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53268","published":"2025-06-27T13:21:12.448Z","updated":"2026-04-28T16:13:22.041Z","title":"WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ryanpcmcquen","product":"Import external attachments","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53267","published":"2025-06-27T13:21:11.852Z","updated":"2026-04-28T16:13:22.106Z","title":"WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Aftab Husain","product":"Hide Admin Bar From Front End","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53266","published":"2025-06-27T13:21:11.276Z","updated":"2026-04-28T16:13:22.132Z","title":"WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EdwardBock","product":"Cron Logger","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-53265","published":"2025-06-27T13:21:10.655Z","updated":"2026-04-28T16:13:22.132Z","title":"WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Virusdie","product":"Virusdie","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-53264","published":"2025-06-27T13:21:10.061Z","updated":"2026-04-28T16:13:22.101Z","title":"WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Konrád Koller","product":"ONet Regenerate Thumbnails","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-53263","published":"2025-06-27T13:21:09.438Z","updated":"2026-04-28T16:13:22.058Z","title":"WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PluginsCafe","product":"Address Autocomplete via Google for Gravity Forms","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-53262","published":"2025-06-27T13:21:08.812Z","updated":"2026-04-28T16:13:22.045Z","title":"WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Writesonic","product":"Writesonic","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-53261","published":"2025-06-27T13:21:08.188Z","updated":"2026-05-13T00:00:24.511Z","title":"WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"macbookandrew","product":"WP YouTube Live","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-53260","published":"2025-06-27T13:21:07.549Z","updated":"2026-04-28T16:13:22.029Z","title":"WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"getredhawkstudio","product":"File Manager Plugin For Wordpress","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-53259","published":"2025-06-27T13:21:06.917Z","updated":"2026-04-28T16:13:22.055Z","title":"WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2025-53258","published":"2025-06-27T13:21:06.300Z","updated":"2026-04-28T16:13:22.036Z","title":"WordPress Hover Effects plugin <= 2.1.2 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Wow-Company","product":"Hover Effects","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-53257","published":"2025-06-27T13:21:05.659Z","updated":"2026-04-28T16:13:22.178Z","title":"WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Serhii Pasyuk","product":"Gmedia Photo Gallery","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2025-53256","published":"2025-06-27T13:21:05.082Z","updated":"2026-04-28T16:13:21.991Z","title":"WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YaySMTP","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-53255","published":"2025-06-27T13:21:04.473Z","updated":"2026-04-28T16:13:22.093Z","title":"WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nabil Lemsieh","product":"HurryTimer","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-53254","published":"2025-06-27T13:21:03.851Z","updated":"2026-05-13T00:00:53.901Z","title":"WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeisle","product":"Cyrlitera","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-53253","published":"2025-06-27T13:21:03.246Z","updated":"2026-05-12T00:26:16.564Z","title":"WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Josh","product":"WP Edit","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-53211","published":"2025-06-27T13:21:02.599Z","updated":"2026-04-28T16:13:20.884Z","title":"WordPress Audio Editor & Recorder plugin <= 2.2.3 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Roland Beaussant","product":"Audio Editor & Recorder","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-53206","published":"2025-06-27T13:21:01.852Z","updated":"2026-04-28T16:13:20.749Z","title":"WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HT Plugins","product":"HT Mega – Absolute Addons for WPBakery Page Builder","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-53203","published":"2025-06-27T13:21:01.191Z","updated":"2026-04-28T16:13:20.684Z","title":"WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EDGARROJAS","product":"WooCommerce PDF Invoice Builder","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-53202","published":"2025-06-27T13:21:00.534Z","updated":"2026-04-28T16:13:20.273Z","title":"WordPress Responsive Blocks plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyberChimps","product":"Responsive Blocks","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-53200","published":"2025-06-27T13:20:59.856Z","updated":"2026-04-28T16:13:20.792Z","title":"WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"QuantumCloud","product":"ChatBot","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-53199","published":"2025-06-27T13:20:59.265Z","updated":"2026-04-28T16:13:20.185Z","title":"WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HT Plugins","product":"HT Slider For Elementor","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-53197","published":"2025-06-27T13:20:58.672Z","updated":"2026-04-28T16:13:20.115Z","title":"WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cookiebot","product":"Cookiebot","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-53193","published":"2025-06-27T13:20:57.894Z","updated":"2026-04-28T16:13:20.020Z","title":"WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Burst Statistics B.V.","product":"Burst Statistics","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-24765","published":"2025-06-27T11:52:48.540Z","updated":"2026-04-28T16:11:34.221Z","title":"WordPress Image Shadow plugin <= 1.1.0 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"RobMarsh","product":"Image Shadow","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-24769","published":"2025-06-27T11:52:47.973Z","updated":"2026-04-28T16:11:34.334Z","title":"WordPress Zenny theme <= 1.7.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"Zenny","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-24774","published":"2025-06-27T11:52:47.385Z","updated":"2026-04-28T16:11:34.590Z","title":"WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mojoomla","product":"WPCRM - CRM for Contact form CF7 & WooCommerce","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-25171","published":"2025-06-27T11:52:46.757Z","updated":"2026-04-28T16:11:37.692Z","title":"WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability","severity":"HIGH","score":8.8,"vendor":"Convers Lab","product":"WP SmartPay","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-25173","published":"2025-06-27T11:52:46.174Z","updated":"2026-04-28T16:11:37.558Z","title":"WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"FasterThemes","product":"FastBook","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-27361","published":"2025-06-27T11:52:45.537Z","updated":"2026-04-28T16:11:49.193Z","title":"WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"thhake","product":"Photo Express for Google","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-28946","published":"2025-06-27T11:52:44.803Z","updated":"2026-04-28T16:11:51.595Z","title":"WordPress PrintXtore theme < 1.7.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"PrintXtore","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-28947","published":"2025-06-27T11:52:44.192Z","updated":"2026-04-28T16:11:51.572Z","title":"WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"MBStore - Digital WooCommerce WordPress Theme","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-28956","published":"2025-06-27T11:52:43.614Z","updated":"2026-04-28T16:11:51.639Z","title":"WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wphobby","product":"Backwp","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-28960","published":"2025-06-27T11:52:43.019Z","updated":"2026-04-28T16:11:51.743Z","title":"WordPress Evangelische Termine plugin <= 3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"regibaer","product":"Evangelische Termine","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-28970","published":"2025-06-27T11:52:42.396Z","updated":"2026-04-28T16:11:52.026Z","title":"WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"pep.vn","product":"WP Optimize By xTraffic","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-28988","published":"2025-06-27T11:52:41.821Z","updated":"2026-05-12T00:25:36.193Z","title":"WordPress WP Front User Submit / Front Editor plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"aharonyan","product":"WP Front User Submit / Front Editor","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-28990","published":"2025-06-27T11:52:41.200Z","updated":"2026-04-28T16:11:52.530Z","title":"WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"SNS Vicky","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-28993","published":"2025-06-27T11:52:40.573Z","updated":"2026-04-28T16:11:52.423Z","title":"WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerability","severity":"HIGH","score":8.6,"vendor":"Jose Mortellaro","product":"Content No Cache","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-28998","published":"2025-06-27T11:52:39.988Z","updated":"2026-04-28T16:11:52.558Z","title":"WordPress SERPed.net plugin <= 4.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"serpednet","product":"SERPed.net","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-30972","published":"2025-06-27T11:52:39.371Z","updated":"2026-04-28T16:12:02.337Z","title":"WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"iamapinan","product":"Woocommerce Line Notify","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-30992","published":"2025-06-27T11:52:38.748Z","updated":"2026-04-28T16:12:02.977Z","title":"WordPress Puca theme <= 2.6.33 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Puca","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-31067","published":"2025-06-27T11:52:38.148Z","updated":"2026-04-28T16:12:04.707Z","title":"WordPress Seven Stars theme <= 1.4.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themeton","product":"Seven Stars","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-31428","published":"2025-06-27T11:52:37.516Z","updated":"2026-04-28T16:12:06.923Z","title":"WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BuddhaThemes","product":"HYDRO","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-32281","published":"2025-06-27T11:52:36.905Z","updated":"2026-04-28T16:12:21.044Z","title":"WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DarkMySite","product":"DarkMySite","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-32298","published":"2025-06-27T11:52:36.269Z","updated":"2026-05-12T00:27:03.178Z","title":"WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Case-Themes","product":"CTUsers","kev":false,"epss":0.00619,"kevAdded":null},{"id":"CVE-2025-39474","published":"2025-06-27T11:52:35.674Z","updated":"2026-04-28T16:12:32.316Z","title":"WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThemeMove","product":"Amely","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-39478","published":"2025-06-27T11:52:35.066Z","updated":"2026-04-28T16:12:32.332Z","title":"WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"smartiolabs","product":"Smart Notification","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-39488","published":"2025-06-27T11:52:34.402Z","updated":"2026-04-28T16:12:32.686Z","title":"WordPress MagOne theme <= 8.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sneeit","product":"MagOne","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-47574","published":"2025-06-27T11:52:33.828Z","updated":"2026-04-28T16:12:45.825Z","title":"WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mojoomla","product":"School Management","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-47654","published":"2025-06-27T11:52:33.236Z","updated":"2026-04-28T16:12:48.406Z","title":"WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Adrian Tobey","product":"FormLift for Infusionsoft Web Forms","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-49290","published":"2025-06-27T11:52:32.608Z","updated":"2026-04-28T16:13:00.487Z","title":"WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jory Hogeveen","product":"Off-Canvas Sidebars & Menus (Slidebars)","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49321","published":"2025-06-27T11:52:32.006Z","updated":"2026-04-28T16:13:00.966Z","title":"WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-49883","published":"2025-06-27T11:52:31.425Z","updated":"2026-04-28T16:13:06.702Z","title":"WordPress Greenmart theme <= 4.2.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Greenmart","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-49885","published":"2025-06-27T11:52:30.847Z","updated":"2026-05-12T00:26:42.811Z","title":"WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"HaruTheme","product":"Drag and Drop Multiple File Upload (Pro) - WooCommerce","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2025-49886","published":"2025-06-27T11:52:30.232Z","updated":"2026-04-28T16:13:07.087Z","title":"WordPress Zikzag Core plugin <= 1.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"Zikzag Core","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-50052","published":"2025-06-27T11:52:29.639Z","updated":"2026-04-28T16:13:16.986Z","title":"WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"flexostudio","product":"Flexo Counter","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-52717","published":"2025-06-27T11:52:28.496Z","updated":"2026-04-28T16:13:17.321Z","title":"WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"chrisbadgett","product":"LifterLMS","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-52722","published":"2025-06-27T11:52:27.828Z","updated":"2026-04-28T16:13:17.580Z","title":"WordPress Classiera theme <= 4.0.34 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"JoinWebs","product":"Classiera","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-52723","published":"2025-06-27T11:52:27.242Z","updated":"2026-05-12T00:27:24.604Z","title":"WordPress Networker theme <= 1.2.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"codesupplyco","product":"Networker","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52724","published":"2025-06-27T11:52:26.703Z","updated":"2026-04-28T16:13:17.618Z","title":"WordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Amwerk","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-52725","published":"2025-06-27T11:52:26.104Z","updated":"2026-04-28T16:13:17.587Z","title":"WordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"pebas","product":"CouponXxL","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2025-52726","published":"2025-06-27T11:52:25.548Z","updated":"2026-04-28T16:13:17.618Z","title":"WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.6,"vendor":"pebas","product":"CouponXxL Custom Post Types","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2025-52727","published":"2025-06-27T11:52:24.978Z","updated":"2026-05-12T00:27:10.753Z","title":"WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"QuanticaLabs","product":"CSS3 Vertical Web Pricing Tables","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52729","published":"2025-06-27T11:52:24.415Z","updated":"2026-04-28T16:13:17.625Z","title":"WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Diza","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52774","published":"2025-06-27T11:52:23.846Z","updated":"2026-04-28T16:13:18.664Z","title":"WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52778","published":"2025-06-27T11:52:23.269Z","updated":"2026-04-28T16:13:18.649Z","title":"WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Michel - xiligroup dev","product":"xili-dictionary","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52799","published":"2025-06-27T11:52:22.671Z","updated":"2026-04-28T16:13:19.163Z","title":"WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"LMS","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-52808","published":"2025-06-27T11:52:22.035Z","updated":"2026-04-28T16:13:19.412Z","title":"WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"real-web","product":"RealtyElite","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52809","published":"2025-06-27T11:52:21.393Z","updated":"2026-05-12T00:27:17.665Z","title":"WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"John Russell","product":"National Weather Service Alerts","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52810","published":"2025-06-27T11:52:20.816Z","updated":"2026-04-28T16:13:19.363Z","title":"WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"TMRW-studio","product":"Katerio - Magazine","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2025-52811","published":"2025-06-27T11:52:20.208Z","updated":"2026-04-28T16:13:19.365Z","title":"WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Creanncy","product":"Davenport - Versatile Blog and Magazine WordPress Theme","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2025-52812","published":"2025-06-27T11:52:19.570Z","updated":"2026-04-28T16:13:19.694Z","title":"WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusWP","product":"Domnoo","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52814","published":"2025-06-27T11:52:18.876Z","updated":"2026-04-28T16:13:19.558Z","title":"WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ovatheme","product":"BRW","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52815","published":"2025-06-27T11:52:18.272Z","updated":"2026-04-28T16:13:19.631Z","title":"WordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CityGov","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-52816","published":"2025-06-27T11:52:17.658Z","updated":"2026-05-12T00:27:45.464Z","title":"WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"themehunk","product":"Zita","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2025-52817","published":"2025-06-27T11:52:17.090Z","updated":"2026-04-28T16:13:19.614Z","title":"WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"ZealousWeb","product":"Abandoned Contact Form 7","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-52818","published":"2025-06-27T11:52:16.472Z","updated":"2026-04-28T16:13:19.632Z","title":"WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Dejan Jasnic","product":"Trusty Whistleblowing","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-52824","published":"2025-06-27T11:52:15.877Z","updated":"2026-05-12T00:27:31.634Z","title":"WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"MDJM","product":"Mobile DJ Manager","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-52826","published":"2025-06-27T11:52:15.291Z","updated":"2026-04-28T16:13:19.848Z","title":"WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"uxper","product":"Sala","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-52827","published":"2025-06-27T11:52:14.560Z","updated":"2026-05-12T00:27:38.506Z","title":"WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"uxper","product":"Nuss","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-52829","published":"2025-06-27T11:52:13.952Z","updated":"2026-04-28T16:13:19.893Z","title":"WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"DirectIQ","product":"DirectIQ Email Marketing","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-52834","published":"2025-06-27T11:52:13.285Z","updated":"2026-04-28T16:13:20.001Z","title":"WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"favethemes","product":"Homey","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2023-25998","published":"2025-06-27T11:52:12.658Z","updated":"2026-04-28T16:08:11.497Z","title":"WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-23967","published":"2025-06-27T11:52:11.964Z","updated":"2026-05-12T00:26:56.214Z","title":"WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpopal","product":"GG Bought Together for WooCommerce","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-23973","published":"2025-06-27T11:52:11.272Z","updated":"2026-05-13T00:02:07.226Z","title":"WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dugudlabs","product":"SpecFit-Virtual Try On Woocommerce","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-24760","published":"2025-06-27T11:52:10.667Z","updated":"2026-04-28T16:11:34.090Z","title":"WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"goalthemes","product":"Sofass","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-49416","published":"2025-06-27T11:52:10.067Z","updated":"2026-04-28T16:13:04.076Z","title":"WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Fastw3b LLC","product":"FW Gallery","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-49423","published":"2025-06-27T11:52:09.473Z","updated":"2026-05-12T00:26:36.321Z","title":"WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Syed Tahir Ali Jan","product":"Bulk YouTube Post Creator","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-49448","published":"2025-06-27T11:52:08.831Z","updated":"2026-04-28T16:13:04.869Z","title":"WordPress FW Food Menu  plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"Fastw3b LLC","product":"FW Food Menu","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-49873","published":"2025-06-20T15:04:30.054Z","updated":"2026-04-28T16:13:06.738Z","title":"WordPress Elessi theme <= 6.3.9 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"NasaTheme","product":"Elessi","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49964","published":"2025-06-20T15:04:23.124Z","updated":"2026-04-28T16:13:14.187Z","title":"WordPress ClipLink plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"indgeek","product":"ClipLink","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-49965","published":"2025-06-20T15:04:22.655Z","updated":"2026-04-28T16:13:14.136Z","title":"WordPress PixelBeds Channel Manager and Hotel Booking Engine plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Oganro","product":"PixelBeds Channel Manager and Hotel Booking Engine","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49966","published":"2025-06-20T15:04:22.175Z","updated":"2026-04-28T16:13:14.041Z","title":"WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Oganro","product":"Oganro Travel Portal Search Widget for HotelBeds APITUDE API","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49967","published":"2025-06-20T15:04:21.688Z","updated":"2026-04-28T16:13:14.091Z","title":"WordPress Live Sports Streamthunder plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"marcusjansen","product":"Live Sports Streamthunder","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49968","published":"2025-06-20T15:04:21.122Z","updated":"2026-04-28T16:13:14.091Z","title":"WordPress XML Travel Portal Widget plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Oganro","product":"XML Travel Portal Widget","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49969","published":"2025-06-20T15:04:20.442Z","updated":"2026-04-28T16:13:14.097Z","title":"WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Zara 4","product":"Zara 4 Image Compression","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-49970","published":"2025-06-20T15:04:19.559Z","updated":"2026-04-28T16:13:14.164Z","title":"WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sparklewpthemes","product":"Hello FSE Blog","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-49971","published":"2025-06-20T15:04:18.787Z","updated":"2026-04-28T16:13:14.193Z","title":"WordPress eDS Responsive Menu plugin <= 1.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"aThemeArt Translations","product":"eDS Responsive Menu","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-49972","published":"2025-06-20T15:04:17.977Z","updated":"2026-05-12T00:25:00.264Z","title":"WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Wood","product":"TM Replace Howdy","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49973","published":"2025-06-20T15:04:17.133Z","updated":"2026-05-12T00:25:09.478Z","title":"WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"GrandPlugins","product":"Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-49974","published":"2025-06-20T15:04:16.551Z","updated":"2026-04-28T16:13:13.985Z","title":"WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"upstreamplugin","product":"UpStream: a Project Management Plugin for WordPress","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-49975","published":"2025-06-20T15:04:15.963Z","updated":"2026-04-28T16:13:14.173Z","title":"WordPress JobWP plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hossni Mubarak","product":"JobWP","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49976","published":"2025-06-20T15:04:15.254Z","updated":"2026-04-28T16:13:14.189Z","title":"WordPress WANotifier plugin <= 2.7.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WANotifier","product":"Notifier","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-49977","published":"2025-06-20T15:04:14.644Z","updated":"2026-04-28T16:13:14.203Z","title":"WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Inventory","product":"WP Inventory Manager","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-49978","published":"2025-06-20T15:04:14.183Z","updated":"2026-04-28T16:13:14.240Z","title":"WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2025-49979","published":"2025-06-20T15:04:13.690Z","updated":"2026-04-28T16:13:14.929Z","title":"WordPress Media Hygiene plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"slui","product":"Media Hygiene","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-49980","published":"2025-06-20T15:04:13.169Z","updated":"2026-04-28T16:13:14.710Z","title":"WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Event Manager","product":"WP User Profile Avatar","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-49981","published":"2025-06-20T15:04:12.611Z","updated":"2026-04-28T16:13:14.500Z","title":"WordPress User Roles and Capabilities plugin <= 1.2.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"mahabub81","product":"User Roles and Capabilities","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2025-49982","published":"2025-06-20T15:04:12.125Z","updated":"2026-04-28T16:13:14.915Z","title":"WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"aguilatechnologies","product":"WP Customer Area","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-49983","published":"2025-06-20T15:04:11.656Z","updated":"2026-04-28T16:13:14.910Z","title":"WordPress WPThumb plugin <= 0.10 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Joe Hoyle","product":"WPThumb","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-49984","published":"2025-06-20T15:04:11.150Z","updated":"2026-04-28T16:13:14.952Z","title":"WordPress PowerPress Podcasting plugin <= 11.13.11 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-49985","published":"2025-06-20T15:04:10.673Z","updated":"2026-04-28T16:13:14.920Z","title":"WordPress Auto Upload Images plugin <= 3.3.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Ali Irani","product":"Auto Upload Images","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-49986","published":"2025-06-20T15:04:10.215Z","updated":"2026-04-28T16:13:15.705Z","title":"WordPress Video List Manager plugin <= 1.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"thanhtungtnt","product":"Video List Manager","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49987","published":"2025-06-20T15:04:09.700Z","updated":"2026-04-28T16:13:14.883Z","title":"WordPress CRM ERP Business Solution plugin <= 1.13 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFactory","product":"CRM ERP Business Solution","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49988","published":"2025-06-20T15:04:09.192Z","updated":"2026-04-28T16:13:14.823Z","title":"WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Renzo Johnson","product":"Contact Form 7 AWeber Extension","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-49989","published":"2025-06-20T15:04:08.696Z","updated":"2026-04-28T16:13:15.332Z","title":"WordPress App Builder plugin <= 5.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"App Cheap","product":"App Builder","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-49990","published":"2025-06-20T15:04:08.230Z","updated":"2026-04-28T16:13:14.946Z","title":"WordPress ContentStudio plugin <= 1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"contentstudio","product":"Contentstudio","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49991","published":"2025-06-20T15:04:07.772Z","updated":"2026-04-28T16:13:15.479Z","title":"WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"tggfref","product":"WP-Recall","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-49993","published":"2025-06-20T15:04:07.297Z","updated":"2026-04-28T16:13:14.955Z","title":"WordPress Cookie-Script.com plugin <= 1.2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"csarturas","product":"Cookie-Script.com","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-49995","published":"2025-06-20T15:04:06.831Z","updated":"2026-04-28T16:13:15.407Z","title":"WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"dFactory","product":"Download Attachments","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-49996","published":"2025-06-20T15:04:06.330Z","updated":"2026-05-12T00:25:15.905Z","title":"WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"osama.esh","product":"WP Visitor Statistics (Real Time Traffic)","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-49997","published":"2025-06-20T15:04:05.866Z","updated":"2026-04-28T16:13:15.170Z","title":"WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Syed Balkhi","product":"Giveaways and Contests by RafflePress","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-49998","published":"2025-06-20T15:04:05.400Z","updated":"2026-04-28T16:13:15.386Z","title":"WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wetail","product":"WooCommerce Fortnox Integration","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2025-50008","published":"2025-06-20T15:04:04.919Z","updated":"2026-05-12T00:24:46.334Z","title":"WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"cscode","product":"WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-50009","published":"2025-06-20T15:04:04.413Z","updated":"2026-04-28T16:13:15.914Z","title":"WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Climax Themes","product":"Kata Plus","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-50010","published":"2025-06-20T15:04:03.937Z","updated":"2026-04-28T16:13:15.874Z","title":"WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Zapier","product":"Zapier for WordPress","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50011","published":"2025-06-20T15:04:03.446Z","updated":"2026-04-28T16:13:15.893Z","title":"WordPress plugin Recipes manager - WPH <=1.0.4  - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Félix Martínez","product":"Recipes manager - WPH","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50012","published":"2025-06-20T15:04:02.968Z","updated":"2026-04-28T16:13:15.879Z","title":"WordPress Inventory Presser plugin <= 15.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"fridaysystems","product":"Inventory Presser","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50013","published":"2025-06-20T15:04:02.485Z","updated":"2026-04-28T16:13:15.907Z","title":"WordPress CSV Importer Improved plugin <= 0.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jason Judge","product":"CSV Importer Improved","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50014","published":"2025-06-20T15:04:01.831Z","updated":"2026-04-28T16:13:15.978Z","title":"WordPress PDPA Consent for Thailand plugin <= 1.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"iamapinan","product":"PDPA Consent for Thailand","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50015","published":"2025-06-20T15:04:01.287Z","updated":"2026-05-12T00:24:53.282Z","title":"WordPress Hand Talk plugin <= 6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Rodrigo Bastos","product":"Hand Talk","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50016","published":"2025-06-20T15:04:00.804Z","updated":"2026-05-12T00:24:38.952Z","title":"WordPress IP Based Login plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"brijeshk89","product":"IP Based Login","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50017","published":"2025-06-20T15:03:59.993Z","updated":"2026-05-12T00:24:32.368Z","title":"WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Matt","product":"WP Voting Contest","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50018","published":"2025-06-20T15:03:59.522Z","updated":"2026-04-28T16:13:16.400Z","title":"WordPress Tealium plugin <= 2.1.20 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tealium","product":"Tealium","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50019","published":"2025-06-20T15:03:59.026Z","updated":"2026-04-28T16:13:16.395Z","title":"WordPress Simple Sticky Footer  plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Sandor Kovacs","product":"Simple Sticky Footer","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50020","published":"2025-06-20T15:03:58.555Z","updated":"2026-04-28T16:13:16.386Z","title":"WordPress RDFa Breadcrumb plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Nitin Yawalkar","product":"RDFa Breadcrumb","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50021","published":"2025-06-20T15:03:58.071Z","updated":"2026-04-28T16:13:16.368Z","title":"WordPress Better Random Redirect plugin <= 1.3.20 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Robert Peake","product":"Better Random Redirect","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50022","published":"2025-06-20T15:03:57.594Z","updated":"2026-04-28T16:13:16.341Z","title":"WordPress WP-FB-AutoConnect plugin <= 4.6.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"JK","product":"WP-FB-AutoConnect","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50023","published":"2025-06-20T15:03:57.125Z","updated":"2026-04-28T16:13:16.390Z","title":"WordPress CodePen Embed Block plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Chris Coyier","product":"CodePen Embed Block","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50024","published":"2025-06-20T15:03:56.651Z","updated":"2026-04-28T16:13:16.398Z","title":"WordPress ATP Call Now plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Truong Thanh","product":"ATP Call Now","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50025","published":"2025-06-20T15:03:56.190Z","updated":"2026-04-28T16:13:16.411Z","title":"WordPress CP Polls plugin <= 1.0.81 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"codepeople","product":"CP Polls","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50026","published":"2025-06-20T15:03:55.684Z","updated":"2026-04-28T16:13:16.359Z","title":"WordPress Spoki plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"spoki","product":"Spoki","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50027","published":"2025-06-20T15:03:55.228Z","updated":"2026-04-28T16:13:16.400Z","title":"WordPress Login/Signup Popup plugin <= 2.9.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"xootix","product":"Login/Signup Popup","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2025-50030","published":"2025-06-20T15:03:54.771Z","updated":"2026-04-28T16:13:16.517Z","title":"WordPress Spark Multipurpose theme <= 1.0.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sparklewpthemes","product":"Spark Multipurpose","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-50033","published":"2025-06-20T15:03:54.301Z","updated":"2026-04-28T16:13:16.444Z","title":"WordPress Fitness Park theme <= 1.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sparklewpthemes","product":"Fitness Park","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-50034","published":"2025-06-20T15:03:53.830Z","updated":"2026-04-28T16:13:16.663Z","title":"WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mahmudul Hasan Arif","product":"Enhanced Blocks – Page Builder Blocks for Gutenberg","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2025-50035","published":"2025-06-20T15:03:53.351Z","updated":"2026-04-28T16:13:16.908Z","title":"WordPress Fyrebox Quizzes plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyrilG","product":"Fyrebox Quizzes","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-50036","published":"2025-06-20T15:03:52.888Z","updated":"2026-04-28T16:13:16.919Z","title":"WordPress Mailing Group Listserv plugin <= 3.0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Yamna Khawaja","product":"Mailing Group Listserv","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-50037","published":"2025-06-20T15:03:52.404Z","updated":"2026-04-28T16:13:16.874Z","title":"WordPress Buying Buddy IDX CRM plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Buying Buddy","product":"Buying Buddy IDX CRM","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50038","published":"2025-06-20T15:03:51.952Z","updated":"2026-04-28T16:13:16.922Z","title":"WordPress Anant Addons for Elementor plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"anantaddons","product":"Anant Addons for Elementor","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50041","published":"2025-06-20T15:03:51.484Z","updated":"2026-04-28T16:13:16.938Z","title":"WordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Engine","product":"Gutenberg Blocks – ACF Blocks Suite","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50042","published":"2025-06-20T15:03:51.023Z","updated":"2026-04-28T16:13:16.941Z","title":"WordPress WP Register Profile With Shortcode plugin <= 3.6.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aviplugins.com","product":"WP Register Profile With Shortcode","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50043","published":"2025-06-20T15:03:50.507Z","updated":"2026-04-28T16:13:16.925Z","title":"WordPress Code Engine plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jordy Meow","product":"Code Engine","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50044","published":"2025-06-20T15:03:50.047Z","updated":"2026-04-28T16:13:16.921Z","title":"WordPress Real Estate Manager plugin <= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-50045","published":"2025-06-20T15:03:49.581Z","updated":"2026-04-28T16:13:16.962Z","title":"WordPress Related Products Manager for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ProWCPlugins","product":"Related Products Manager for WooCommerce","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50046","published":"2025-06-20T15:03:49.121Z","updated":"2026-04-28T16:13:16.924Z","title":"WordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StellarWP","product":"WPComplete","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50047","published":"2025-06-20T15:03:48.663Z","updated":"2026-04-28T16:13:17.026Z","title":"WordPress Sitekit plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webvitaly","product":"Sitekit","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50048","published":"2025-06-20T15:03:48.179Z","updated":"2026-04-28T16:13:16.998Z","title":"WordPress Automatically Hierarchic Categories in Menu plugin <= 2.0.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Atakan Au","product":"Automatically Hierarchic Categories in Menu","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50049","published":"2025-06-20T15:03:47.700Z","updated":"2026-04-28T16:13:17.012Z","title":"WordPress Modern Footnotes plugin <= 1.4.19 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"prismtechstudios","product":"Modern Footnotes","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50050","published":"2025-06-20T15:03:47.234Z","updated":"2026-04-28T16:13:17.196Z","title":"WordPress Jobs for WordPress plugin <= 2.7.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-50051","published":"2025-06-20T15:03:46.724Z","updated":"2026-04-28T16:13:17.044Z","title":"WordPress WP-Members plugin <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chad Butler","product":"WP-Members","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-52772","published":"2025-06-20T15:03:46.238Z","updated":"2026-04-28T16:13:18.654Z","title":"WordPress Virtual Moderator plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Adnan Haque (a11n)","product":"Virtual Moderator","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-52780","published":"2025-06-20T15:03:45.765Z","updated":"2026-05-12T00:25:22.833Z","title":"WordPress Logo Manager For Samandehi plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohammad Parsa","product":"Logo Manager For Samandehi","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-52781","published":"2025-06-20T15:03:45.299Z","updated":"2026-04-28T16:13:18.798Z","title":"WordPress TinyNav plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Beee","product":"TinyNav","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-52782","published":"2025-06-20T15:03:44.629Z","updated":"2026-04-28T16:13:18.794Z","title":"WordPress Scroll UP plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"King Rayhan","product":"Scroll UP","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-52783","published":"2025-06-20T15:03:44.014Z","updated":"2026-04-28T16:13:18.964Z","title":"WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themelocation","product":"Change Cart button Colors WooCommerce","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52784","published":"2025-06-20T15:03:43.552Z","updated":"2026-04-28T16:13:19.075Z","title":"WordPress Bluff Post plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"hideoguchi","product":"Bluff Post","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52789","published":"2025-06-20T15:03:43.083Z","updated":"2026-04-28T16:13:19.008Z","title":"WordPress Lewe ChordPress plugin <= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability","severity":"HIGH","score":7.1,"vendor":"George Lewe","product":"Lewe ChordPress","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52790","published":"2025-06-20T15:03:42.584Z","updated":"2026-04-28T16:13:19.155Z","title":"WordPress WP-DownloadCounter plugin <= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"r-win","product":"WP-DownloadCounter","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-52791","published":"2025-06-20T15:03:42.082Z","updated":"2026-04-28T16:13:19.107Z","title":"WordPress Knowledge Base – Knowledge Base Maker plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"devfelixmoira","product":"Knowledge Base – Knowledge Base Maker","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-52792","published":"2025-06-20T15:03:41.587Z","updated":"2026-05-12T00:25:29.263Z","title":"WordPress WP User Stylesheet Switcher plugin <= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"vgstef","product":"WP User Stylesheet Switcher","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52793","published":"2025-06-20T15:03:41.126Z","updated":"2026-04-28T16:13:18.975Z","title":"WordPress Esselink.nu Settings plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Esselink.nu","product":"Esselink.nu Settings","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52794","published":"2025-06-20T15:03:40.653Z","updated":"2026-04-28T16:13:18.980Z","title":"WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Creative-Solutions","product":"Creative Contact Form","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-52795","published":"2025-06-20T15:03:40.191Z","updated":"2026-04-28T16:13:19.135Z","title":"WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"aharonyan","product":"WP Front User Submit / Front Editor","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-52802","published":"2025-06-20T15:03:39.682Z","updated":"2026-04-28T16:13:18.988Z","title":"WordPress Import YouTube videos as WP Posts plugin <= 2.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"enguerranws","product":"Import YouTube videos as WP Posts","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-52821","published":"2025-06-20T15:03:39.230Z","updated":"2026-04-28T16:13:19.686Z","title":"WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"thanhtungtnt","product":"Video List Manager","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-52822","published":"2025-06-20T15:03:38.743Z","updated":"2026-04-28T16:13:19.691Z","title":"WordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Iqonic Design","product":"WP Roadmap","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-52825","published":"2025-06-20T15:03:38.280Z","updated":"2026-04-28T16:13:19.900Z","title":"WordPress Real Estate Manager plugin <= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":8.8,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-52733","published":"2025-06-20T15:03:37.794Z","updated":"2026-04-28T16:13:17.752Z","title":"WordPress ANON::form embedded secure form plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Anonform Ab","product":"ANON::form embedded secure form","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-52719","published":"2025-06-20T15:03:37.331Z","updated":"2026-04-28T16:13:17.624Z","title":"WordPress ProfileGrid  plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-52715","published":"2025-06-20T15:03:36.841Z","updated":"2026-04-28T16:13:17.417Z","title":"WordPress Classified Listing plugin <= 4.2.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00577,"kevAdded":null},{"id":"CVE-2025-52713","published":"2025-06-20T15:03:36.364Z","updated":"2026-04-28T16:13:17.268Z","title":"WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":6.4,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-52711","published":"2025-06-20T15:03:35.880Z","updated":"2026-04-28T16:13:17.227Z","title":"WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-52710","published":"2025-06-20T15:03:35.411Z","updated":"2026-04-28T16:13:17.199Z","title":"WordPress File Manager Pro plugin <= 1.8.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ninja Team","product":"File Manager Pro","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-52708","published":"2025-06-20T15:03:34.933Z","updated":"2026-04-28T16:13:17.224Z","title":"WordPress HUSKY plugin <= 1.3.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00691,"kevAdded":null},{"id":"CVE-2025-52707","published":"2025-06-20T15:03:34.270Z","updated":"2026-04-28T16:13:17.040Z","title":"WordPress Firelight Lightbox plugin <= 2.3.16 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Firelight","product":"Firelight Lightbox","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-23999","published":"2025-06-18T09:26:29.875Z","updated":"2026-04-28T16:11:27.778Z","title":"WordPress Breeze plugin <= 2.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Cloudways","product":"Breeze","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-48111","published":"2025-06-17T15:01:43.752Z","updated":"2026-04-28T16:12:51.827Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"YITHEMES","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-48333","published":"2025-06-17T15:01:43.296Z","updated":"2026-04-28T16:12:56.747Z","title":"WordPress eForm - WordPress Form Builder < 4.19.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WPQuark","product":"eForm - WordPress Form Builder","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-49071","published":"2025-06-17T15:01:42.839Z","updated":"2026-04-28T16:12:58.646Z","title":"WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"NasaTheme","product":"Flozen","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2025-49451","published":"2025-06-17T15:01:42.375Z","updated":"2026-04-28T16:13:05.284Z","title":"WordPress Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin <= 1.0.13 - Directory Traversal Vulnerability","severity":"HIGH","score":7.5,"vendor":"yannisraft","product":"Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2025-49452","published":"2025-06-17T15:01:41.901Z","updated":"2026-04-28T16:13:05.594Z","title":"WordPress PostaPanduri plugin <= 2.1.3 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Adrian Ladó","product":"PostaPanduri","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-49508","published":"2025-06-17T15:01:41.424Z","updated":"2026-04-28T16:13:05.667Z","title":"WordPress CozyStay theme < 1.7.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"LoftOcean","product":"CozyStay","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-24761","published":"2025-06-17T15:01:40.951Z","updated":"2026-04-28T16:11:34.081Z","title":"WordPress DSK theme < 2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"DSK","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-24773","published":"2025-06-17T15:01:40.473Z","updated":"2026-05-12T00:23:30.937Z","title":"WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mojoomla","product":"WPCRM - CRM for Contact form CF7 & WooCommerce","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-28972","published":"2025-06-17T15:01:40.024Z","updated":"2026-04-28T16:11:52.062Z","title":"WordPress WP Employee Attendance System plugin <= 3.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Suhas Surse","product":"WP Employee Attendance System","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-28991","published":"2025-06-17T15:01:39.541Z","updated":"2026-04-28T16:11:52.365Z","title":"WordPress Evon theme <= 3.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Evon","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2025-29002","published":"2025-06-17T15:01:39.046Z","updated":"2026-04-28T16:11:52.572Z","title":"WordPress Simen theme <= 4.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Simen","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2025-30562","published":"2025-06-17T15:01:38.513Z","updated":"2026-04-29T09:51:54.892Z","title":"WordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"wpdistillery","product":"Navigation Tree Elementor","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2025-30618","published":"2025-06-17T15:01:38.032Z","updated":"2026-04-28T16:11:55.871Z","title":"WordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"yuliaz","product":"Rapyd Payment Extension for WooCommerce","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-30988","published":"2025-06-17T15:01:37.532Z","updated":"2026-04-28T16:12:02.982Z","title":"WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"_CreativeMedia_","product":"Elite Video Player","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-31919","published":"2025-06-17T15:01:37.063Z","updated":"2026-04-28T16:12:16.289Z","title":"WordPress Spare <= 1.7 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"Spare","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-32510","published":"2025-06-17T15:01:36.611Z","updated":"2026-04-28T16:12:23.236Z","title":"WordPress Ovatheme Events Manager plugin <= 1.8.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"ovatheme","product":"Ovatheme Events Manager","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-32549","published":"2025-06-17T15:01:36.146Z","updated":"2026-04-28T16:12:24.059Z","title":"WordPress WPGYM <= 65.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"mojoomla","product":"WPGYM","kev":false,"epss":0.00691,"kevAdded":null},{"id":"CVE-2025-39479","published":"2025-06-17T15:01:35.656Z","updated":"2026-04-28T16:12:32.347Z","title":"WordPress Smart Notification Plugin <= 10.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"smartiolabs","product":"Smart Notification","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-39486","published":"2025-06-17T15:01:35.197Z","updated":"2026-04-28T16:12:32.535Z","title":"WordPress Rankie plugin < 1.8.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ValvePress","product":"Rankie","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-39508","published":"2025-06-17T15:01:34.698Z","updated":"2026-05-12T00:23:23.993Z","title":"WordPress Nasa Core Plugin <= 6.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NasaTheme","product":"Nasa Core","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-47452","published":"2025-06-17T15:01:34.207Z","updated":"2026-04-28T16:12:40.908Z","title":"WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"RexTheme","product":"WP VR","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2025-47559","published":"2025-06-17T15:01:33.673Z","updated":"2026-04-28T16:12:44.933Z","title":"WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2025-47572","published":"2025-06-17T15:01:33.187Z","updated":"2026-04-28T16:12:45.895Z","title":"WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"mojoomla","product":"School Management","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2025-47573","published":"2025-06-17T15:01:32.721Z","updated":"2026-04-28T16:12:45.805Z","title":"WordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mojoomla","product":"School Management","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2025-48118","published":"2025-06-17T15:01:32.252Z","updated":"2026-04-28T16:12:51.899Z","title":"WordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"WpExperts Hub","product":"Woocommerce Partial Shipment","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-48145","published":"2025-06-17T15:01:31.782Z","updated":"2026-05-12T00:24:25.906Z","title":"WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Michal Jaworski","product":"Track, Analyze & Optimize by WP Tao","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-48274","published":"2025-06-17T15:01:31.321Z","updated":"2026-04-28T16:12:54.800Z","title":"WordPress WP Job Portal plugin <= 2.3.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-49234","published":"2025-06-17T15:01:30.665Z","updated":"2026-04-28T16:12:58.927Z","title":"WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Deepak anand","product":"WP Dummy Content Generator","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-49251","published":"2025-06-17T15:01:30.203Z","updated":"2026-04-28T16:12:59.009Z","title":"WordPress Fana theme <= 1.1.28 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Fana","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49252","published":"2025-06-17T15:01:29.742Z","updated":"2026-04-28T16:12:59.011Z","title":"WordPress Besa theme <= 2.3.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Besa","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49253","published":"2025-06-17T15:01:29.219Z","updated":"2026-04-28T16:12:59.028Z","title":"WordPress Lasa theme <= 1.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Lasa","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49254","published":"2025-06-17T15:01:28.668Z","updated":"2026-04-28T16:12:59.358Z","title":"WordPress Nika theme <= 1.2.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Nika","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49255","published":"2025-06-17T15:01:28.175Z","updated":"2026-05-12T00:23:58.699Z","title":"WordPress Ruza theme <= 1.0.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Ruza","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49256","published":"2025-06-17T15:01:27.698Z","updated":"2026-04-28T16:12:59.516Z","title":"WordPress Sapa theme <= 1.1.14 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Sapa","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49257","published":"2025-06-17T15:01:27.235Z","updated":"2026-05-12T00:24:13.064Z","title":"WordPress Zota theme <= 1.3.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Zota","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49258","published":"2025-06-17T15:01:26.682Z","updated":"2026-04-28T16:12:59.521Z","title":"WordPress Maia theme <= 1.1.15 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Maia","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2025-49259","published":"2025-06-17T15:01:26.202Z","updated":"2026-04-28T16:12:59.424Z","title":"WordPress Hara theme <= 1.2.10 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Hara","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49260","published":"2025-06-17T15:01:25.733Z","updated":"2026-04-28T16:12:59.655Z","title":"WordPress Aora theme <= 1.3.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Aora","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2025-49261","published":"2025-06-17T15:01:25.253Z","updated":"2026-04-28T16:12:59.497Z","title":"WordPress Diza theme <= 1.3.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"thembay","product":"Diza","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2025-49266","published":"2025-06-17T15:01:24.743Z","updated":"2026-04-28T16:12:59.786Z","title":"WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rustaurius","product":"Ultimate Reviews","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-49312","published":"2025-06-17T15:01:24.280Z","updated":"2026-04-28T16:13:00.781Z","title":"WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CodeRevolution","product":"Echo RSS Feed Post Generator Plugin for WordPress","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-49316","published":"2025-06-17T15:01:23.808Z","updated":"2026-05-12T00:23:37.856Z","title":"WordPress WP2LEADS plugin <= 3.5.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saleswonder Team: Tobias","product":"WP2LEADS","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-49330","published":"2025-06-17T15:01:23.343Z","updated":"2026-04-28T16:13:01.271Z","title":"WordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CRM Perks","product":"Integration for Contact Form 7 and Zoho CRM, Bigin","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2025-49331","published":"2025-06-17T15:01:22.874Z","updated":"2026-04-28T16:13:01.383Z","title":"WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2025-49854","published":"2025-06-17T15:01:22.399Z","updated":"2026-04-28T16:13:05.758Z","title":"WordPress Slim SEO plugin <= 4.5.4 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Anh Tran","product":"Slim SEO","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-49855","published":"2025-06-17T15:01:21.926Z","updated":"2026-04-28T16:13:05.609Z","title":"WordPress Meks Flexible Shortcodes plugin <= 1.3.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Meks","product":"Meks Flexible Shortcodes","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49856","published":"2025-06-17T15:01:21.476Z","updated":"2026-04-28T16:13:05.673Z","title":"WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CyberChimps","product":"Responsive Plus","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-49857","published":"2025-06-17T15:01:21.023Z","updated":"2026-04-28T16:13:05.619Z","title":"WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-49858","published":"2025-06-17T15:01:20.486Z","updated":"2026-05-12T00:23:51.785Z","title":"WordPress Arconix Shortcodes plugin <= 2.1.17 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tychesoftwares","product":"Arconix Shortcodes","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49859","published":"2025-06-17T15:01:19.971Z","updated":"2026-04-28T16:13:05.617Z","title":"WordPress WP Views Counter plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"etruel","product":"WP Views Counter","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49861","published":"2025-06-17T15:01:19.373Z","updated":"2026-04-28T16:13:05.832Z","title":"WordPress Kama Click Counter plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Timur Kamaev","product":"Kama Click Counter","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49862","published":"2025-06-17T15:01:18.902Z","updated":"2026-04-28T16:13:05.932Z","title":"WordPress Ebook Store plugin <= 5.8008 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-49863","published":"2025-06-17T15:01:18.412Z","updated":"2026-05-12T00:24:06.641Z","title":"WordPress Advanced Sermons plugin <= 3.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP CodeUs","product":"Advanced Sermons","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49864","published":"2025-06-17T15:01:17.962Z","updated":"2026-04-28T16:13:05.835Z","title":"WordPress AFS Analytics plugin <= 4.21 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"AFS Analytics","product":"AFS Analytics","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-49865","published":"2025-06-17T15:01:17.471Z","updated":"2026-04-28T16:13:06.333Z","title":"WordPress Advanced Settings plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Helmut Wandl","product":"Advanced Settings","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-49868","published":"2025-06-17T15:01:17.009Z","updated":"2026-04-28T16:13:06.696Z","title":"WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-49871","published":"2025-06-17T15:01:16.540Z","updated":"2026-04-28T16:13:06.598Z","title":"WordPress Noptin plugin <= 3.8.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Noptin Newsletter Team","product":"Noptin","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-49872","published":"2025-06-17T15:01:16.048Z","updated":"2026-04-28T16:13:06.684Z","title":"WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"myCred","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-49874","published":"2025-06-17T15:01:15.593Z","updated":"2026-04-28T16:13:06.674Z","title":"WordPress Arconix FAQ plugin <= 1.9.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tychesoftwares","product":"Arconix FAQ","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-49875","published":"2025-06-17T15:01:15.065Z","updated":"2026-04-28T16:13:06.724Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.9.3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49877","published":"2025-06-17T15:01:14.573Z","updated":"2026-04-28T16:13:06.696Z","title":"WordPress ProfileGrid  plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2025-49878","published":"2025-06-17T15:01:14.088Z","updated":"2026-05-12T00:23:44.299Z","title":"WordPress WPAdverts plugin <= 2.2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49879","published":"2025-06-17T15:01:13.627Z","updated":"2026-04-28T16:13:06.690Z","title":"WordPress Litho theme <= 3.0 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"themezaa","product":"Litho","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-49880","published":"2025-06-17T15:01:13.153Z","updated":"2026-05-12T00:24:19.482Z","title":"WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Imran Tauqeer","product":"CubeWP Forms","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-49881","published":"2025-06-17T15:01:12.665Z","updated":"2026-04-28T16:13:06.752Z","title":"WordPress Responsive Blocks plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyberChimps","product":"Responsive Blocks","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49882","published":"2025-06-17T15:01:12.192Z","updated":"2026-04-28T16:13:06.970Z","title":"WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-49415","published":"2025-06-17T15:01:11.701Z","updated":"2026-04-28T16:13:03.935Z","title":"WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"Fastw3b LLC","product":"FW Gallery","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2025-49444","published":"2025-06-17T15:01:11.240Z","updated":"2026-04-28T16:13:04.934Z","title":"WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"merkulove","product":"Reformer for Elementor","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-49447","published":"2025-06-17T15:01:10.770Z","updated":"2026-04-28T16:13:04.903Z","title":"WordPress FW Food Menu  <= 6.0.0 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"Fastw3b LLC","product":"FW Food Menu","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-49454","published":"2025-06-10T12:44:32.257Z","updated":"2026-04-29T09:51:55.324Z","title":"WordPress TinySalt theme < 3.10.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"LoftOcean","product":"TinySalt","kev":false,"epss":0.00787,"kevAdded":null},{"id":"CVE-2025-49455","published":"2025-06-10T12:43:42.832Z","updated":"2026-04-28T16:13:05.741Z","title":"WordPress WordPress-WPJobBoard <= 25.07010000-WP6.8.1-JB5.11.5 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ClickandPledge","product":"WordPress-WPJobBoard","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2025-49507","published":"2025-06-10T12:42:12.069Z","updated":"2026-04-28T16:13:05.610Z","title":"WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"LoftOcean","product":"CozyStay","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2025-49509","published":"2025-06-10T12:40:49.442Z","updated":"2026-04-28T16:13:05.595Z","title":"WordPress Audio Editor & Recorder plugin <= 2.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Roland Beaussant","product":"Audio Editor & Recorder","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-49510","published":"2025-06-10T12:36:35.258Z","updated":"2026-04-28T16:13:05.590Z","title":"WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFactory","product":"Min Max Step Quantity Limits Manager for WooCommerce","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-49511","published":"2025-06-10T12:35:33.715Z","updated":"2026-04-28T16:13:05.603Z","title":"WordPress Civi Framework plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability","severity":"HIGH","score":7.1,"vendor":"uxper","product":"Civi Framework","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2023-25999","published":"2025-06-09T15:56:58.863Z","updated":"2026-04-28T16:08:11.327Z","title":"WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"BodyCenter - Gym, Fitness WooCommerce WordPress Theme","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2023-26005","published":"2025-06-09T15:56:58.127Z","updated":"2026-04-28T16:08:11.580Z","title":"WordPress Fitrush <= 1.3.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"Fitrush","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-23974","published":"2025-06-09T15:56:57.317Z","updated":"2026-04-28T16:11:26.578Z","title":"WordPress One-Login plugin <= 1.4 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.1,"vendor":"ifkooo","product":"One-Login","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-24767","published":"2025-06-09T15:56:56.570Z","updated":"2026-04-28T16:11:34.346Z","title":"WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"facturaone","product":"TicketBAI Facturas para WooCommerce","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-24768","published":"2025-06-09T15:56:55.812Z","updated":"2026-04-28T16:11:34.311Z","title":"WordPress Nitan theme <= 2.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Nitan","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-24770","published":"2025-06-09T15:56:55.085Z","updated":"2026-04-28T16:11:34.324Z","title":"WordPress CraftXtore theme <= 1.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"CraftXtore","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-26592","published":"2025-06-09T15:56:54.330Z","updated":"2026-04-28T16:11:39.462Z","title":"WordPress Lab Theme <= 1.0.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Lab","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-27362","published":"2025-06-09T15:56:53.575Z","updated":"2026-04-28T16:11:49.200Z","title":"WordPress Petito theme < 1.6.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"Petito","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-28888","published":"2025-06-09T15:56:52.840Z","updated":"2026-04-28T16:11:49.951Z","title":"WordPress GiftXtore theme < 1.7.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"BZOTheme","product":"GiftXtore","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-28944","published":"2025-06-09T15:56:52.076Z","updated":"2026-04-28T16:11:51.604Z","title":"WordPress Avaz theme <= 2.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Avaz","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-28945","published":"2025-06-09T15:56:51.055Z","updated":"2026-04-28T16:11:51.535Z","title":"WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"Valen - Sport, Fashion WooCommerce WordPress Theme","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-28992","published":"2025-06-09T15:56:49.983Z","updated":"2026-04-28T16:11:52.496Z","title":"WordPress SNS Anton theme <= 4.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"snstheme","product":"SNS Anton","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2025-31019","published":"2025-06-09T15:56:49.219Z","updated":"2026-04-28T16:12:03.849Z","title":"WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability","severity":"HIGH","score":8.8,"vendor":"miniOrange","product":"Password Policy Manager","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2025-31022","published":"2025-06-09T15:56:48.504Z","updated":"2026-04-28T16:12:03.867Z","title":"WordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"PayU India","product":"PayU India","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2025-31039","published":"2025-06-09T15:56:47.786Z","updated":"2026-04-28T16:12:04.074Z","title":"WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"pixelgrade","product":"Category Icon","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2025-31045","published":"2025-06-09T15:56:47.038Z","updated":"2026-04-28T16:12:04.240Z","title":"WordPress elfsight Contact Form widget plugin <= 2.3.1 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"elfsight","product":"elfsight Contact Form widget","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2025-31050","published":"2025-06-09T15:56:46.312Z","updated":"2026-04-28T16:12:04.492Z","title":"WordPress Apptha Slider Gallery plugin <= 2.5 - Arbitrary File Read vulnerability","severity":"HIGH","score":7.5,"vendor":"appthaplugins","product":"Apptha Slider Gallery","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-31052","published":"2025-06-09T15:56:45.558Z","updated":"2026-04-28T16:12:04.347Z","title":"WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"The Fashion - Model Agency One Page Beauty Theme","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2025-31057","published":"2025-06-09T15:56:44.831Z","updated":"2026-04-28T16:12:04.422Z","title":"WordPress Universal Video Player plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31058","published":"2025-06-09T15:56:43.955Z","updated":"2026-04-28T16:12:04.304Z","title":"WordPress Revolution Video Player plugin <= 2.9.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Revolution Video Player","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31059","published":"2025-06-09T15:56:42.914Z","updated":"2026-04-28T16:12:04.472Z","title":"WordPress WBW Product Table PRO plugin <= 2.2.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"woobewoo","product":"WBW Product Table PRO","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-31061","published":"2025-06-09T15:56:41.949Z","updated":"2026-04-28T16:12:04.820Z","title":"WordPress Wishlist plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"redqteam","product":"Wishlist","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31396","published":"2025-06-09T15:56:40.939Z","updated":"2026-04-28T16:12:05.794Z","title":"WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"FLAP - Business WordPress Theme","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31398","published":"2025-06-09T15:56:40.019Z","updated":"2026-04-28T16:12:06.532Z","title":"WordPress PIMP - Creative MultiPurpose <= 1.7 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"PIMP - Creative MultiPurpose","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31424","published":"2025-06-09T15:56:38.948Z","updated":"2026-05-12T00:23:11.081Z","title":"WordPress WP Lead Capturing Pages plugin < 2.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"kamleshyadav","product":"WP Lead Capturing Pages","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-31426","published":"2025-06-09T15:56:37.872Z","updated":"2026-04-28T16:12:06.885Z","title":"WordPress Sticky Radio Player plugin <= 3.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Sticky Radio Player","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31429","published":"2025-06-09T15:56:36.838Z","updated":"2026-04-28T16:12:06.844Z","title":"WordPress PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"PressGrid - Frontend Publish Reaction & Multimedia Theme","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31635","published":"2025-06-09T15:56:36.111Z","updated":"2026-04-28T16:12:10.781Z","title":"WordPress CLEVER plugin <= 2.6 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"LambertGroup","product":"CLEVER","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-31638","published":"2025-06-09T15:56:35.343Z","updated":"2026-04-28T16:12:10.768Z","title":"WordPress Spare <= 1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"themeton","product":"Spare","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31917","published":"2025-06-09T15:56:34.614Z","updated":"2026-05-12T00:23:17.509Z","title":"WordPress Universal Video Player plugin <= 3.8.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"Universal Video Player","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-31920","published":"2025-06-09T15:56:33.877Z","updated":"2026-04-28T16:12:16.356Z","title":"WordPress WP Guppy plugin <= 4.3.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"AmentoTech","product":"WP Guppy","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-31925","published":"2025-06-09T15:56:32.794Z","updated":"2026-05-12T00:23:04.120Z","title":"WordPress SHOUT plugin <= 3.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LambertGroup","product":"SHOUT","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-32291","published":"2025-06-09T15:54:18.887Z","updated":"2026-04-28T16:12:20.999Z","title":"WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"FantasticPlugins","product":"SUMO Affiliates Pro","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2025-32305","published":"2025-06-09T15:54:18.184Z","updated":"2026-04-28T16:12:21.804Z","title":"WordPress FlatNews theme <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sneeit","product":"WordPress FlatNews Theme","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-32308","published":"2025-06-09T15:54:17.431Z","updated":"2026-04-28T16:12:21.852Z","title":"WordPress Team Builder plugin <= 1.5.7 - Broken Access Control Vulnerability","severity":"HIGH","score":7.6,"vendor":"looks_awesome","product":"Team Builder","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2025-32595","published":"2025-06-09T15:54:16.735Z","updated":"2026-04-28T16:12:25.088Z","title":"WordPress Krowd theme < 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Krowd","kev":false,"epss":0.00785,"kevAdded":null},{"id":"CVE-2025-39473","published":"2025-06-09T15:54:16.031Z","updated":"2026-04-28T16:12:32.325Z","title":"WordPress Seofy Core plugin <= 1.6.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"WebGeniusLab","product":"Seofy Core","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2025-39475","published":"2025-06-09T15:54:15.232Z","updated":"2026-04-28T16:12:32.366Z","title":"WordPress Arlo theme <= 6.0.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Frenify","product":"Arlo","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2025-39476","published":"2025-06-09T15:54:14.400Z","updated":"2026-04-28T16:12:32.375Z","title":"WordPress Revo theme <= 4.0.26 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"magentech","product":"Revo","kev":false,"epss":0.00676,"kevAdded":null},{"id":"CVE-2025-39539","published":"2025-06-09T15:54:13.691Z","updated":"2026-04-28T16:12:34.289Z","title":"WordPress WP Email Delivery plugin <= 1.20.11.23 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"brewlabs","product":"WP Email Delivery","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-47463","published":"2025-06-09T15:54:12.968Z","updated":"2026-04-28T16:12:41.771Z","title":"WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"Fahad Mahmood","product":"Stock Locations for WooCommerce","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-47477","published":"2025-06-09T15:54:12.253Z","updated":"2026-04-28T16:12:42.304Z","title":"WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"revmakx","product":"Backup and Staging by WP Time Capsule","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-47487","published":"2025-06-09T15:54:11.431Z","updated":"2026-04-28T16:12:42.683Z","title":"WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Moreconvert Team","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-47511","published":"2025-06-09T15:54:10.686Z","updated":"2026-04-28T16:12:43.371Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability","severity":"MEDIUM","score":6.8,"vendor":"info@welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2025-47527","published":"2025-06-09T15:54:09.986Z","updated":"2026-04-28T16:12:44.063Z","title":"WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability","severity":"HIGH","score":7.1,"vendor":"Icegram","product":"Icegram Collect","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-47561","published":"2025-06-09T15:54:09.280Z","updated":"2026-05-12T00:22:29.980Z","title":"WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2025-47598","published":"2025-06-09T15:54:08.578Z","updated":"2026-04-28T16:12:46.832Z","title":"WordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"click5","product":"History Log by click5","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-47608","published":"2025-06-09T15:54:07.876Z","updated":"2026-04-28T16:12:47.003Z","title":"WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"sonalsinha21","product":"Recover abandoned cart for WooCommerce","kev":false,"epss":0.01113,"kevAdded":null},{"id":"CVE-2025-47651","published":"2025-06-09T15:54:07.167Z","updated":"2026-04-28T16:12:48.080Z","title":"WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Infility","product":"Infility Global","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-48122","published":"2025-06-09T15:54:06.451Z","updated":"2026-05-12T00:22:57.268Z","title":"WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Holest Engineering","product":"Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-48123","published":"2025-06-09T15:54:05.742Z","updated":"2026-04-28T16:12:51.875Z","title":"WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":10,"vendor":"Holest Engineering","product":"Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2025-48124","published":"2025-06-09T15:54:05.023Z","updated":"2026-04-28T16:12:51.886Z","title":"WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"Holest Engineering","product":"Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-48125","published":"2025-06-09T15:54:04.283Z","updated":"2026-04-28T16:12:52.117Z","title":"WordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"WP Event Manager","product":"WP Event Manager","kev":false,"epss":0.00636,"kevAdded":null},{"id":"CVE-2025-48126","published":"2025-06-09T15:54:03.530Z","updated":"2026-04-28T16:12:52.081Z","title":"WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2025-48129","published":"2025-06-09T15:54:02.694Z","updated":"2026-04-28T16:12:52.203Z","title":"WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Holest Engineering","product":"Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-48130","published":"2025-06-09T15:54:01.031Z","updated":"2026-04-28T16:12:52.327Z","title":"WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"spicethemes","product":"Spice Blocks","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2025-48139","published":"2025-06-09T15:54:00.244Z","updated":"2026-04-28T16:12:52.355Z","title":"WordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"relentlo","product":"StyleAI","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-48140","published":"2025-06-09T15:53:59.337Z","updated":"2026-04-28T16:12:52.318Z","title":"WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"metalpriceapi","product":"MetalpriceAPI","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2025-48141","published":"2025-06-09T15:53:58.539Z","updated":"2026-04-28T16:12:52.340Z","title":"WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Alex Zaytseff","product":"Multi CryptoCurrency Payments","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2025-48143","published":"2025-06-09T15:53:57.808Z","updated":"2026-04-28T16:12:52.408Z","title":"WordPress Formulario de contacto SalesUp! plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"salesup2019","product":"Formulario de contacto SalesUp!","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-48147","published":"2025-06-09T15:53:57.056Z","updated":"2026-04-29T09:51:55.579Z","title":"WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crypto Cloud","product":"CryptoCloud - Crypto Payment Gateway","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-48261","published":"2025-06-09T15:53:56.298Z","updated":"2026-04-29T09:51:55.692Z","title":"WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-48267","published":"2025-06-09T15:53:55.539Z","updated":"2026-04-28T16:12:54.364Z","title":"WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-48279","published":"2025-06-09T15:53:54.808Z","updated":"2026-04-28T16:12:55.352Z","title":"WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Richard Perdaan","product":"WC MyParcel Belgium","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-48281","published":"2025-06-09T15:53:53.912Z","updated":"2026-05-12T00:22:50.300Z","title":"WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mystyleplatform","product":"MyStyle Custom Product Designer","kev":false,"epss":0.01404,"kevAdded":null},{"id":"CVE-2025-49265","published":"2025-06-09T15:53:53.079Z","updated":"2026-04-28T16:12:59.720Z","title":"WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Membership For WooCommerce","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-49275","published":"2025-06-09T15:53:52.274Z","updated":"2026-04-28T16:12:59.914Z","title":"WordPress Blogbyte theme <= 1.1.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Blogbyte","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49276","published":"2025-06-09T15:53:51.518Z","updated":"2026-04-28T16:12:59.879Z","title":"WordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Blogmine","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49277","published":"2025-06-09T15:53:50.790Z","updated":"2026-04-28T16:12:59.917Z","title":"WordPress Blogprise theme <= 1.0.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Blogprise","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49278","published":"2025-06-09T15:53:50.048Z","updated":"2026-04-28T16:12:59.886Z","title":"WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Blogty","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49279","published":"2025-06-09T15:53:49.232Z","updated":"2026-04-28T16:12:59.927Z","title":"WordPress Blogvy theme <= 1.0.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Blogvy","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49280","published":"2025-06-09T15:53:48.534Z","updated":"2026-04-28T16:12:59.921Z","title":"WordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magty","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49281","published":"2025-06-09T15:53:47.818Z","updated":"2026-04-28T16:13:00.255Z","title":"WordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magways","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-49282","published":"2025-06-09T15:53:47.134Z","updated":"2026-04-28T16:12:59.993Z","title":"WordPress Magze theme <= 1.0.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"unfoldwp","product":"Magze","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2025-49295","published":"2025-06-09T15:53:46.392Z","updated":"2026-05-12T00:22:43.857Z","title":"WordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"MediClinic","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2025-49296","published":"2025-06-09T15:53:45.686Z","updated":"2026-04-28T16:13:00.451Z","title":"WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"GrandPrix","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2025-49297","published":"2025-06-09T15:53:44.962Z","updated":"2026-05-12T00:22:36.924Z","title":"WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Grill and Chow","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2025-47601","published":"2025-06-07T04:37:52.987Z","updated":"2026-04-28T16:12:46.906Z","title":"WordPress MaxiBlocks plugin <= 2.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Christiaan Pieterse","product":"MaxiBlocks","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-49419","published":"2025-06-06T12:54:52.214Z","updated":"2026-04-28T16:13:04.185Z","title":"WordPress Foxit eSign for WordPress plugin <= 2.0.3 - Other Vulnerability Type Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"esigngenie","product":"Foxit eSign for WordPress","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-49421","published":"2025-06-06T12:54:51.748Z","updated":"2026-04-28T16:13:04.095Z","title":"WordPress WP Text Expander plugin <= 1.0.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Andrei Filonov","product":"WP Text Expander","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-49425","published":"2025-06-06T12:54:51.309Z","updated":"2026-04-28T16:13:04.226Z","title":"WordPress Konami Easter Egg plugin <= v0.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Adrian Hanft","product":"Konami Easter Egg","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-49427","published":"2025-06-06T12:54:50.836Z","updated":"2026-04-28T16:13:04.349Z","title":"WordPress Abbie Expander plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ryan Burnette","product":"Abbie Expander","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49429","published":"2025-06-06T12:54:50.375Z","updated":"2026-04-28T16:13:04.707Z","title":"WordPress Video Embeds plugin <= 0.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ryan Burnette","product":"Video Embeds","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49435","published":"2025-06-06T12:54:49.895Z","updated":"2026-04-28T16:13:04.874Z","title":"WordPress Wp Easy Allopass plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hasina77","product":"Wp Easy Allopass","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-49439","published":"2025-06-06T12:54:49.420Z","updated":"2026-04-28T16:13:04.891Z","title":"WordPress Atelier Create CV plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"mariusz88atelierweb","product":"Atelier Create CV","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-49440","published":"2025-06-06T12:54:48.939Z","updated":"2026-04-28T16:13:04.900Z","title":"WordPress WP Security Master plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Vuong Nguyen","product":"WP Security Master","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-49441","published":"2025-06-06T12:54:48.457Z","updated":"2026-04-28T16:13:04.880Z","title":"WordPress Interactive Regional Map of Florida plugin <= 1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Map Plugins","product":"Interactive Regional Map of Florida","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-49442","published":"2025-06-06T12:54:47.896Z","updated":"2026-04-28T16:13:04.976Z","title":"WordPress Simple Nested Menu plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mostafa Shahiri","product":"Simple Nested Menu","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49443","published":"2025-06-06T12:54:47.442Z","updated":"2026-04-28T16:13:04.870Z","title":"WordPress Bacon Ipsum plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chris McCoy","product":"Bacon Ipsum","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49445","published":"2025-06-06T12:54:46.955Z","updated":"2026-04-28T16:13:04.940Z","title":"WordPress Interactive UK Regional Map plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Map Plugins","product":"Interactive UK Regional Map","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-49446","published":"2025-06-06T12:54:46.484Z","updated":"2026-04-28T16:13:04.878Z","title":"WordPress Admin Notes plugin <=1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"minhlaobao","product":"Admin Notes","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-49449","published":"2025-06-06T12:54:45.999Z","updated":"2026-04-28T16:13:05.015Z","title":"WordPress Interactive Regional Map of Africa plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Map Plugins","product":"Interactive Regional Map of Africa","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-49450","published":"2025-06-06T12:54:45.510Z","updated":"2026-04-28T16:13:05.279Z","title":"WordPress SEPA Girocode plugin <= 0.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mhallmann","product":"SEPA Girocode","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49453","published":"2025-06-06T12:54:44.910Z","updated":"2026-04-28T16:13:05.568Z","title":"WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Jatinder Pal Singh","product":"BP Profile as Homepage","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2023-25995","published":"2025-06-06T12:54:44.444Z","updated":"2026-04-28T16:08:11.231Z","title":"WordPress AI Mortgage Calculator <= 1.0.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"choicehomemortgage","product":"AI Mortgage Calculator","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2023-25997","published":"2025-06-06T12:54:43.959Z","updated":"2026-04-28T16:08:11.629Z","title":"WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SolaPlugins","product":"Sola Support Ticket","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2023-26000","published":"2025-06-06T12:54:43.462Z","updated":"2026-04-28T16:08:11.315Z","title":"WordPress Bang tinh vay <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"hanhdo205","product":"Bang tinh vay","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2023-26001","published":"2025-06-06T12:54:42.934Z","updated":"2026-04-28T16:08:11.817Z","title":"WordPress Next Event Calendar <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Marchetti Design","product":"Next Event Calendar","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2023-26002","published":"2025-06-06T12:54:42.453Z","updated":"2026-04-28T16:08:11.760Z","title":"WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"6Storage","product":"6Storage Rentals","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2023-26003","published":"2025-06-06T12:54:41.979Z","updated":"2026-04-28T16:08:11.825Z","title":"WordPress WP Post Corrector <= 1.0.2 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"vipul Jariwala","product":"WP Post Corrector","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-23969","published":"2025-06-06T12:54:41.515Z","updated":"2026-04-28T16:11:26.940Z","title":"WordPress KI Live Video Conferences plugin <= 5.5.15 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"whassan","product":"KI Live Video Conferences","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-23971","published":"2025-06-06T12:54:40.993Z","updated":"2026-05-13T00:00:10.037Z","title":"WordPress KI Live Video Conferences plugin <= 5.5.15 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"whassan","product":"KI Live Video Conferences","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-24762","published":"2025-06-06T12:54:40.421Z","updated":"2026-04-28T16:11:34.110Z","title":"WordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"facturaone","product":"TicketBAI Facturas para WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-24763","published":"2025-06-06T12:54:39.955Z","updated":"2026-04-28T16:11:34.127Z","title":"WordPress bbPress API plugin <= 1.0.14 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pascal Casier","product":"bbPress API","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-24772","published":"2025-06-06T12:54:39.454Z","updated":"2026-04-28T16:11:34.305Z","title":"WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"cmsMinds","product":"Pay with Contact Form 7","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-24776","published":"2025-06-06T12:54:38.983Z","updated":"2026-04-28T16:11:34.349Z","title":"WordPress Responsive Flipbooks plugin <= 1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"codelobster","product":"Responsive Flipbooks","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-24778","published":"2025-06-06T12:54:38.327Z","updated":"2026-04-28T16:11:34.346Z","title":"WordPress No Spam At All plugin <= 1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"De paragon","product":"No Spam At All","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-26590","published":"2025-06-06T12:54:37.782Z","updated":"2026-04-28T16:11:39.571Z","title":"WordPress Complete Google Seo Scan plugin <= 3.5.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Nir","product":"Complete Google Seo Scan","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-26593","published":"2025-06-06T12:54:37.321Z","updated":"2026-04-28T16:11:39.624Z","title":"WordPress FastBook plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"FasterThemes","product":"FastBook","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-27334","published":"2025-06-06T12:54:36.862Z","updated":"2026-04-28T16:11:48.374Z","title":"WordPress Simple Google Static Map plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ángel C.","product":"Simple Google Static Map","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-27359","published":"2025-06-06T12:54:36.408Z","updated":"2026-04-28T16:11:49.106Z","title":"WordPress WP Media File Type Manager plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Seerox","product":"WP Media File Type Manager","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-27360","published":"2025-06-06T12:54:35.952Z","updated":"2026-04-28T16:11:49.232Z","title":"WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Corner","product":"Quick Event Calendar","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-28948","published":"2025-06-06T12:54:35.489Z","updated":"2026-04-28T16:11:51.665Z","title":"WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"codedraft","product":"Mediabay - WordPress Media Library Folders","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-28950","published":"2025-06-06T12:54:35.051Z","updated":"2026-04-28T16:11:51.690Z","title":"WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"David Shabtai","product":"Post Author","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-28952","published":"2025-06-06T12:54:34.612Z","updated":"2026-04-28T16:11:51.627Z","title":"WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jonathan Lau","product":"CubePoints","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-28954","published":"2025-06-06T12:54:34.160Z","updated":"2026-04-28T16:11:51.622Z","title":"WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"wphobby","product":"Backwp","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-28958","published":"2025-06-06T12:54:33.704Z","updated":"2026-04-28T16:11:51.685Z","title":"WordPress Bg Orthodox Calendar plugin <= 0.13.10 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Vadim Bogaiskov","product":"Bg Orthodox Calendar","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-28964","published":"2025-06-06T12:54:33.252Z","updated":"2026-04-28T16:11:51.901Z","title":"WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"mangup","product":"Personal Favicon","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-28966","published":"2025-06-06T12:54:32.790Z","updated":"2026-04-28T16:11:51.954Z","title":"WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"dilemma123","product":"Recent Posts Slider Responsive","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-28974","published":"2025-06-06T12:54:32.342Z","updated":"2026-04-28T16:11:52.014Z","title":"WordPress Free WP Mail SMTP plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"mail250","product":"Free WP Mail SMTP","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-28981","published":"2025-06-06T12:54:31.893Z","updated":"2026-04-28T16:11:52.189Z","title":"WordPress WP Mail Options plugin <= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Soli","product":"WP Mail Options","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-28984","published":"2025-06-06T12:54:31.442Z","updated":"2026-04-28T16:11:52.492Z","title":"WordPress Subscription Renewal Reminders for WooCommerce plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"storepro","product":"Subscription Renewal Reminders for WooCommerce","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-28985","published":"2025-06-06T12:54:30.985Z","updated":"2026-04-28T16:11:52.317Z","title":"WordPress Elastic Email Subscribe Form plugin <= 1.2.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Elastic Email","product":"Elastic Email Subscribe Form","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-28986","published":"2025-06-06T12:54:30.522Z","updated":"2026-04-28T16:11:52.292Z","title":"WordPress Epicwin Plugin plugin <= 1.5 - CSRF to SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"Webaholicson","product":"Epicwin Plugin","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-28989","published":"2025-06-06T12:54:30.062Z","updated":"2026-04-28T16:11:52.308Z","title":"WordPress Read More Login plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"arildur","product":"Read More Login","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-28994","published":"2025-06-06T12:54:29.584Z","updated":"2026-04-28T16:11:52.528Z","title":"WordPress Viral Loops WP Integration plugin <= 3.8.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"viralloops","product":"Viral Loops WP Integration","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-28995","published":"2025-06-06T12:54:29.129Z","updated":"2026-05-12T00:21:17.087Z","title":"WordPress Viral Loops WP Integration plugin <= 3.8.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"viralloops","product":"Viral Loops WP Integration","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-28996","published":"2025-06-06T12:54:28.676Z","updated":"2026-04-28T16:11:52.521Z","title":"WordPress GPP Slideshow plugin <= 1.3.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Thad Allender","product":"GPP Slideshow","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-28997","published":"2025-06-06T12:54:28.235Z","updated":"2026-04-28T16:11:52.521Z","title":"WordPress WP AutoKeyword plugin <= 1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"EXEIdeas International","product":"WP AutoKeyword","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-29003","published":"2025-06-06T12:54:27.779Z","updated":"2026-05-12T00:21:23.600Z","title":"WordPress The Holiday Calendar plugin <= 1.18.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mva7","product":"The Holiday Calendar","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-29005","published":"2025-06-06T12:54:27.333Z","updated":"2026-04-28T16:11:52.770Z","title":"WordPress HR Management Lite plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Weblizar - WordPress Themes & Plugin","product":"HR Management Lite","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-29006","published":"2025-06-06T12:54:26.887Z","updated":"2026-04-28T16:11:52.804Z","title":"WordPress Direct Checkout for WooCommerce Lite plugin <= 1.0.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"centangle","product":"Direct Checkout for WooCommerce Lite","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-29008","published":"2025-06-06T12:54:26.435Z","updated":"2026-04-28T16:11:52.836Z","title":"WordPress SocialMark plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"ShawonPro","product":"SocialMark","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-29010","published":"2025-06-06T12:54:25.981Z","updated":"2026-04-28T16:11:52.868Z","title":"WordPress Behance Portfolio Manager plugin <= 1.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"eleopard","product":"Behance Portfolio Manager","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-29011","published":"2025-06-06T12:54:25.496Z","updated":"2026-04-28T16:11:52.969Z","title":"WordPress YouTube Simple Gallery plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CHR Designer","product":"YouTube Simple Gallery","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-29013","published":"2025-06-06T12:54:25.042Z","updated":"2026-05-12T00:21:30.253Z","title":"WordPress Custom Category/Post Type Post order plugin <= 1.6.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"faaiq","product":"Custom Category/Post Type Post order","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-30624","published":"2025-06-06T12:54:24.591Z","updated":"2026-04-28T16:11:55.940Z","title":"WordPress WordLift plugin <= 3.54.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WordLift","product":"WordLift","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-30625","published":"2025-06-06T12:54:24.142Z","updated":"2026-04-28T16:11:56.058Z","title":"WordPress AppBanners plugin <= 1.5.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Matt Pramschufer","product":"AppBanners","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30627","published":"2025-06-06T12:54:23.683Z","updated":"2026-04-28T16:11:56.399Z","title":"WordPress Elegant Visitor Counter plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"regolithsjk","product":"Elegant Visitor Counter","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30629","published":"2025-06-06T12:54:23.205Z","updated":"2026-04-28T16:11:56.519Z","title":"WordPress Bitly URL Shortener plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codehaveli","product":"Bitly URL Shortener","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30630","published":"2025-06-06T12:54:22.736Z","updated":"2026-04-28T16:11:56.736Z","title":"WordPress Global Translator plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"pozzad","product":"Global Translator","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30632","published":"2025-06-06T12:54:22.264Z","updated":"2026-04-28T16:11:56.442Z","title":"WordPress Global Translator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pozzad","product":"Global Translator","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-30634","published":"2025-06-06T12:54:21.791Z","updated":"2026-04-28T16:11:56.451Z","title":"WordPress WP Featured Content Slider plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"IWEBIX","product":"WP Featured Content Slider","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30636","published":"2025-06-06T12:54:21.342Z","updated":"2026-04-28T16:11:56.533Z","title":"WordPress Accessibility Suite plugin <= 4.19 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ability, Inc","product":"Accessibility Suite","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-30637","published":"2025-06-06T12:54:20.882Z","updated":"2026-04-28T16:11:56.646Z","title":"WordPress Booking Ultra Pro plugin <= 1.1.20 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Deetronix","product":"Booking Ultra Pro","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30638","published":"2025-06-06T12:54:20.428Z","updated":"2026-04-28T16:11:56.772Z","title":"WordPress Powie's Uptime Robot plugin <= 0.9.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"PowieT","product":"Powie's Uptime Robot","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-30927","published":"2025-06-06T12:54:19.973Z","updated":"2026-04-28T16:12:00.644Z","title":"WordPress Wordapp plugin <= 1.7.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wordapp Team","product":"Wordapp","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-30928","published":"2025-06-06T12:54:19.523Z","updated":"2026-04-28T16:12:00.987Z","title":"WordPress WP Biographia plugin <= 4.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"vicchi","product":"WP Biographia","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-30930","published":"2025-06-06T12:54:19.059Z","updated":"2026-04-28T16:12:00.965Z","title":"WordPress ACF: Yandex Maps Field plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Unreal Themes","product":"ACF: Yandex Maps Field","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-30931","published":"2025-06-06T12:54:18.585Z","updated":"2026-04-28T16:12:00.929Z","title":"WordPress «Подсказки» от DaData.ru plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Shamil Shafeev","product":"«Подсказки» от DaData.ru","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-30932","published":"2025-06-06T12:54:18.100Z","updated":"2026-04-28T16:12:00.844Z","title":"WordPress WP Compress for MainWP plugin <= 6.30.32 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Compress","product":"WP Compress for MainWP","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-30934","published":"2025-06-06T12:54:17.586Z","updated":"2026-04-28T16:12:01.882Z","title":"WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"OLIVESYSTEM","product":"診断ジェネレータ作成プラグイン","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-30935","published":"2025-06-06T12:54:17.118Z","updated":"2026-04-28T16:12:01.245Z","title":"WordPress Contact Form plugin <= 2.0.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NickDuncan","product":"Contact Form","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-30937","published":"2025-06-06T12:54:16.646Z","updated":"2026-04-28T16:12:01.775Z","title":"WordPress Responsify WP plugin <= 1.9.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"stefanledin","product":"Responsify WP","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30938","published":"2025-06-06T12:54:16.196Z","updated":"2026-04-28T16:12:01.225Z","title":"WordPress Broadly for WordPress plugin <= 3.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"broadly","product":"Broadly for WordPress","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30939","published":"2025-06-06T12:54:15.732Z","updated":"2026-04-28T16:12:01.336Z","title":"WordPress IFrame Widget plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Debashish","product":"IFrame Widget","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-30940","published":"2025-06-06T12:54:15.252Z","updated":"2026-04-28T16:12:01.543Z","title":"WordPress Melipayamak plugin <= 2.2.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"melipayamak","product":"Melipayamak","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-30941","published":"2025-06-06T12:54:14.791Z","updated":"2026-04-28T16:12:01.451Z","title":"WordPress Pinterest Verify Meta Tag plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Marvie Pons","product":"Pinterest Verify Meta Tag","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30942","published":"2025-06-06T12:54:14.331Z","updated":"2026-04-28T16:12:01.923Z","title":"WordPress  Post Custom Templates Lite plugin <= 1.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"OTWthemes","product":"Post Custom Templates Lite","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30945","published":"2025-06-06T12:54:13.836Z","updated":"2026-04-28T16:12:01.770Z","title":"WordPress Taskbuilder plugin <= 4.0.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-30946","published":"2025-06-06T12:54:13.310Z","updated":"2026-04-28T16:12:01.652Z","title":"WordPress Custom Bulk/Quick Edit plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Michael Cannon","product":"Custom Bulk/Quick Edit","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30948","published":"2025-06-06T12:54:12.562Z","updated":"2026-04-28T16:12:01.748Z","title":"WordPress Layouts for Elementor plugin <= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Giraphix Creative","product":"Layouts for Elementor","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30950","published":"2025-06-06T12:54:11.997Z","updated":"2026-04-28T16:12:01.927Z","title":"WordPress All Currencies for WooCommerce plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Wham","product":"All Currencies for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-30951","published":"2025-06-06T12:54:11.513Z","updated":"2026-04-28T16:12:01.878Z","title":"WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stiofan","product":"BlockStrap Page Builder - Bootstrap Blocks","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-30952","published":"2025-06-06T12:54:11.056Z","updated":"2026-04-28T16:12:01.879Z","title":"WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdive","product":"Nexa Blocks","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-30953","published":"2025-06-06T12:54:10.601Z","updated":"2026-04-28T16:12:01.860Z","title":"WordPress WP Gravity Forms Salesforce plugin <= 1.4.7 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Salesforce","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-30954","published":"2025-06-06T12:54:10.142Z","updated":"2026-04-28T16:12:02.084Z","title":"WordPress WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Constant Contact Plugin","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-30956","published":"2025-06-06T12:54:09.684Z","updated":"2026-04-28T16:12:02.002Z","title":"WordPress Booqable Rental plugin <= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Booqable Rental Software","product":"Booqable Rental","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30957","published":"2025-06-06T12:54:09.222Z","updated":"2026-04-28T16:12:02.198Z","title":"WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"BuddyDev","product":"Activity Plus Reloaded for BuddyPress","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-30958","published":"2025-06-06T12:54:08.772Z","updated":"2026-04-28T16:12:02.090Z","title":"WordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"onOffice GmbH","product":"onOffice for WP-Websites","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2025-30968","published":"2025-06-06T12:54:08.294Z","updated":"2026-04-28T16:12:02.209Z","title":"WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"jokerbr313","product":"Advanced Post List","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-30974","published":"2025-06-06T12:54:07.807Z","updated":"2026-04-28T16:12:02.771Z","title":"WordPress Post Grid Master plugin <= 3.4.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Akhtarujjaman Shuvo","product":"Post Grid Master","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2025-30976","published":"2025-06-06T12:54:07.354Z","updated":"2026-04-28T16:12:02.931Z","title":"WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"wpdive","product":"Nexa Blocks","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-30977","published":"2025-06-06T12:54:06.879Z","updated":"2026-04-28T16:12:03.015Z","title":"WordPress Chaport <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Chaport Live Chat","product":"Chaport","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-30978","published":"2025-06-06T12:54:06.426Z","updated":"2026-04-28T16:12:02.719Z","title":"WordPress Slack Notifications by dorzki plugin <= 2.0.7 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Dor Zuberi","product":"Slack Notifications by dorzki","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-30980","published":"2025-06-06T12:54:05.928Z","updated":"2026-04-28T16:12:03.064Z","title":"WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Alessandro Piconi","product":"Simple Keyword to Link","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30981","published":"2025-06-06T12:54:05.463Z","updated":"2026-04-28T16:12:02.886Z","title":"WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"tggfref","product":"WP-Recall","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-30986","published":"2025-06-06T12:54:04.960Z","updated":"2026-04-28T16:12:03.355Z","title":"WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"_CreativeMedia_","product":"Elite Video Player","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-30989","published":"2025-06-06T12:54:04.456Z","updated":"2026-04-28T16:12:02.996Z","title":"WordPress Libro de Reclamaciones y Quejas plugin <= 0.9 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Renzo Tejada","product":"Libro de Reclamaciones y Quejas","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-30990","published":"2025-06-06T12:54:03.984Z","updated":"2026-04-28T16:12:03.130Z","title":"WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeHunk","product":"ThemeHunk","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-30991","published":"2025-06-06T12:54:03.403Z","updated":"2026-04-28T16:12:02.715Z","title":"WordPress Premium Packages plugin <= 6.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shahjada","product":"WPDM – Premium Packages","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-30994","published":"2025-06-06T12:54:02.625Z","updated":"2026-04-28T16:12:03.353Z","title":"WordPress CubeWP plugin <= 1.1.29 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-30995","published":"2025-06-06T12:54:01.042Z","updated":"2026-04-28T16:12:03.290Z","title":"WordPress Widgetize Pages Light plugin <= 3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Widgetize Pages Light","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-30997","published":"2025-06-06T12:54:00.439Z","updated":"2026-04-28T16:12:03.328Z","title":"WordPress Car Repair Services theme <= 5.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SmartDataSoft","product":"Car Repair Services","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-30999","published":"2025-06-06T12:53:59.939Z","updated":"2026-04-28T16:12:03.275Z","title":"WordPress External Store for Shopify plugin <= 1.5.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Fahad Mahmood","product":"External Store for Shopify","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-31000","published":"2025-06-06T12:53:59.458Z","updated":"2026-04-28T16:12:03.284Z","title":"WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Miguel Fuentes","product":"Payment QR WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-31025","published":"2025-06-06T12:53:58.978Z","updated":"2026-04-28T16:12:03.920Z","title":"WordPress Image Hover Effects Block plugin <= 1.4.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Blocksera","product":"Image Hover Effects Block","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49333","published":"2025-06-06T12:53:58.451Z","updated":"2026-05-12T00:21:44.441Z","title":"WordPress Simple Membership plugin <= 4.6.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-49332","published":"2025-06-06T12:53:57.993Z","updated":"2026-04-28T16:13:01.493Z","title":"WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"codepeople","product":"WP Time Slots Booking Form","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-49329","published":"2025-06-06T12:53:57.531Z","updated":"2026-04-28T16:13:01.678Z","title":"WordPress Store Locator WordPress plugin <= 1.5.2 - Arbitrary File Upload Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Agile Logix","product":"Store Locator WordPress","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-49328","published":"2025-06-06T12:53:57.015Z","updated":"2026-04-28T16:13:01.073Z","title":"WordPress Store Locator WordPress plugin <= 1.5.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Agile Logix","product":"Store Locator WordPress","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-49327","published":"2025-06-06T12:53:56.553Z","updated":"2026-04-28T16:13:01.796Z","title":"WordPress ShortLinks Pro plugin <= 1.0.7 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Ruben Garcia","product":"ShortLinks Pro","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-49326","published":"2025-06-06T12:53:56.115Z","updated":"2026-04-28T16:13:01.339Z","title":"WordPress GamiPress plugin <= 7.4.5 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-49325","published":"2025-06-06T12:53:55.675Z","updated":"2026-04-28T16:13:01.600Z","title":"WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Automattic","product":"Newspack Newsletters","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2025-49324","published":"2025-06-06T12:53:55.229Z","updated":"2026-04-28T16:13:01.324Z","title":"WordPress Job Board Manager plugin <= 2.1.60 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PickPlugins","product":"Job Board Manager","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-49323","published":"2025-06-06T12:53:54.778Z","updated":"2026-04-28T16:13:01.080Z","title":"WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Themefic","product":"Hydra Booking","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-49322","published":"2025-06-06T12:53:54.330Z","updated":"2026-04-28T16:13:01.145Z","title":"WordPress 404 Page by SeedProd < 1.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SeedProd","product":"404 Page by SeedProd","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-49320","published":"2025-06-06T12:53:53.887Z","updated":"2026-04-28T16:13:01.017Z","title":"WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"fraudlabspro","product":"FraudLabs Pro for WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-49318","published":"2025-06-06T12:53:53.437Z","updated":"2026-05-12T00:22:10.688Z","title":"WordPress WPtouch plugin <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WPtouch","product":"WPtouch","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-49317","published":"2025-06-06T12:53:52.974Z","updated":"2026-04-28T16:13:00.805Z","title":"WordPress WP Page Loading plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"NTC","product":"WP Page Loading","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49315","published":"2025-06-06T12:53:52.486Z","updated":"2026-04-28T16:13:00.796Z","title":"WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"PersianScript","product":"Persian Woocommerce SMS","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-49314","published":"2025-06-06T12:53:51.977Z","updated":"2026-04-28T16:13:00.722Z","title":"WordPress BRW plugin <= 1.8.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ovatheme","product":"BRW","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49313","published":"2025-06-06T12:53:51.516Z","updated":"2026-04-28T16:13:00.764Z","title":"WordPress BRW plugin <= 1.8.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"ovatheme","product":"BRW","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-49311","published":"2025-06-06T12:53:51.061Z","updated":"2026-04-28T16:13:00.789Z","title":"WordPress The Events Calendar Countdown Addon plugin <= 1.4.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CoolHappy","product":"The Events Calendar Countdown Addon","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49310","published":"2025-06-06T12:53:50.605Z","updated":"2026-04-28T16:13:00.736Z","title":"WordPress Frontend Dashboard plugin <= 2.2.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"M A Vinoth Kumar","product":"Frontend Dashboard","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49309","published":"2025-06-06T12:53:50.147Z","updated":"2026-04-28T16:13:00.717Z","title":"WordPress HT Team Member plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HT Plugins","product":"HT Team Member","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49308","published":"2025-06-06T12:53:49.689Z","updated":"2026-04-28T16:13:00.743Z","title":"WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Travel Engine","product":"WP Travel Engine","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-49307","published":"2025-06-06T12:53:49.237Z","updated":"2026-04-28T16:13:00.737Z","title":"WordPress WP Multilang plugin <= 2.4.19 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Magazine3","product":"WP Multilang","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-49306","published":"2025-06-06T12:53:48.782Z","updated":"2026-04-28T16:13:00.786Z","title":"WordPress WP Social Widget plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"catchsquare","product":"WP Social Widget","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-49305","published":"2025-06-06T12:53:48.326Z","updated":"2026-04-28T16:13:00.753Z","title":"WordPress Product Catalog Simple plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"impleCode","product":"Product Catalog Simple","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49304","published":"2025-06-06T12:53:47.873Z","updated":"2026-04-28T16:13:00.794Z","title":"WordPress Search with Typesense plugin <= 2.0.10 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodeManas","product":"Search with Typesense","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49301","published":"2025-06-06T12:53:47.422Z","updated":"2026-04-28T16:13:00.563Z","title":"WordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpsoul","product":"Greenshift","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49299","published":"2025-06-06T12:53:46.964Z","updated":"2026-04-28T16:13:00.294Z","title":"WordPress WebHotelier plugin <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPlugged.com","product":"WebHotelier","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49298","published":"2025-06-06T12:53:46.507Z","updated":"2026-04-28T16:13:00.356Z","title":"WordPress Event post plugin <= 5.10.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bastien Ho","product":"Event post","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49294","published":"2025-06-06T12:53:46.025Z","updated":"2026-04-28T16:13:00.329Z","title":"WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Sensitive Data Exposure via Log Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CodeRevolution","product":"Crawlomatic Multisite Scraper Post Generator","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-49293","published":"2025-06-06T12:53:45.575Z","updated":"2026-04-28T16:13:00.283Z","title":"WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CodeRevolution","product":"Crawlomatic Multisite Scraper Post Generator","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49292","published":"2025-06-06T12:53:45.090Z","updated":"2026-04-28T16:13:00.354Z","title":"WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-49291","published":"2025-06-06T12:53:44.559Z","updated":"2026-04-28T16:13:00.350Z","title":"WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"codepeople","product":"Calculated Fields Form","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-49289","published":"2025-06-06T12:53:44.101Z","updated":"2026-04-28T16:13:00.307Z","title":"WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5,"vendor":"add-ons.org","product":"PDF for WPForms","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49288","published":"2025-06-06T12:53:43.649Z","updated":"2026-04-28T16:13:00.304Z","title":"WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability","severity":"HIGH","score":8.8,"vendor":"Rustaurius","product":"Ultimate WP Mail","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-49287","published":"2025-06-06T12:53:43.203Z","updated":"2026-04-28T16:13:00.292Z","title":"WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebToffee","product":"Product Feed for WooCommerce","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-49286","published":"2025-06-06T12:53:42.738Z","updated":"2026-04-28T16:13:00.340Z","title":"WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Table Builder","product":"WP Table Builder","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49285","published":"2025-06-06T12:53:42.278Z","updated":"2026-04-28T16:13:00.200Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49284","published":"2025-06-06T12:53:41.826Z","updated":"2026-04-28T16:13:00.215Z","title":"WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wp-buy","product":"WP Maintenance Mode & Site Under Construction","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49283","published":"2025-06-06T12:53:41.363Z","updated":"2026-04-28T16:13:00.018Z","title":"WordPress Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Matthias Nordwig","product":"Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49273","published":"2025-06-06T12:53:40.895Z","updated":"2026-04-28T16:12:59.517Z","title":"WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sminozzi","product":"WP Tools","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49272","published":"2025-06-06T12:53:40.416Z","updated":"2026-04-28T16:12:59.549Z","title":"WordPress Trinity Audio plugin <= 5.20.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sergiotrinity","product":"Trinity Audio","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49270","published":"2025-06-06T12:53:39.962Z","updated":"2026-04-28T16:12:59.516Z","title":"WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mario Peshev","product":"WP-CRM System","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-49269","published":"2025-06-06T12:53:39.500Z","updated":"2026-04-28T16:12:59.769Z","title":"WordPress Market Exporter plugin <= 2.0.22 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Anton Vanyukov","product":"Market Exporter","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49268","published":"2025-06-06T12:53:39.044Z","updated":"2026-04-28T16:12:59.457Z","title":"WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Soft8Soft LLC","product":"Verge3D","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-49263","published":"2025-06-06T12:53:38.578Z","updated":"2026-04-28T16:12:59.801Z","title":"WordPress WC Vendors Marketplace plugin <= 2.5.6 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"WCVendors","product":"WC Vendors Marketplace","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-49262","published":"2025-06-06T12:53:38.113Z","updated":"2026-04-28T16:12:59.442Z","title":"WordPress Sina Extension for Elementor plugin <= 3.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.6,"vendor":"shaonsina","product":"Sina Extension for Elementor","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49250","published":"2025-06-06T12:53:37.649Z","updated":"2026-04-28T16:12:58.969Z","title":"WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cmoreira","product":"Team Showcase","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-49248","published":"2025-06-06T12:53:37.200Z","updated":"2026-04-28T16:12:59.088Z","title":"WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cmoreira","product":"Team Showcase","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49246","published":"2025-06-06T12:53:36.737Z","updated":"2026-05-12T00:21:57.928Z","title":"WordPress Testimonials Showcase plugin <= 1.9.16 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cmoreira","product":"Testimonials Showcase","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-49244","published":"2025-06-06T12:53:36.275Z","updated":"2026-05-12T00:22:04.252Z","title":"WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vova","product":"Shortcodes Ultimate","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49243","published":"2025-06-06T12:53:35.789Z","updated":"2026-04-28T16:12:58.990Z","title":"WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sevenspark","product":"ShiftNav – Responsive Mobile Menu","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49242","published":"2025-06-06T12:53:35.336Z","updated":"2026-05-12T00:21:37.536Z","title":"WordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sevenspark","product":"Bellows Accordion Menu","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49241","published":"2025-06-06T12:53:34.877Z","updated":"2026-04-28T16:12:58.985Z","title":"WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-49240","published":"2025-06-06T12:53:34.419Z","updated":"2026-04-28T16:12:58.924Z","title":"WordPress DocsPress plugin <= 2.5.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"nK","product":"DocsPress","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-49239","published":"2025-06-06T12:53:33.930Z","updated":"2026-04-28T16:12:58.940Z","title":"WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"tychesoftwares","product":"Print Invoice & Delivery Notes for WooCommerce","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-49238","published":"2025-06-06T12:53:33.458Z","updated":"2026-05-12T00:21:51.385Z","title":"WordPress Everest Backup plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-49237","published":"2025-06-06T12:53:32.991Z","updated":"2026-04-28T16:12:58.960Z","title":"WordPress POEditor plugin <= 0.9.10 - CSRF to Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"POEditor","product":"POEditor","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-49236","published":"2025-06-06T12:53:32.500Z","updated":"2026-04-28T16:12:58.995Z","title":"WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"raychat","product":"Raychat","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-49235","published":"2025-06-06T12:53:31.801Z","updated":"2026-04-28T16:12:58.916Z","title":"WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rometheme","product":"RTMKit","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-49072","published":"2025-06-06T12:15:02.441Z","updated":"2026-04-28T16:12:58.629Z","title":"WordPress Mr. Murphy < 1.2.12.1 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Mr. Murphy","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-49073","published":"2025-06-06T12:13:28.749Z","updated":"2026-04-28T16:12:58.616Z","title":"WordPress Sweet Dessert < 1.1.13 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Sweet Dessert","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-48329","published":"2025-06-06T11:48:58.610Z","updated":"2026-04-28T16:12:56.247Z","title":"WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Daman Jeet","product":"Real Time Validation for Gravity Forms","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-39358","published":"2025-06-06T11:47:13.485Z","updated":"2026-04-29T09:51:54.967Z","title":"WordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"teastudio.pl","product":"WP Posts Carousel","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-47584","published":"2025-06-06T11:45:34.759Z","updated":"2026-04-28T16:12:45.849Z","title":"WordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-47586","published":"2025-06-06T11:41:13.679Z","updated":"2026-04-28T16:12:46.415Z","title":"WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability","severity":"CRITICAL","score":9,"vendor":"StylemixThemes","product":"Motors - Events","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2025-48335","published":"2025-06-06T11:38:58.595Z","updated":"2026-04-28T16:12:56.644Z","title":"WordPress Responsive Plus plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"CyberChimps","product":"Responsive Plus","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-48328","published":"2025-06-06T11:37:51.862Z","updated":"2026-05-12T00:22:23.560Z","title":"WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Daman Jeet","product":"Real Time Validation for Gravity Forms","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-49076","published":"2025-06-06T11:36:40.429Z","updated":"2026-04-28T16:12:58.735Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-49075","published":"2025-06-06T11:35:32.895Z","updated":"2026-04-28T16:12:58.574Z","title":"WordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PickPlugins","product":"Wishlist","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-49074","published":"2025-06-06T11:34:21.081Z","updated":"2026-04-28T16:12:58.549Z","title":"WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Abu Huraira Bin Aman","product":"WidgetKit","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-49068","published":"2025-06-06T11:32:21.762Z","updated":"2026-04-28T16:12:58.698Z","title":"WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"oceanwp","product":"Ocean Extra","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49067","published":"2025-06-06T11:31:20.491Z","updated":"2026-04-28T16:12:58.559Z","title":"WordPress Nasa Core plugin < 6.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NasaTheme","product":"Nasa Core","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-49077","published":"2025-06-06T11:18:47.844Z","updated":"2026-04-28T16:12:58.772Z","title":"WordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeHigh","product":"Dynamic Pricing and Discount Rules","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-48337","published":"2025-06-06T11:15:24.081Z","updated":"2026-04-28T16:12:56.638Z","title":"WordPress QuickCab plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"QuickcabWP","product":"QuickCab","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-48133","published":"2025-06-05T20:49:14.279Z","updated":"2026-04-28T16:12:52.328Z","title":"WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-46258","published":"2025-06-05T17:36:05.036Z","updated":"2026-04-28T16:12:37.108Z","title":"WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"BdThemes","product":"Element Pack Pro","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-46257","published":"2025-06-05T17:35:20.616Z","updated":"2026-04-28T16:12:37.097Z","title":"WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BdThemes","product":"Element Pack Pro","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-47585","published":"2025-06-02T19:29:20.093Z","updated":"2026-04-28T16:12:46.296Z","title":"WordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-49069","published":"2025-06-02T18:49:25.588Z","updated":"2026-04-28T16:12:58.612Z","title":"WordPress Contact Forms by Cimatti plugin <= 1.9.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"cimatti","product":"Contact Forms by Cimatti","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-48331","published":"2025-05-30T14:01:38.968Z","updated":"2026-04-28T16:12:56.597Z","title":"WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"vanquish","product":"WooCommerce Orders & Customers Exporter","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-48334","published":"2025-05-30T08:42:56.425Z","updated":"2026-04-28T16:12:56.711Z","title":"WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BinaryCarpenter","product":"Woo Slider Pro","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2025-48336","published":"2025-05-29T18:54:34.068Z","updated":"2026-04-28T16:12:56.717Z","title":"WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThimPress","product":"Course Builder","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2025-3704","published":"2025-05-27T14:39:32.084Z","updated":"2026-04-28T16:12:29.217Z","title":"WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"DBAR Productions","product":"Volunteer Sign Up Sheets","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-39498","published":"2025-05-26T14:05:22.053Z","updated":"2026-04-28T16:12:32.978Z","title":"WordPress Spotlight - Social Media Feeds (Premium) plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spotlight","product":"Spotlight - Social Media Feeds (Premium)","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31049","published":"2025-05-23T12:44:10.106Z","updated":"2026-04-28T16:12:04.313Z","title":"WordPress Dash <= 1.3 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"Dash","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-31053","published":"2025-05-23T12:44:09.619Z","updated":"2026-04-28T16:12:04.314Z","title":"WordPress KBx Pro Ultimate plugin < 8.0.5 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":7.7,"vendor":"quantumcloud","product":"KBx Pro Ultimate","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2025-31056","published":"2025-05-23T12:44:09.140Z","updated":"2026-04-28T16:12:04.362Z","title":"WordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Techspawn","product":"WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-31060","published":"2025-05-23T12:44:08.676Z","updated":"2026-04-28T16:12:04.355Z","title":"WordPress Capie theme <= 1.0.40 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Capie","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31064","published":"2025-05-23T12:44:08.191Z","updated":"2026-04-28T16:12:04.568Z","title":"WordPress Vizeon theme < 1.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Vizeon - Business Consulting","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31069","published":"2025-05-23T12:44:07.712Z","updated":"2026-04-28T16:12:04.642Z","title":"WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"HotStar – Multi-Purpose Business Theme","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-31397","published":"2025-05-23T12:44:07.240Z","updated":"2026-04-28T16:12:06.488Z","title":"WordPress Bus Ticket Booking with Seat Reservation for WooCommerce plugin <= 1.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"smartcms","product":"Bus Ticket Booking with Seat Reservation for WooCommerce","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2025-31423","published":"2025-05-23T12:44:06.784Z","updated":"2026-04-28T16:12:06.875Z","title":"WordPress Umberto theme <= 1.2.8 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Umberto","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-31430","published":"2025-05-23T12:44:06.320Z","updated":"2026-04-28T16:12:06.910Z","title":"WordPress The Business <= 1.6.1 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"The Business","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-31631","published":"2025-05-23T12:44:05.860Z","updated":"2026-04-28T16:12:10.748Z","title":"WordPress Fish House theme <= 1.2.7 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Fish House","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-31632","published":"2025-05-23T12:44:05.394Z","updated":"2026-04-28T16:12:10.743Z","title":"WordPress La Boom <= 2.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"SpyroPress","product":"La Boom","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31633","published":"2025-05-23T12:44:04.939Z","updated":"2026-04-28T16:12:10.734Z","title":"WordPress Kiamo - Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Kiamo - Responsive Business Service WordPress Theme","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31636","published":"2025-05-23T12:44:04.482Z","updated":"2026-04-28T16:12:10.791Z","title":"WordPress WP Post Modules for Elementor plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SaurabhSharma","product":"WP Post Modules for Elementor","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-31912","published":"2025-05-23T12:44:04.027Z","updated":"2026-04-28T16:12:16.075Z","title":"WordPress Enzio - Responsive Business WordPress Theme theme < 1.2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Enzio - Responsive Business WordPress Theme","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31913","published":"2025-05-23T12:44:03.548Z","updated":"2026-04-28T16:12:16.247Z","title":"WordPress Ogami theme <= 1.53 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Ogami","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-31914","published":"2025-05-23T12:44:03.050Z","updated":"2026-04-28T16:12:16.213Z","title":"WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"kamleshyadav","product":"Pixel WordPress Form BuilderPlugin & Autoresponder","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-31916","published":"2025-05-23T12:44:02.503Z","updated":"2026-04-28T16:12:16.256Z","title":"WordPress JP Students Result Management System Premium plugin 1.1.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"joy2012bd","product":"JP Students Result Management System Premium","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-31918","published":"2025-05-23T12:44:01.823Z","updated":"2026-05-12T00:21:10.155Z","title":"WordPress Simple Business Directory Pro plugin < 15.6.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"quantumcloud","product":"Simple Business Directory Pro","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2025-31924","published":"2025-05-23T12:44:01.125Z","updated":"2026-05-12T00:21:03.282Z","title":"WordPress Crafts & Arts theme <= 2.5 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Crafts & Arts","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-31927","published":"2025-05-23T12:44:00.642Z","updated":"2026-04-28T16:12:16.386Z","title":"WordPress Acerola <= 1.6.5 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themeton","product":"Acerola","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-32284","published":"2025-05-23T12:44:00.122Z","updated":"2026-04-28T16:12:20.850Z","title":"WordPress Pet World theme <= 2.8 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Pet World","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32285","published":"2025-05-23T12:43:59.597Z","updated":"2026-04-28T16:12:20.651Z","title":"WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ApusTheme","product":"Butcher","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-32286","published":"2025-05-23T12:43:59.141Z","updated":"2026-04-28T16:12:20.627Z","title":"WordPress Butcher theme <= 2.40 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Butcher","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-32289","published":"2025-05-23T12:43:58.677Z","updated":"2026-05-12T00:20:56.207Z","title":"WordPress Yozi theme <= 2.0.63 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ApusTheme","product":"Yozi","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-32292","published":"2025-05-23T12:43:58.217Z","updated":"2026-04-28T16:12:21.018Z","title":"WordPress Jarvis – Night Club, Concert, Festival WordPress theme <= 1.8.11 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Jarvis – Night Club, Concert, Festival WordPress","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-32293","published":"2025-05-23T12:43:57.752Z","updated":"2026-04-28T16:12:21.362Z","title":"WordPress Finance Consultant theme <= 2.8 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"designthemes","product":"Finance Consultant","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32294","published":"2025-05-23T12:43:57.281Z","updated":"2026-04-28T16:12:21.226Z","title":"WordPress Oxpitan theme <= 1.3.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Oxpitan","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-32302","published":"2025-05-23T12:43:56.808Z","updated":"2026-04-28T16:12:21.675Z","title":"WordPress Winnex theme <= 1.3.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"gavias","product":"Winnex","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-32309","published":"2025-05-23T12:43:56.345Z","updated":"2026-04-28T16:12:21.815Z","title":"WordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeMove","product":"Healsoul","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-39480","published":"2025-05-23T12:43:55.871Z","updated":"2026-04-28T16:12:32.334Z","title":"WordPress Car Dealer theme < 1.6.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeMakers","product":"Car Dealer","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39485","published":"2025-05-23T12:43:55.410Z","updated":"2026-04-28T16:12:32.633Z","title":"WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Tour","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39489","published":"2025-05-23T12:43:54.956Z","updated":"2026-04-28T16:12:32.624Z","title":"WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"pebas","product":"CouponXL","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2025-39490","published":"2025-05-23T12:43:54.481Z","updated":"2026-04-28T16:12:32.701Z","title":"WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Backpack Traveler","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-39494","published":"2025-05-23T12:43:54.021Z","updated":"2026-04-28T16:12:32.827Z","title":"WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Wilmër","kev":false,"epss":0.00737,"kevAdded":null},{"id":"CVE-2025-39495","published":"2025-05-23T12:43:53.570Z","updated":"2026-04-28T16:12:32.853Z","title":"WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Avantage","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39499","published":"2025-05-23T12:43:53.107Z","updated":"2026-04-28T16:12:32.987Z","title":"WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Medicare","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39500","published":"2025-05-23T12:43:52.651Z","updated":"2026-04-28T16:12:32.970Z","title":"WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"GoodLayers","product":"Goodlayers Hostel","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39501","published":"2025-05-23T12:43:52.186Z","updated":"2026-05-12T00:19:14.986Z","title":"WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"GoodLayers","product":"Goodlayers Hostel","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-39502","published":"2025-05-23T12:43:51.701Z","updated":"2026-04-28T16:12:32.989Z","title":"WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GoodLayers","product":"Goodlayers Hostel","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-39503","published":"2025-05-23T12:43:51.237Z","updated":"2026-04-28T16:12:32.965Z","title":"WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"GoodLayers","product":"Goodlayers Hotel","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-39504","published":"2025-05-23T12:43:50.777Z","updated":"2026-04-28T16:12:33.144Z","title":"WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"GoodLayers","product":"Goodlayers Hotel","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2025-39505","published":"2025-05-23T12:43:50.263Z","updated":"2026-04-28T16:12:32.993Z","title":"WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GoodLayers","product":"Goodlayers Hotel","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-39506","published":"2025-05-23T12:43:49.805Z","updated":"2026-04-28T16:12:33.291Z","title":"WordPress Nasa Core Plugin <= 6.3.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"NasaTheme","product":"Nasa Core","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-39536","published":"2025-05-23T12:43:49.339Z","updated":"2026-04-28T16:12:34.239Z","title":"WordPress JobHunt Job Alerts <= 3.6 - Arbitrary Content Deletion Vulnerability","severity":"HIGH","score":8.2,"vendor":"Chimpstudio","product":"JobHunt Job Alerts","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-46437","published":"2025-05-23T12:43:48.870Z","updated":"2026-04-28T16:12:37.499Z","title":"WordPress Tayori Form plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tayoricom","product":"Tayori Form","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46440","published":"2025-05-23T12:43:48.408Z","updated":"2026-05-12T00:19:55.147Z","title":"WordPress kStats Reloaded plugin <= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mark","product":"kStats Reloaded","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46444","published":"2025-05-23T12:43:47.879Z","updated":"2026-04-28T16:12:37.639Z","title":"WordPress Ads Pro plugin <= 4.89 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"scripteo","product":"Ads Pro","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-46446","published":"2025-05-23T12:43:47.397Z","updated":"2026-04-28T16:12:37.577Z","title":"WordPress Libro de Reclamaciones plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ivanrojas","product":"Libro de Reclamaciones","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46448","published":"2025-05-23T12:43:46.932Z","updated":"2026-05-12T00:19:48.754Z","title":"WordPress Document Management System plugin <= 1.24 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"reifsnyderb","product":"Document Management System","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46454","published":"2025-05-23T12:43:46.472Z","updated":"2026-04-28T16:12:37.681Z","title":"WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"svil4ok","product":"Meta Keywords & Description","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2025-46455","published":"2025-05-23T12:43:46.010Z","updated":"2026-04-28T16:12:37.853Z","title":"WordPress WP HRM LITE plugin <= 1.1 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"IndigoThemes","product":"WP HRM LITE","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2025-46456","published":"2025-05-23T12:43:45.525Z","updated":"2026-04-28T16:12:37.810Z","title":"WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jason","product":"Theme Blvd Sliders","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46458","published":"2025-05-23T12:43:44.578Z","updated":"2026-05-12T00:19:22.016Z","title":"WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"x000x","product":"occupancyplan","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-46460","published":"2025-05-23T12:43:44.106Z","updated":"2026-05-12T00:19:35.379Z","title":"WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Detheme","product":"Easy Guide","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2025-46463","published":"2025-05-23T12:43:43.644Z","updated":"2026-04-28T16:12:37.969Z","title":"WordPress Mailing Group Listserv plugin <= 3.0.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Yamna Khawaja","product":"Mailing Group Listserv","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-46468","published":"2025-05-23T12:43:43.121Z","updated":"2026-04-28T16:12:38.842Z","title":"WordPress Fable Extra plugin <= 1.0.6 - Local File Inclusion Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPFable","product":"Fable Extra","kev":false,"epss":0.00637,"kevAdded":null},{"id":"CVE-2025-46474","published":"2025-05-23T12:43:42.660Z","updated":"2026-04-28T16:12:38.585Z","title":"WordPress SEUR Oficial plugin <= 2.2.23 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"SEUR OFICIAL","product":"SEUR Oficial","kev":false,"epss":0.00795,"kevAdded":null},{"id":"CVE-2025-46486","published":"2025-05-23T12:43:42.164Z","updated":"2026-05-12T00:19:28.492Z","title":"WordPress Nomupay Payment Processing Gateway plugin <= 7.1.7 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"totalprocessing","product":"Nomupay Payment Processing Gateway","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-46487","published":"2025-05-23T12:43:41.701Z","updated":"2026-04-28T16:12:39.241Z","title":"WordPress EC Authorize.net plugin <=  0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"sftranna","product":"EC Authorize.net","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46488","published":"2025-05-23T12:43:41.239Z","updated":"2026-05-12T00:19:42.298Z","title":"WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"dastan800","product":"Visual Builder","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-46490","published":"2025-05-23T12:43:40.781Z","updated":"2026-04-28T16:12:39.320Z","title":"WordPress Crossword Compiler Puzzles plugin <= 5.2 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"wordwebsoftware","product":"Crossword Compiler Puzzles","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-46493","published":"2025-05-23T12:43:40.330Z","updated":"2026-04-28T16:12:39.208Z","title":"WordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wordwebsoftware","product":"Crossword Compiler Puzzles","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-46515","published":"2025-05-23T12:43:39.839Z","updated":"2026-04-28T16:12:39.785Z","title":"WordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"M A Vinoth Kumar","product":"Category Widget","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46518","published":"2025-05-23T12:43:39.386Z","updated":"2026-04-28T16:12:39.782Z","title":"WordPress IGIT Related Posts With Thumb Image After Posts plugin <=  4.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"phpaddicted","product":"IGIT Related Posts With Thumb Image After Posts","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-46526","published":"2025-05-23T12:43:38.920Z","updated":"2026-04-28T16:12:40.180Z","title":"WordPress My Custom Widgets plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"janekniefeldt","product":"My Custom Widgets","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46527","published":"2025-05-23T12:43:38.441Z","updated":"2026-04-28T16:12:40.113Z","title":"WordPress Web3Press – Decentralize Publishing with Writing NFT plugin <= 3.2.0 - Arbitrary File Read vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LikeCoin","product":"Web3Press","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-46537","published":"2025-05-23T12:43:37.977Z","updated":"2026-04-28T16:12:40.110Z","title":"WordPress Section Widget plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ctltwp","product":"Section Widget","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46539","published":"2025-05-23T12:43:37.504Z","updated":"2026-04-28T16:12:40.164Z","title":"WordPress Fable Extra plugin <= 1.0.6 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFable","product":"Fable Extra","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2025-47438","published":"2025-05-23T12:43:37.020Z","updated":"2026-04-29T09:51:55.323Z","title":"WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2025-47453","published":"2025-05-23T12:43:36.560Z","updated":"2026-04-28T16:12:41.428Z","title":"WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Xylus Themes","product":"WP Smart Import","kev":false,"epss":0.00737,"kevAdded":null},{"id":"CVE-2025-47458","published":"2025-05-23T12:43:36.084Z","updated":"2026-04-28T16:12:41.294Z","title":"WordPress B2i Investor Tools plugin <= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"B2itech","product":"B2i Investor Tools","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-47461","published":"2025-05-23T12:43:35.572Z","updated":"2026-05-12T00:20:15.564Z","title":"WordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability","severity":"HIGH","score":8.8,"vendor":"mediaticus","product":"Subaccounts for WooCommerce","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2025-47478","published":"2025-05-23T12:43:35.084Z","updated":"2026-04-28T16:12:42.337Z","title":"WordPress ProfileGrid  plugin <= 5.9.5.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-47492","published":"2025-05-23T12:43:34.629Z","updated":"2026-04-28T16:12:42.737Z","title":"WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"add-ons.org","product":"Drag and Drop File Upload for Elementor Forms","kev":false,"epss":0.01482,"kevAdded":null},{"id":"CVE-2025-47512","published":"2025-05-23T12:43:34.169Z","updated":"2026-04-28T16:12:43.569Z","title":"WordPress Tainacan plugin <=  0.21.14 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"tainacan","product":"Tainacan","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2025-47513","published":"2025-05-23T12:43:33.704Z","updated":"2026-04-28T16:12:43.374Z","title":"WordPress Infocob CRM Forms plugin <= 2.4.0 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"James Laforge","product":"Infocob CRM Forms","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2025-47529","published":"2025-05-23T12:43:33.241Z","updated":"2026-04-28T16:12:44.159Z","title":"WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UX Design Experts","product":"Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-47530","published":"2025-05-23T12:43:32.783Z","updated":"2026-04-28T16:12:44.125Z","title":"WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-47532","published":"2025-05-23T12:43:32.317Z","updated":"2026-05-12T00:20:35.926Z","title":"WordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CoinPayments","product":"CoinPayments.net Payment Gateway for WooCommerce","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-47535","published":"2025-05-23T12:43:31.842Z","updated":"2026-04-28T16:12:44.332Z","title":"WordPress Opal Woo Custom Product Variation plugin <= 1.2.0 - Arbitrary File Deletion Vulnerability","severity":"HIGH","score":8.6,"vendor":"wpopal","product":"Opal Woo Custom Product Variation","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-47539","published":"2025-05-23T12:43:31.396Z","updated":"2026-04-28T16:12:44.335Z","title":"WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.25447,"kevAdded":null},{"id":"CVE-2025-47541","published":"2025-05-23T12:43:30.943Z","updated":"2026-04-29T09:51:55.529Z","title":"WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability","severity":"HIGH","score":7.5,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-47558","published":"2025-05-23T12:43:30.469Z","updated":"2026-04-28T16:12:44.874Z","title":"WordPress MapSVG plugin < 8.6.13 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-47568","published":"2025-05-23T12:43:29.996Z","updated":"2026-04-28T16:12:44.989Z","title":"WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ZoomIt","product":"ZoomSounds","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-47575","published":"2025-05-23T12:43:29.529Z","updated":"2026-04-28T16:12:45.755Z","title":"WordPress School Management plugin <= 92.0.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"mojoomla","product":"School Management","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-47599","published":"2025-05-23T12:43:29.064Z","updated":"2026-04-28T16:12:46.856Z","title":"WordPress Facturante plugin <= 1.11 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"facturante","product":"Facturante","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-47603","published":"2025-05-23T12:43:28.598Z","updated":"2026-05-12T00:20:09.065Z","title":"WordPress belingoGeo plugin <= 1.12.0 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"Belingo","product":"belingoGeo","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2025-47611","published":"2025-05-23T12:43:28.136Z","updated":"2026-04-28T16:12:46.929Z","title":"WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Khaled","product":"User Meta","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-47613","published":"2025-05-23T12:43:27.686Z","updated":"2026-04-28T16:12:47.043Z","title":"WordPress School Management System for Wordpress plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mojoomla","product":"School Management","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-47618","published":"2025-05-23T12:43:27.223Z","updated":"2026-04-29T09:51:55.321Z","title":"WordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mortgage Calculator","product":"BMI Adult & Kid Calculator","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-47619","published":"2025-05-23T12:43:26.758Z","updated":"2026-05-12T00:20:29.450Z","title":"WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"6Storage","product":"6Storage Rentals","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-47631","published":"2025-05-23T12:43:26.234Z","updated":"2026-04-28T16:12:47.403Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2025-47637","published":"2025-05-23T12:43:25.383Z","updated":"2026-04-28T16:12:47.895Z","title":"WordPress STAGGS plugin <= 2.11.0 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"STAGGS","product":"STAGGS","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-47640","published":"2025-05-23T12:43:24.927Z","updated":"2026-04-28T16:12:48.215Z","title":"WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"printcart","product":"Printcart Web to Print Product Designer for WooCommerce","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-47641","published":"2025-05-23T12:43:24.460Z","updated":"2026-04-28T16:12:47.929Z","title":"WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.3.9 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"printcart","product":"Printcart Web to Print Product Designer for WooCommerce","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-47642","published":"2025-05-23T12:43:23.982Z","updated":"2026-04-28T16:12:47.896Z","title":"WordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"Ajar Productions","product":"Ajar in5 Embed","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-47646","published":"2025-05-23T12:43:23.517Z","updated":"2026-04-29T09:51:55.265Z","title":"WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Gilblas Ngunte Possi","product":"PSW Front-end Login & Registration","kev":false,"epss":0.24718,"kevAdded":null},{"id":"CVE-2025-47658","published":"2025-05-23T12:43:23.046Z","updated":"2026-05-12T00:20:22.531Z","title":"WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"ELEXtensions","product":"ELEX WordPress HelpDesk & Customer Ticketing System","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-47660","published":"2025-05-23T12:43:22.575Z","updated":"2026-04-28T16:12:48.580Z","title":"WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Codexpert, Inc","product":"WC Affiliate","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-47663","published":"2025-05-23T12:43:22.108Z","updated":"2026-04-28T16:12:49.615Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47670","published":"2025-05-23T12:43:21.642Z","updated":"2026-04-28T16:12:49.087Z","title":"WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-47671","published":"2025-05-23T12:43:21.167Z","updated":"2026-04-28T16:12:48.890Z","title":"WordPress Binary MLM Plan plugin <= 3.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"LETSCMS MLM Software","product":"Binary MLM Plan","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-47672","published":"2025-05-23T12:43:20.654Z","updated":"2026-04-28T16:12:49.047Z","title":"WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"miniOrange","product":"miniOrange Discord Integration","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-47673","published":"2025-05-23T12:43:20.166Z","updated":"2026-04-28T16:12:49.099Z","title":"WordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tychesoftwares","product":"Arconix Shortcodes","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-47678","published":"2025-05-23T12:43:19.709Z","updated":"2026-05-12T00:20:02.254Z","title":"WordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FunnelCockpit","product":"FunnelCockpit","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-47680","published":"2025-05-23T12:43:19.228Z","updated":"2026-04-28T16:12:49.579Z","title":"WordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Michel - xiligroup dev","product":"xili-tidy-tags","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-47687","published":"2025-05-23T12:43:18.746Z","updated":"2026-04-28T16:12:49.681Z","title":"WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"StoreKeeper B.V.","product":"StoreKeeper for WooCommerce","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-47690","published":"2025-05-23T12:43:18.277Z","updated":"2026-04-28T16:12:50.142Z","title":"WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Smackcoders Inc.,","product":"Lead Form Data Collection to CRM","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2025-48241","published":"2025-05-23T12:43:17.808Z","updated":"2026-04-28T16:12:53.704Z","title":"WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Soft8Soft LLC","product":"Verge3D","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-48245","published":"2025-05-23T12:43:17.321Z","updated":"2026-04-28T16:12:53.692Z","title":"WordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"Quick Contact Form","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-48271","published":"2025-05-23T12:43:16.869Z","updated":"2026-04-28T16:12:54.376Z","title":"WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leadinfo","product":"Leadinfo","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-48273","published":"2025-05-23T12:43:16.413Z","updated":"2026-05-12T00:20:49.289Z","title":"WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-48275","published":"2025-05-23T12:43:15.964Z","updated":"2026-04-28T16:12:54.840Z","title":"WordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dastan800","product":"Visual Header","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-48283","published":"2025-05-23T12:43:15.502Z","updated":"2026-04-28T16:12:55.133Z","title":"WordPress Majestic Support plugin <= 1.1.0 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-48286","published":"2025-05-23T12:43:15.038Z","updated":"2026-04-28T16:12:55.175Z","title":"WordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"catkin","product":"ReDi Restaurant Reservation","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-48287","published":"2025-05-23T12:43:14.537Z","updated":"2026-04-28T16:12:55.336Z","title":"WordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Pagaleve","product":"Pix 4x sem juros - Pagaleve","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-48289","published":"2025-05-23T12:43:14.067Z","updated":"2026-04-28T16:12:55.228Z","title":"WordPress Kids Planet theme <= 2.2.14 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Kids Planet","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-48292","published":"2025-05-23T12:43:13.593Z","updated":"2026-05-12T00:20:42.338Z","title":"WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"GoodLayers","product":"Tourmaster","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-48340","published":"2025-05-19T20:33:06.741Z","updated":"2026-04-28T16:12:56.780Z","title":"WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Danny Vink","product":"User Profile Meta Manager","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-31027","published":"2025-05-19T19:59:43.260Z","updated":"2026-04-28T16:12:03.912Z","title":"WordPress Tiger theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jocoxdesign","product":"Tiger","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2025-32924","published":"2025-05-19T19:57:42.192Z","updated":"2026-04-28T16:12:28.943Z","title":"WordPress Revy plugin <= 2.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"roninwp","product":"Revy","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32925","published":"2025-05-19T19:56:57.237Z","updated":"2026-04-28T16:12:29.202Z","title":"WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.3,"vendor":"FantasticPlugins","product":"SUMO Reward Points","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-32926","published":"2025-05-19T19:55:38.253Z","updated":"2026-05-12T00:19:08.461Z","title":"WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2025-32927","published":"2025-05-19T19:54:47.090Z","updated":"2026-04-28T16:12:28.914Z","title":"WordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Chimpstudio","product":"FoodBakery","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-32928","published":"2025-05-19T19:53:26.530Z","updated":"2026-04-28T16:12:28.970Z","title":"WordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Altair","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-39348","published":"2025-05-19T19:52:27.046Z","updated":"2026-04-28T16:12:29.130Z","title":"WordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-39349","published":"2025-05-19T19:51:03.916Z","updated":"2026-04-28T16:12:29.316Z","title":"WordPress CiyaShop theme <= 4.18.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Potenzaglobalsolutions","product":"CiyaShop","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-39350","published":"2025-05-19T19:50:15.064Z","updated":"2026-04-28T16:12:29.328Z","title":"WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability","severity":"HIGH","score":8.2,"vendor":"Rocket Apps","product":"wProject","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-39352","published":"2025-05-19T19:49:17.818Z","updated":"2026-04-28T16:12:29.329Z","title":"WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability","severity":"HIGH","score":8.2,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-39354","published":"2025-05-19T19:48:09.530Z","updated":"2026-04-28T16:12:29.330Z","title":"WordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Grand Conference","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-39355","published":"2025-05-19T19:46:07.807Z","updated":"2026-04-28T16:12:29.346Z","title":"WordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"roninwp","product":"FAT Services Booking","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-39356","published":"2025-05-19T19:45:18.969Z","updated":"2026-04-28T16:12:29.365Z","title":"WordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Chimpstudio","product":"Foodbakery Sticky Cart","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-39357","published":"2025-05-19T19:43:44.537Z","updated":"2026-04-28T16:12:29.430Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-46441","published":"2025-05-19T19:42:37.039Z","updated":"2026-04-28T16:12:37.423Z","title":"WordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ctltwp","product":"Section Widget","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-39365","published":"2025-05-19T19:40:23.473Z","updated":"2026-04-28T16:12:29.567Z","title":"WordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rocket Apps","product":"wProject","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39366","published":"2025-05-19T19:39:18.593Z","updated":"2026-04-28T16:12:29.565Z","title":"WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Rocket Apps","product":"wProject","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2025-39372","published":"2025-05-19T19:38:06.046Z","updated":"2026-04-28T16:12:29.756Z","title":"WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"elbisnero","product":"WordPress Events Calendar Registration & Tickets","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39380","published":"2025-05-19T19:36:48.363Z","updated":"2026-04-28T16:12:29.796Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-39386","published":"2025-05-19T19:34:11.730Z","updated":"2026-04-28T16:12:29.853Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-39389","published":"2025-05-19T19:31:20.579Z","updated":"2026-04-28T16:12:30.242Z","title":"WordPress AnalyticsWP <= 2.1.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Solid Plugins","product":"AnalyticsWP","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-39392","published":"2025-05-19T19:29:45.931Z","updated":"2026-05-12T00:17:52.890Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39393","published":"2025-05-19T19:28:39.998Z","updated":"2026-04-28T16:12:30.130Z","title":"WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mojoomla","product":"Hospital Management System","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39395","published":"2025-05-19T19:27:13.848Z","updated":"2026-04-28T16:12:30.259Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-39401","published":"2025-05-19T19:26:17.917Z","updated":"2026-05-12T00:17:39.923Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00562,"kevAdded":null},{"id":"CVE-2025-39402","published":"2025-05-19T19:24:47.800Z","updated":"2026-04-28T16:12:30.150Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-39403","published":"2025-05-19T19:10:31.919Z","updated":"2026-04-28T16:12:30.183Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-39405","published":"2025-05-19T19:09:20.995Z","updated":"2026-04-28T16:12:30.272Z","title":"WordPress WPAMS plugin <= 44.0 (17-08-2023) - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2025-39406","published":"2025-05-19T19:07:25.329Z","updated":"2026-04-28T16:12:30.354Z","title":"WordPress WPAMS plugin <= 44.0 - Local File Inclusion to Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"mojoomla","product":"WPAMS","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-39407","published":"2025-05-19T19:06:22.751Z","updated":"2026-04-28T16:12:30.307Z","title":"WordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Caseproof, LLC","product":"Memberpress","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39409","published":"2025-05-19T19:03:42.917Z","updated":"2026-04-28T16:12:30.446Z","title":"WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pressaholic","product":"WordPress Video Robot - The Ultimate Video Importer","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39410","published":"2025-05-19T18:58:46.039Z","updated":"2026-04-28T16:12:30.479Z","title":"WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"themegusta","product":"Smart Sections Theme Builder - WPBakery Page Builder Addon","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-39411","published":"2025-05-19T18:58:01.600Z","updated":"2026-04-28T16:12:30.541Z","title":"WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Indie_Plugins","product":"WhatsApp Click to Chat Plugin for WordPress","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2025-39445","published":"2025-05-19T18:56:59.117Z","updated":"2026-04-28T16:12:31.832Z","title":"WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-39446","published":"2025-05-19T18:55:54.932Z","updated":"2026-04-28T16:12:31.832Z","title":"WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pluggabl LLC","product":"Booster Plus for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-39447","published":"2025-05-19T18:51:31.986Z","updated":"2026-04-29T09:51:55.028Z","title":"WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-39449","published":"2025-05-19T18:50:35.578Z","updated":"2026-04-29T09:51:55.209Z","title":"WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetWooBuilder","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-39451","published":"2025-05-19T18:48:48.908Z","updated":"2026-05-12T00:17:26.667Z","title":"WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2025-39458","published":"2025-05-19T18:47:55.062Z","updated":"2026-04-28T16:12:32.088Z","title":"WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Foton","kev":false,"epss":0.00767,"kevAdded":null},{"id":"CVE-2025-39459","published":"2025-05-19T18:46:41.609Z","updated":"2026-04-28T16:12:32.044Z","title":"WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.3,"vendor":"contempoinc","product":"Real Estate 7","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-43832","published":"2025-05-19T18:45:14.076Z","updated":"2026-04-28T16:12:35.929Z","title":"WordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"andreyk","product":"Remote Images Grabber","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-43836","published":"2025-05-19T18:22:02.030Z","updated":"2026-04-28T16:12:36.196Z","title":"WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"confuzzledduck","product":"Syndicate Out","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-43837","published":"2025-05-19T18:20:33.700Z","updated":"2026-04-28T16:12:35.923Z","title":"WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"binti76","product":"Total Donations","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-43838","published":"2025-05-19T18:17:37.698Z","updated":"2026-04-28T16:12:36.401Z","title":"WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ChoPlugins.com","product":"Custom PC Builder Lite for WooCommerce","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-43839","published":"2025-05-19T18:16:27.051Z","updated":"2026-04-28T16:12:36.319Z","title":"WordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"shanebp","product":"BP Messages Tool","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-47577","published":"2025-05-19T18:15:02.058Z","updated":"2026-05-12T00:18:21.013Z","title":"WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":10,"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","kev":false,"epss":0.04558,"kevAdded":null},{"id":"CVE-2025-47581","published":"2025-05-19T18:13:44.689Z","updated":"2026-04-28T16:12:45.791Z","title":"WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"elbisnero","product":"WordPress Events Calendar Registration & Tickets","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-47582","published":"2025-05-19T18:12:08.367Z","updated":"2026-04-28T16:12:45.916Z","title":"WordPress WPBot Pro Wordpress Chatbot <= 12.7.0 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"QuantumCloud","product":"WPBot Pro Wordpress Chatbot","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2025-27010","published":"2025-05-19T18:08:53.393Z","updated":"2026-04-28T16:11:46.741Z","title":"WordPress Tastyc < 2.5.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"bslthemes","product":"Tastyc","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2025-26997","published":"2025-05-19T18:07:48.895Z","updated":"2026-04-28T16:11:46.287Z","title":"WordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"validas","product":"Wireless Butler","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-26892","published":"2025-05-19T18:06:06.214Z","updated":"2026-04-28T16:11:42.371Z","title":"WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"dkszone","product":"Celestial Aura","kev":false,"epss":0.00667,"kevAdded":null},{"id":"CVE-2025-26872","published":"2025-05-19T18:04:14.384Z","updated":"2026-04-28T16:11:41.105Z","title":"WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"dkszone","product":"Eximius","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2025-26735","published":"2025-05-19T18:01:42.890Z","updated":"2026-04-28T16:11:39.805Z","title":"WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Candid themes","product":"Grip","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2025-22287","published":"2025-05-19T17:56:54.085Z","updated":"2026-04-29T09:56:32.056Z","title":"WordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"enituretechnology","product":"LTL Freight Quotes – FreightQuote Edition","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-39448","published":"2025-05-19T17:33:17.762Z","updated":"2026-04-28T16:12:31.890Z","title":"WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-39450","published":"2025-05-19T17:32:19.805Z","updated":"2026-04-28T16:12:31.920Z","title":"WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetTabs","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-39454","published":"2025-05-19T17:31:37.126Z","updated":"2026-05-12T00:17:33.520Z","title":"WordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeroen Peters","product":"Name Directory","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-39460","published":"2025-05-19T17:30:44.742Z","updated":"2026-04-28T16:12:32.014Z","title":"WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"Eduma","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-43833","published":"2025-05-19T17:29:57.245Z","updated":"2026-04-28T16:12:35.907Z","title":"WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Amir Helzer","product":"Absolute Links","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-43834","published":"2025-05-19T17:27:44.348Z","updated":"2026-05-12T00:18:07.557Z","title":"WordPress cookieBAR plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"tox82","product":"cookieBAR","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-43835","published":"2025-05-19T17:26:45.474Z","updated":"2026-05-12T00:18:14.012Z","title":"WordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ktsvetkov","product":"wp-cyr-cho","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-39412","published":"2025-05-19T17:25:26.205Z","updated":"2026-04-28T16:12:30.622Z","title":"WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"averta","product":"Master Slider","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-39398","published":"2025-05-19T17:22:42.989Z","updated":"2026-04-28T16:12:30.211Z","title":"WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themovation","product":"Bellevue","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-39396","published":"2025-05-19T17:15:08.161Z","updated":"2026-04-28T16:12:30.327Z","title":"WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2025-43841","published":"2025-05-19T17:08:41.224Z","updated":"2026-04-28T16:12:36.283Z","title":"WordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jamesdbruner","product":"WP Vegas","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-43840","published":"2025-05-19T17:07:20.828Z","updated":"2026-04-28T16:12:36.340Z","title":"WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ref","product":"CheckBot","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-46262","published":"2025-05-19T17:06:23.877Z","updated":"2026-04-28T16:12:37.172Z","title":"WordPress Mad Mimi for WordPress plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Zack Katz","product":"Mad Mimi for WordPress","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-46263","published":"2025-05-19T17:05:18.843Z","updated":"2026-04-28T16:12:37.321Z","title":"WordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Lloyd Saunders","product":"Author Box After Posts","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-46543","published":"2025-05-19T17:04:06.073Z","updated":"2026-04-28T16:12:40.599Z","title":"WordPress Enhanced Paypal Shortcodes plugin <= 0.5a - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CharlyLeetham","product":"Enhanced Paypal Shortcodes","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-39394","published":"2025-05-19T16:51:13.144Z","updated":"2026-04-28T16:12:30.306Z","title":"WordPress AnalyticsWP plugin <= 2.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Solid Plugins","product":"AnalyticsWP","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-26920","published":"2025-05-19T16:50:24.950Z","updated":"2026-04-28T16:11:43.806Z","title":"WordPress Customify theme <= 0.4.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pressmaximum","product":"Customify","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-26867","published":"2025-05-19T16:48:56.873Z","updated":"2026-04-28T16:11:40.878Z","title":"WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themes4WP","product":"Bulk","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-39388","published":"2025-05-19T16:47:44.841Z","updated":"2026-04-28T16:12:30.167Z","title":"WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Solid Plugins","product":"AnalyticsWP","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-39376","published":"2025-05-19T16:46:41.539Z","updated":"2026-04-28T16:12:29.735Z","title":"WordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"QuanticaLabs","product":"Car Park Booking System for WordPress","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-39375","published":"2025-05-19T16:45:29.686Z","updated":"2026-05-12T00:17:59.678Z","title":"WordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ashok G","product":"Easy Child Theme Creator","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-39374","published":"2025-05-19T16:44:18.116Z","updated":"2026-04-28T16:12:29.748Z","title":"WordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"aseem1234","product":"Best Posts Summary","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-39373","published":"2025-05-19T16:42:18.412Z","updated":"2026-04-28T16:12:29.715Z","title":"WordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"jegtheme","product":"JNews","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-39371","published":"2025-05-19T16:41:23.968Z","updated":"2026-04-28T16:12:29.819Z","title":"WordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sanjeev Mohindra","product":"Author Box Plugin With Different Description","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-39370","published":"2025-05-19T16:40:06.236Z","updated":"2026-04-28T16:12:29.714Z","title":"WordPress iCafe Library plugin <= 1.8.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"cnilsson","product":"iCafe Library","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-39369","published":"2025-05-19T16:35:02.122Z","updated":"2026-04-28T16:12:29.795Z","title":"WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sihibbs","product":"Posts for Page","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-39368","published":"2025-05-19T16:33:47.691Z","updated":"2026-05-12T00:17:46.389Z","title":"WordPress Rootspersona plugin <= 3.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ed4becky","product":"Rootspersona","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-39353","published":"2025-05-19T16:30:53.171Z","updated":"2026-04-28T16:12:29.330Z","title":"WordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-39351","published":"2025-05-19T16:30:03.073Z","updated":"2026-04-28T16:12:29.424Z","title":"WordPress Grand Restaurant WordPress theme <= 7.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-39364","published":"2025-05-19T16:28:30.750Z","updated":"2026-04-28T16:12:29.545Z","title":"WordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"PluginEver","product":"Product Category Slider for WooCommerce","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2025-47576","published":"2025-05-19T16:23:38.587Z","updated":"2026-04-28T16:12:46.003Z","title":"WordPress Bimber - Viral Magazine WordPress Theme theme <= 9.2.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Bringthepixel","product":"Bimber - Viral Magazine WordPress Theme","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-47583","published":"2025-05-19T16:07:01.498Z","updated":"2026-04-28T16:12:45.916Z","title":"WordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-32920","published":"2025-05-19T16:05:49.475Z","updated":"2026-04-28T16:12:29.025Z","title":"WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-23988","published":"2025-05-19T16:03:07.415Z","updated":"2026-04-28T16:11:26.880Z","title":"WordPress ghostwriter theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bruno Cavalcante","product":"Ghostwriter","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-23986","published":"2025-05-19T16:02:34.983Z","updated":"2026-04-28T16:11:26.877Z","title":"WordPress Tiki Time theme <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fyrewurks","product":"Tiki Time","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-23983","published":"2025-05-19T16:02:03.541Z","updated":"2026-05-12T23:59:51.004Z","title":"WordPress Tijaji theme <= 1.43 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tijaji","product":"Tijaji","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-23981","published":"2025-05-19T16:01:43.405Z","updated":"2026-04-28T16:11:27.381Z","title":"WordPress CarZine theme <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Takimi Themes","product":"CarZine","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-23979","published":"2025-05-19T16:01:21.666Z","updated":"2026-04-28T16:11:26.938Z","title":"WordPress Flashy theme <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"duwasai","product":"Flashy","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22792","published":"2025-05-19T16:00:51.886Z","updated":"2026-04-28T16:11:07.505Z","title":"WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jinwen","product":"Js O3 Lite","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22791","published":"2025-05-19T16:00:27.992Z","updated":"2026-04-28T16:11:07.506Z","title":"WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"twh","product":"offset writing","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22790","published":"2025-05-19T16:00:07.956Z","updated":"2026-04-28T16:11:07.459Z","title":"WordPress moseter theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"asmedia","product":"moseter","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22789","published":"2025-05-19T15:59:46.062Z","updated":"2026-04-28T16:11:07.573Z","title":"WordPress polka dots theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fyrewurks","product":"polka dots","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22687","published":"2025-05-19T15:59:04.024Z","updated":"2026-04-28T16:11:04.492Z","title":"WordPress tuaug4 theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Asmedia","product":"Tuaug4","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-22678","published":"2025-05-19T15:58:33.012Z","updated":"2026-04-28T16:11:04.259Z","title":"WordPress my white theme <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mythemes","product":"my white","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2024-33939","published":"2025-05-19T15:55:18.574Z","updated":"2026-04-28T16:09:47.023Z","title":"WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00937,"kevAdded":null},{"id":"CVE-2025-48346","published":"2025-05-19T14:55:23.640Z","updated":"2026-04-28T16:12:57.135Z","title":"WordPress Embed and Integrate Etsy Shop plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Embed360","product":"Embed and Integrate Etsy Shop","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-48344","published":"2025-05-19T14:55:23.169Z","updated":"2026-04-28T16:12:57.200Z","title":"WordPress Rootspersona plugin <= 3.7.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ed4becky","product":"Rootspersona","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-48342","published":"2025-05-19T14:55:22.665Z","updated":"2026-04-28T16:12:56.897Z","title":"WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RedefiningTheWeb","product":"Dynamic Pricing & Discounts Lite for WooCommerce","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-48341","published":"2025-05-19T14:55:22.115Z","updated":"2026-04-28T16:12:57.050Z","title":"WordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"10Web","product":"Form Maker by 10Web","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-48288","published":"2025-05-19T14:45:29.272Z","updated":"2026-04-28T16:12:55.295Z","title":"WordPress ElementInvader Addons for Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Element Invader","product":"ElementInvader Addons for Elementor","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-48285","published":"2025-05-19T14:45:28.812Z","updated":"2026-04-28T16:12:55.283Z","title":"WordPress Falang multilanguage plugin <= 1.3.61 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sbouey","product":"Falang multilanguage","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-48284","published":"2025-05-19T14:45:28.326Z","updated":"2026-04-28T16:12:55.401Z","title":"WordPress Japanized For WooCommerce plugin <= 2.6.40 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"shohei.tanaka","product":"Japanized For WooCommerce","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-48282","published":"2025-05-19T14:45:27.844Z","updated":"2026-04-28T16:12:55.687Z","title":"WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Majestic Support","product":"Majestic Support","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-48280","published":"2025-05-19T14:45:27.384Z","updated":"2026-04-28T16:12:55.252Z","title":"WordPress AutomatorWP plugin <= 5.2.1.3 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-48278","published":"2025-05-19T14:45:26.912Z","updated":"2026-04-28T16:12:54.834Z","title":"WordPress RSVPMarker  plugin <= 11.5.6 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"davidfcarr","product":"RSVPMarker","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-48277","published":"2025-05-19T14:45:26.444Z","updated":"2026-04-28T16:12:55.322Z","title":"WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Stylemix","product":"Cost Calculator Builder","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-48276","published":"2025-05-19T14:45:25.944Z","updated":"2026-04-28T16:12:54.862Z","title":"WordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-48272","published":"2025-05-19T14:45:25.486Z","updated":"2026-04-28T16:12:54.929Z","title":"WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpjobportal","product":"WP Job Portal","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-48270","published":"2025-05-19T14:45:25.014Z","updated":"2026-04-28T16:12:54.531Z","title":"WordPress SKT Blocks plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Blocks","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-48269","published":"2025-05-19T14:45:24.544Z","updated":"2026-04-28T16:12:54.377Z","title":"WordPress WPAdverts plugin <= 2.2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-48268","published":"2025-05-19T14:45:24.051Z","updated":"2026-04-28T16:12:54.423Z","title":"WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Guru Team","product":"Bot for Telegram on WooCommerce","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-48266","published":"2025-05-19T14:45:16.146Z","updated":"2026-05-12T00:18:47.495Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-48265","published":"2025-05-19T14:45:12.920Z","updated":"2026-05-12T00:18:41.006Z","title":"WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Pektsekye","product":"Year Make Model Search for WooCommerce","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-48264","published":"2025-05-19T14:45:12.414Z","updated":"2026-04-28T16:12:54.391Z","title":"WordPress Product Code for WooCommerce plugin <= 1.5.0 - CSRF to Database Update vulnerability","severity":"MEDIUM","score":4.3,"vendor":"artiosmedia","product":"Product Code for WooCommerce","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-48263","published":"2025-05-19T14:45:11.886Z","updated":"2026-05-12T00:19:00.708Z","title":"WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-48262","published":"2025-05-19T14:45:02.598Z","updated":"2026-04-28T16:12:54.507Z","title":"WordPress Url Rewrite Analyzer plugin <= 1.3.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"M.Code","product":"Url Rewrite Analyzer","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-48260","published":"2025-05-19T14:45:02.120Z","updated":"2026-04-28T16:12:54.602Z","title":"WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ninja Team","product":"GDPR CCPA Compliance Support","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-48259","published":"2025-05-19T14:45:01.435Z","updated":"2026-04-28T16:12:53.994Z","title":"WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Juan Carlos","product":"WP Mapa Politico España","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-48258","published":"2025-05-19T14:45:00.913Z","updated":"2026-04-28T16:12:54.347Z","title":"WordPress Mega Menu Block plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jetmonsters","product":"Mega Menu Block","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48257","published":"2025-05-19T14:45:00.326Z","updated":"2026-04-28T16:12:54.328Z","title":"WordPress Projectopia plugin <= 5.1.17 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Projectopia","product":"Projectopia","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-48256","published":"2025-05-19T14:44:59.649Z","updated":"2026-04-28T16:12:54.288Z","title":"WordPress Import Social Events plugin <= 1.8.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xylus Themes","product":"Import Social Events","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-48255","published":"2025-05-19T14:44:59.186Z","updated":"2026-04-28T16:12:53.905Z","title":"WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"videowhisper","product":"Broadcast Live Video","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-48254","published":"2025-05-19T14:44:58.736Z","updated":"2026-04-28T16:12:54.327Z","title":"WordPress Change Add to Cart Button Text for WooCommerce plugin <= 2.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Change Add to Cart Button Text for WooCommerce","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-48253","published":"2025-05-19T14:44:58.246Z","updated":"2026-04-28T16:12:54.225Z","title":"WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-48252","published":"2025-05-19T14:44:57.782Z","updated":"2026-04-28T16:12:54.240Z","title":"WordPress Back Button Widget plugin <= 1.6.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Back Button Widget","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-48251","published":"2025-05-19T14:44:57.292Z","updated":"2026-04-28T16:12:53.895Z","title":"WordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Additional Custom Emails & Recipients for WooCommerce","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-48250","published":"2025-05-19T14:44:56.839Z","updated":"2026-04-28T16:12:54.315Z","title":"WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin <= 1.7.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Coupons & Add to Cart by URL Links for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48249","published":"2025-05-19T14:44:56.380Z","updated":"2026-04-28T16:12:53.880Z","title":"WordPress EAN for WooCommerce plugin <= 5.4.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"EAN for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48248","published":"2025-05-19T14:44:55.865Z","updated":"2026-04-28T16:12:53.732Z","title":"WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Sitewide Discount for WooCommerce: Apply Discount to All Products","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48247","published":"2025-05-19T14:44:55.413Z","updated":"2026-04-28T16:12:53.857Z","title":"WordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Blair Williams","product":"Shortlinks by Pretty Links","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-48246","published":"2025-05-19T14:44:54.964Z","updated":"2026-04-28T16:12:53.734Z","title":"WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"StellarWP","product":"The Events Calendar","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-48244","published":"2025-05-19T14:44:54.508Z","updated":"2026-05-12T00:18:53.973Z","title":"WordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tim Strifler","product":"Exclusive Addons Elementor","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-48243","published":"2025-05-19T14:44:54.055Z","updated":"2026-04-28T16:12:53.644Z","title":"WordPress reCAPTCHA for all plugin <= 2.26 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sminozzi","product":"reCAPTCHA for all","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-48242","published":"2025-05-19T14:44:53.592Z","updated":"2026-04-28T16:12:53.628Z","title":"WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Legal Pages","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2025-48240","published":"2025-05-19T14:44:53.148Z","updated":"2026-04-28T16:12:53.602Z","title":"WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Cost of Goods for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48239","published":"2025-05-19T14:44:52.687Z","updated":"2026-04-28T16:12:53.439Z","title":"WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Product Notes Tab & Private Admin Notes for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48238","published":"2025-05-19T14:44:52.236Z","updated":"2026-04-28T16:12:53.373Z","title":"WordPress AWcode Toolkit plugin <= 1.0.18 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"awcode","product":"AWcode Toolkit","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-48237","published":"2025-05-19T14:44:51.776Z","updated":"2026-04-28T16:12:53.418Z","title":"WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Wishlist for WooCommerce","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48236","published":"2025-05-19T14:44:51.265Z","updated":"2026-04-28T16:12:53.477Z","title":"WordPress bunny.net plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":8.5,"vendor":"bunny.net","product":"bunny.net","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-48235","published":"2025-05-19T14:44:50.802Z","updated":"2026-04-28T16:12:53.628Z","title":"WordPress WP Image Mask plugin <= 3.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bogdan Bendziukov","product":"WP Image Mask","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-48234","published":"2025-05-19T14:44:50.310Z","updated":"2026-04-28T16:12:53.355Z","title":"WordPress Ultimate Blocks plugin <= 3.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ultimate Blocks","product":"Ultimate Blocks","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-48233","published":"2025-05-19T14:44:49.825Z","updated":"2026-04-28T16:12:53.629Z","title":"WordPress Affiliates Manager Google reCAPTCHA Integration plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"affmngr","product":"Affiliates Manager Google reCAPTCHA Integration","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-48232","published":"2025-05-19T14:44:49.304Z","updated":"2026-05-12T00:18:34.515Z","title":"WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xpro","product":"Xpro Addons For Beaver Builder – Lite","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-31062","published":"2025-05-16T15:45:42.159Z","updated":"2026-05-12T00:17:06.096Z","title":"WordPress Wishlist plugin <= 2.1.0 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"redqteam","product":"Wishlist","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-31063","published":"2025-05-16T15:45:41.674Z","updated":"2026-04-28T16:12:04.696Z","title":"WordPress Wishlist plugin <= 2.1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"redqteam","product":"Wishlist","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-31065","published":"2025-05-16T15:45:41.184Z","updated":"2026-04-28T16:12:04.707Z","title":"WordPress Rozario <= 1.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeton","product":"Rozario","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-31066","published":"2025-05-16T15:45:40.686Z","updated":"2026-04-28T16:12:04.723Z","title":"WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeton","product":"Acerola","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-31068","published":"2025-05-16T15:45:40.193Z","updated":"2026-04-28T16:12:04.712Z","title":"WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themeton","product":"Seven Stars","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-31071","published":"2025-05-16T15:45:39.672Z","updated":"2026-04-28T16:12:04.769Z","title":"WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeton","product":"HotStar – Multi-Purpose Business Theme","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-31630","published":"2025-05-16T15:45:39.177Z","updated":"2026-04-28T16:12:10.717Z","title":"WordPress The Business <= 1.6.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeton","product":"The Business","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-31637","published":"2025-05-16T15:45:38.696Z","updated":"2026-04-28T16:12:10.797Z","title":"WordPress SHOUT plugin <= 3.5.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"SHOUT","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-31639","published":"2025-05-16T15:45:38.188Z","updated":"2026-04-28T16:12:10.835Z","title":"WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themeton","product":"Spare","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-31640","published":"2025-05-16T15:45:37.673Z","updated":"2026-05-12T00:17:19.924Z","title":"WordPress Magic Responsive Slider and Carousel WordPress plugin < 1.6 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Magic Responsive Slider and Carousel WordPress","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-31641","published":"2025-05-16T15:45:37.174Z","updated":"2026-04-28T16:12:10.874Z","title":"WordPress UberSlider plugin <= 2.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"UberSlider","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-31915","published":"2025-05-16T15:45:36.671Z","updated":"2026-04-28T16:12:16.270Z","title":"WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"kamleshyadav","product":"Pixel WordPress Form BuilderPlugin & Autoresponder","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-31921","published":"2025-05-16T15:45:36.160Z","updated":"2026-04-28T16:12:16.385Z","title":"WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"loopus","product":"WP Ultimate Tours Builder","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-31922","published":"2025-05-16T15:45:35.670Z","updated":"2026-04-28T16:12:16.280Z","title":"WordPress CSS3 Accordions for WordPress plugin <= 3.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"QuanticaLabs","product":"CSS3 Accordions for WordPress","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-31923","published":"2025-05-16T15:45:35.160Z","updated":"2026-04-28T16:12:16.280Z","title":"WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"QuanticaLabs","product":"CSS3 Accordions for WordPress","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-31926","published":"2025-05-16T15:45:34.653Z","updated":"2026-04-28T16:12:16.579Z","title":"WordPress Sticky Radio Player plugin <= 3.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Sticky Radio Player","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-31928","published":"2025-05-16T15:45:34.150Z","updated":"2026-05-12T00:17:12.965Z","title":"WordPress Multimedia Responsive Carousel with Image Video Audio Support plugin <= 2.6.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Multimedia Responsive Carousel with Image Video Audio Support","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32180","published":"2025-05-16T15:45:33.636Z","updated":"2026-04-28T16:12:18.266Z","title":"WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mojofywp","product":"Product Carousel For WooCommerce – WoorouSell","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-32245","published":"2025-05-16T15:45:33.117Z","updated":"2026-04-28T16:12:19.729Z","title":"WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Chaser324","product":"Featured Posts Scroll","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2025-32287","published":"2025-05-16T15:45:32.563Z","updated":"2026-04-28T16:12:20.621Z","title":"WordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Responsive HTML5 Audio Player PRO With Playlist","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32290","published":"2025-05-16T15:45:32.044Z","updated":"2026-04-28T16:12:20.861Z","title":"WordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Sticky HTML5 Music Player","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32295","published":"2025-05-16T15:45:31.498Z","updated":"2026-04-28T16:12:21.623Z","title":"WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wordpresschef","product":"Salon Booking Pro","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-32296","published":"2025-05-16T15:45:30.945Z","updated":"2026-04-28T16:12:21.332Z","title":"WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"quantumcloud","product":"Simple Link Directory","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-32299","published":"2025-05-16T15:45:30.411Z","updated":"2026-04-28T16:12:21.596Z","title":"WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themovation","product":"QuickCal - Appointment Booking Calendar for WordPress","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-32301","published":"2025-05-16T15:45:29.883Z","updated":"2026-04-28T16:12:21.622Z","title":"WordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"CountDown Pro WP Plugin","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32306","published":"2025-05-16T15:45:29.365Z","updated":"2026-04-28T16:12:21.611Z","title":"WordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Radio Player Shoutcast & Icecast WordPress Plugin","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32307","published":"2025-05-16T15:45:28.801Z","updated":"2026-04-28T16:12:21.446Z","title":"WordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"LambertGroup","product":"Chameleon HTML5 Audio Player With/Without Playlist","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-32310","published":"2025-05-16T15:45:28.252Z","updated":"2026-04-28T16:12:21.765Z","title":"WordPress QuickCal plugin <= 1.0.15 - CSRF to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeMove","product":"QuickCal - Appointment Booking Calendar for WordPress","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2025-32643","published":"2025-05-16T15:45:27.731Z","updated":"2026-04-28T16:12:26.345Z","title":"WordPress WPGYM Plugin <= 65.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"mojoomla","product":"WPGYM","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2025-39481","published":"2025-05-16T15:45:27.223Z","updated":"2026-04-28T16:12:32.383Z","title":"WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"imithemes","product":"Eventer","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2025-39482","published":"2025-05-16T15:45:26.697Z","updated":"2026-04-28T16:12:32.421Z","title":"WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"imithemes","product":"Eventer","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2025-39491","published":"2025-05-16T15:45:26.153Z","updated":"2026-04-28T16:12:32.640Z","title":"WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WHMPress","product":"WHMpress","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2025-39492","published":"2025-05-16T15:45:25.612Z","updated":"2026-04-28T16:12:32.741Z","title":"WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"WHMPress","product":"WHMpress","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-39493","published":"2025-05-16T15:45:25.055Z","updated":"2026-05-12T00:16:31.372Z","title":"WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ValvePress","product":"Rankie","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2025-39507","published":"2025-05-16T15:45:24.437Z","updated":"2026-04-28T16:12:33.227Z","title":"WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"NasaTheme","product":"Nasa Core","kev":false,"epss":0.00844,"kevAdded":null},{"id":"CVE-2025-39509","published":"2025-05-16T15:45:23.847Z","updated":"2026-04-28T16:12:33.316Z","title":"WordPress TNC FlipBook  plugin  <= 12.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeNcode","product":"TNC FlipBook","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-39511","published":"2025-05-16T15:45:23.327Z","updated":"2026-04-28T16:12:33.260Z","title":"WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ValvePress","product":"Pinterest Automatic Pin","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-39537","published":"2025-05-16T15:45:22.765Z","updated":"2026-04-28T16:12:34.329Z","title":"WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Blaze Concepts","product":"Better Customer List for WooCommerce","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-46464","published":"2025-05-16T15:45:22.238Z","updated":"2026-04-28T16:12:38.579Z","title":"WordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"scripteo","product":"Ads Pro","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47534","published":"2025-05-16T15:45:21.730Z","updated":"2026-04-28T16:12:44.319Z","title":"WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ValvePress","product":"Wordpress Auto Spinner","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-47556","published":"2025-05-16T15:45:21.219Z","updated":"2026-04-28T16:12:45.106Z","title":"WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"QuanticaLabs","product":"CSS3 Compare Pricing Tables for WordPress","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2025-47557","published":"2025-05-16T15:45:20.719Z","updated":"2026-04-28T16:12:44.869Z","title":"WordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47560","published":"2025-05-16T15:45:20.185Z","updated":"2026-04-28T16:12:44.944Z","title":"WordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-47562","published":"2025-05-16T15:45:19.655Z","updated":"2026-04-28T16:12:44.977Z","title":"WordPress MapSVG plugin <= 8.5.34 - Content Injection Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-47563","published":"2025-05-16T15:45:19.130Z","updated":"2026-04-28T16:12:44.958Z","title":"WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"villatheme","product":"CURCY","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-47564","published":"2025-05-16T15:45:18.579Z","updated":"2026-04-28T16:12:44.990Z","title":"WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ashanjay","product":"EventON","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2025-47567","published":"2025-05-16T15:45:18.030Z","updated":"2026-04-28T16:12:45.044Z","title":"WordPress Video Player & FullScreen Video Background plugin <= 2.4.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"LambertGroup","product":"Video Player & FullScreen Video Background","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47693","published":"2025-05-16T15:45:17.462Z","updated":"2026-04-28T16:12:50.356Z","title":"WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"roninwp","product":"FAT Services Booking","kev":false,"epss":0.0062,"kevAdded":null},{"id":"CVE-2025-48146","published":"2025-05-16T15:45:16.899Z","updated":"2026-04-28T16:12:52.765Z","title":"WordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Michael Lups","product":"SEO Flow by LupsOnline","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-48144","published":"2025-05-16T15:45:16.349Z","updated":"2026-04-28T16:12:52.347Z","title":"WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"sidngr","product":"Import Export For WooCommerce","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-48138","published":"2025-05-16T15:45:15.805Z","updated":"2026-05-12T00:16:51.661Z","title":"WordPress BERTHA AI plugin <= 1.13 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bertha AI – Andrew Palmer","product":"BERTHA AI","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-48137","published":"2025-05-16T15:45:15.297Z","updated":"2026-05-12T00:16:58.645Z","title":"WordPress Interview plugin <= 1.01 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"proxymis","product":"Interview","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-48136","published":"2025-05-16T15:45:14.748Z","updated":"2026-04-28T16:12:52.191Z","title":"WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Estatik","product":"Mortgage Calculator Estatik","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2025-48135","published":"2025-05-16T15:45:14.238Z","updated":"2026-04-28T16:12:52.319Z","title":"WordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aptivadadev","product":"Aptivada for WP","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-48134","published":"2025-05-16T15:45:13.676Z","updated":"2026-05-12T00:16:37.798Z","title":"WordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"ShapedPlugin LLC","product":"WP Tabs","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2025-48132","published":"2025-05-16T15:45:13.127Z","updated":"2026-04-28T16:12:52.292Z","title":"WordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pencilwp","product":"X Addons for Elementor","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-48131","published":"2025-05-16T15:45:12.591Z","updated":"2026-04-28T16:12:52.156Z","title":"WordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saiful Islam","product":"UltraAddons Elementor Lite","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-48128","published":"2025-05-16T15:45:12.066Z","updated":"2026-04-28T16:12:52.201Z","title":"WordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sharespine","product":"Sharespine Woocommerce Connector","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-48127","published":"2025-05-16T15:45:11.459Z","updated":"2026-04-28T16:12:52.100Z","title":"WordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"App Cheap","product":"Push notification for Mobile and Web app","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-48121","published":"2025-05-16T15:45:10.875Z","updated":"2026-04-28T16:12:51.845Z","title":"WordPress WP Notes Widget plugin <= 1.0.6  - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Steve Puddick","product":"WP Notes Widget","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-48120","published":"2025-05-16T15:45:10.264Z","updated":"2026-04-28T16:12:51.879Z","title":"WordPress MapSVG Lite plugin <= 8.6.9 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-48119","published":"2025-05-16T15:45:09.672Z","updated":"2026-04-28T16:12:51.882Z","title":"WordPress RS WP Book Showcase plugin <= 6.7.59 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RS WP THEMES","product":"RS WP Book Showcase","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-48117","published":"2025-05-16T15:45:09.119Z","updated":"2026-05-12T00:16:44.687Z","title":"WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"kilbot","product":"WooCommerce POS","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2025-48116","published":"2025-05-16T15:45:08.523Z","updated":"2026-04-28T16:12:51.818Z","title":"WordPress EventON plugin <= 2.4.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-48115","published":"2025-05-16T15:45:07.990Z","updated":"2026-04-28T16:12:51.837Z","title":"WordPress ValidateCertify plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Javier Revilla","product":"ValidateCertify","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-48114","published":"2025-05-16T15:45:07.460Z","updated":"2026-04-28T16:12:51.831Z","title":"WordPress ShayanWeb Admin FontChanger plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Shayan Farhang Pazhooh","product":"ShayanWeb Admin FontChanger","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-48113","published":"2025-05-16T15:45:06.919Z","updated":"2026-04-28T16:12:51.669Z","title":"WordPress Broadstreet plugin <= 1.51.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Broadstreet","product":"Broadstreet Ads","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-48112","published":"2025-05-16T15:45:06.405Z","updated":"2026-04-28T16:12:51.714Z","title":"WordPress Dot html,php,xml etc pages plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"karimmughal","product":"Dot html,php,xml etc pages","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-48080","published":"2025-05-16T15:45:05.899Z","updated":"2026-04-28T16:12:50.403Z","title":"WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-48079","published":"2025-05-16T15:45:05.014Z","updated":"2026-04-28T16:12:50.377Z","title":"WordPress ProfileGrid  plugin <= 5.9.5.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2024-51666","published":"2025-05-15T18:27:23.440Z","updated":"2026-05-12T00:16:24.394Z","title":"WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Tosin Oguntuyi","product":"Tours","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2024-56006","published":"2025-05-15T18:24:37.638Z","updated":"2026-04-28T16:10:53.712Z","title":"WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Automattic","product":"Jetpack Debug Tools","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-32922","published":"2025-05-15T18:11:54.301Z","updated":"2026-04-28T16:12:28.897Z","title":"WordPress WP2LEADS plugin <= 3.5.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saleswonder Team: Tobias","product":"WP2LEADS","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-47580","published":"2025-05-15T17:07:41.602Z","updated":"2026-04-28T16:12:45.850Z","title":"WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Rustaurius","product":"Front End Users","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-47445","published":"2025-05-14T11:37:49.467Z","updated":"2026-05-12T00:16:18.055Z","title":"WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.0516,"kevAdded":null},{"id":"CVE-2025-47682","published":"2025-05-12T18:19:43.926Z","updated":"2026-04-29T09:51:55.520Z","title":"WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Cozy Vision","product":"SMS Alert Order Notifications","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2025-47578","published":"2025-05-12T16:04:16.451Z","updated":"2026-04-28T16:12:45.522Z","title":"WordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Edward Caissie","product":"BNS Twitter Follow Button","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47692","published":"2025-05-07T14:20:57.916Z","updated":"2026-04-28T16:12:50.334Z","title":"WordPress ContentStudio plugin <= 1.3.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"contentstudio","product":"Contentstudio","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-47691","published":"2025-05-07T14:20:57.321Z","updated":"2026-04-28T16:12:50.171Z","title":"WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-47688","published":"2025-05-07T14:20:56.807Z","updated":"2026-04-28T16:12:49.688Z","title":"WordPress Advanced File Manager plugin <= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"Advanced File Manager","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-47686","published":"2025-05-07T14:20:56.276Z","updated":"2026-04-28T16:12:49.618Z","title":"WordPress DELUCKS SEO plugin <= 2.5.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DELUCKS","product":"DELUCKS SEO","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47685","published":"2025-05-07T14:20:55.734Z","updated":"2026-04-28T16:12:49.616Z","title":"WordPress Contribuinte Checkout plugin <= 2.0.03 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Moloni","product":"Contribuinte Checkout","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-47684","published":"2025-05-07T14:20:55.218Z","updated":"2026-04-28T16:12:49.759Z","title":"WordPress Smaily for WP plugin <= 3.1.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Smaily","product":"Smaily for WP","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-47683","published":"2025-05-07T14:20:54.652Z","updated":"2026-04-28T16:12:49.812Z","title":"WordPress WP Maintenance plugin <= 6.1.9.7 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"Florent Maillefaud","product":"WP Maintenance","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-47681","published":"2025-05-07T14:20:54.122Z","updated":"2026-05-12T00:14:17.722Z","title":"WordPress Web Accessibility with Max Access plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ability, Inc","product":"Web Accessibility with Max Access","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-47679","published":"2025-05-07T14:20:53.598Z","updated":"2026-04-28T16:12:49.320Z","title":"WordPress RS WP Book Showcase plugin <= 6.7.59 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RS WP THEMES","product":"RS WP Book Showcase","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47677","published":"2025-05-07T14:20:53.076Z","updated":"2026-04-28T16:12:49.507Z","title":"WordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.25 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gt3themes","product":"Photo Gallery","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47676","published":"2025-05-07T14:20:52.511Z","updated":"2026-04-28T16:12:49.058Z","title":"WordPress User Login History plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Faiyaz Alam","product":"User Login History","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-47675","published":"2025-05-07T14:20:51.957Z","updated":"2026-04-28T16:12:49.754Z","title":"WordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"woobox","product":"Woobox","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-47674","published":"2025-05-07T14:20:51.441Z","updated":"2026-04-28T16:12:49.242Z","title":"WordPress Credova_Financial plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Credova Financial","product":"Credova_Financial","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-47669","published":"2025-05-07T14:20:50.913Z","updated":"2026-04-28T16:12:48.715Z","title":"WordPress CBX Map for Google Map & OpenStreetMap plugin <= 1.1.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sabuj Kundu","product":"CBX Map for Google Map & OpenStreetMap","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47668","published":"2025-05-07T14:20:50.350Z","updated":"2026-04-28T16:12:48.632Z","title":"WordPress CookieCode plugin <= 2.4.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"cookiecode","product":"CookieCode","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-47667","published":"2025-05-07T14:20:49.821Z","updated":"2026-04-28T16:12:48.751Z","title":"WordPress LiveAgent plugin <= 4.4.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"qusupport","product":"LiveAgent","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-47665","published":"2025-05-07T14:20:49.279Z","updated":"2026-04-28T16:12:48.606Z","title":"WordPress N360 | Splash Screen plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"bistromatic","product":"N360 | Splash Screen","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-47664","published":"2025-05-07T14:20:48.744Z","updated":"2026-04-28T16:12:49.648Z","title":"WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.4,"vendor":"ThimPress","product":"WP Pipes","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-47662","published":"2025-05-07T14:20:48.201Z","updated":"2026-04-28T16:12:49.266Z","title":"WordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"woobox","product":"Woobox","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-47661","published":"2025-05-07T14:20:47.648Z","updated":"2026-04-28T16:12:48.585Z","title":"WordPress 워드프레스 결제 심플페이 plugin <= 5.2.11 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"codemstory","product":"워드프레스 결제 심플페이","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-47659","published":"2025-05-07T14:20:47.065Z","updated":"2026-04-28T16:12:49.704Z","title":"WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"voidcoders","product":"WPBakery Visual Composer WHMCS Elements","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-47657","published":"2025-05-07T14:20:46.516Z","updated":"2026-04-28T16:12:48.535Z","title":"WordPress Productive Commerce plugin <= 1.1.40 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Productive Minds","product":"Productive Commerce","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-47656","published":"2025-05-07T14:20:45.991Z","updated":"2026-05-12T00:15:08.744Z","title":"WordPress Spiraclethemes Site Library plugin <= 1.5.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Spiracle Themes","product":"Spiraclethemes Site Library","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-47655","published":"2025-05-07T14:20:45.442Z","updated":"2026-04-28T16:12:48.246Z","title":"WordPress theMarketer plugin <= 1.4.7 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"themarketer2023","product":"theMarketer","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-47653","published":"2025-05-07T14:20:44.904Z","updated":"2026-04-28T16:12:48.004Z","title":"WordPress WP-Recall <= 16.26.14 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"tggfref","product":"WP-Recall","kev":false,"epss":0.0062,"kevAdded":null},{"id":"CVE-2025-47649","published":"2025-05-07T14:20:44.376Z","updated":"2026-04-28T16:12:47.937Z","title":"WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"StackWC","product":"Open Close WooCommerce Store","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2025-47648","published":"2025-05-07T14:20:43.813Z","updated":"2026-04-28T16:12:48.028Z","title":"WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"axima","product":"Pays – WooCommerce Payment Gateway","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-47647","published":"2025-05-07T14:20:43.240Z","updated":"2026-04-28T16:12:47.936Z","title":"WordPress Sidebar Manager Light plugin <= 1.18 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"OTWthemes","product":"Sidebar Manager Light","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47644","published":"2025-05-07T14:20:42.694Z","updated":"2026-04-28T16:12:47.992Z","title":"WordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"formsintegrations","product":"Integrations of Zoho CRM with Elementor form","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-47643","published":"2025-05-07T14:20:42.102Z","updated":"2026-04-28T16:12:47.950Z","title":"WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"ELEXtensions","product":"ELEX Product Feed for WooCommerce","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47639","published":"2025-05-07T14:20:41.551Z","updated":"2026-04-28T16:12:47.993Z","title":"WordPress Supertext Translation and Proofreading plugin <= 4.26 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Supertext","product":"Supertext Translation and Proofreading","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-47638","published":"2025-05-07T14:20:41.002Z","updated":"2026-05-12T00:14:10.610Z","title":"WordPress WP Discord Invite plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Sarvesh M Rao","product":"WP Discord Invite","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47636","published":"2025-05-07T14:20:40.452Z","updated":"2026-04-28T16:12:47.787Z","title":"WordPress List category posts plugin <= 0.91.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Fernando Briano","product":"List category posts","kev":false,"epss":0.00723,"kevAdded":null},{"id":"CVE-2025-47635","published":"2025-05-07T14:20:39.904Z","updated":"2026-05-12T00:16:10.903Z","title":"WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"WPWebinarSystem","product":"WebinarPress","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-47633","published":"2025-05-07T14:20:39.270Z","updated":"2026-05-12T00:16:03.914Z","title":"WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Awin","product":"Awin – Advertiser Tracking for WooCommerce","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-47632","published":"2025-05-07T14:20:38.754Z","updated":"2026-04-28T16:12:47.411Z","title":"WordPress Awesome Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Raihanul Islam","product":"Awesome Gallery","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-47630","published":"2025-05-07T14:20:38.219Z","updated":"2026-04-28T16:12:47.343Z","title":"WordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Darren Cooney","product":"Ajax Load More","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-47629","published":"2025-05-07T14:20:37.692Z","updated":"2026-04-28T16:12:47.609Z","title":"WordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Mario Peshev","product":"WP-CRM System","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2025-47628","published":"2025-05-07T14:20:37.182Z","updated":"2026-04-28T16:12:47.575Z","title":"WordPress QS Dark Mode plugin <= 3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"quomodosoft","product":"QS Dark Mode","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-47626","published":"2025-05-07T14:20:36.654Z","updated":"2026-04-28T16:12:47.590Z","title":"WordPress Submission DOM tracking for Contact Form 7 plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"apasionados","product":"Submission DOM tracking for Contact Form 7","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-47625","published":"2025-05-07T14:20:36.116Z","updated":"2026-04-28T16:12:47.392Z","title":"WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"apasionados","product":"DoFollow Case by Case","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-47624","published":"2025-05-07T14:20:35.591Z","updated":"2026-04-28T16:12:47.463Z","title":"WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"apasionados","product":"DoFollow Case by Case","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-47623","published":"2025-05-07T14:20:35.057Z","updated":"2026-04-28T16:12:47.462Z","title":"WordPress Easy PayPal Buy Now Button plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Scott Paterson","product":"Easy PayPal Buy Now Button","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-47622","published":"2025-05-07T14:20:34.524Z","updated":"2026-04-28T16:12:47.487Z","title":"WordPress Email Notification on Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"apasionados","product":"Email Notification on Login","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47621","published":"2025-05-07T14:20:33.969Z","updated":"2026-05-12T00:15:50.447Z","title":"WordPress Meks Flexible Shortcodes plugin <= 1.3.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Meks","product":"Meks Flexible Shortcodes","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47620","published":"2025-05-07T14:20:33.416Z","updated":"2026-05-12T00:14:52.263Z","title":"WordPress Martins Free Monetized Ad Exchange Network plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"bundgaard","product":"Martins Free Monetized Ad Exchange Network","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-47617","published":"2025-05-07T14:20:32.752Z","updated":"2026-05-12T00:15:29.507Z","title":"WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"aharonyan","product":"WP Front User Submit / Front Editor","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47616","published":"2025-05-07T14:20:32.154Z","updated":"2026-04-28T16:12:47.257Z","title":"WordPress aBlocks plugin <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kodezen LLC","product":"aBlocks","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47615","published":"2025-05-07T14:20:31.427Z","updated":"2026-04-28T16:12:47.210Z","title":"WordPress Amazon Product in a Post plugin <= 5.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"flowdee","product":"Amazon Product in a Post","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47614","published":"2025-05-07T14:20:30.890Z","updated":"2026-04-28T16:12:47.280Z","title":"WordPress LessButtons Social Sharing and Statistics plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Chris Clark","product":"LessButtons Social Sharing and Statistics","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47612","published":"2025-05-07T14:20:30.323Z","updated":"2026-04-28T16:12:47.118Z","title":"WordPress ClickWhale plugin <= 2.4.6 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ClickWhale","product":"ClickWhale","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-47609","published":"2025-05-07T14:20:29.775Z","updated":"2026-04-28T16:12:46.992Z","title":"WordPress EasyMe Connect plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"easymebiz","product":"EasyMe Connect","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47607","published":"2025-05-07T14:20:29.234Z","updated":"2026-05-12T00:15:22.576Z","title":"WordPress Show All Comments plugin <= 7.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"AppJetty","product":"Show All Comments","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47606","published":"2025-05-07T14:20:28.694Z","updated":"2026-04-28T16:12:46.889Z","title":"WordPress Simple Giveaways plugin <= 2.49.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Igor Benic","product":"Simple Giveaways","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47605","published":"2025-05-07T14:20:28.164Z","updated":"2026-05-12T00:14:31.060Z","title":"WordPress WP jQuery DataTable plugin <= 4.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"AppJetty","product":"WP jQuery DataTable","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47604","published":"2025-05-07T14:20:27.635Z","updated":"2026-04-28T16:12:46.881Z","title":"WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Data443 Risk Mitigation, Inc.","product":"Inline Related Posts","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-47602","published":"2025-05-07T14:20:27.128Z","updated":"2026-04-28T16:12:46.913Z","title":"WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ammarahmad786","product":"Calculate Prices based on Distance For WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47597","published":"2025-05-07T14:20:26.591Z","updated":"2026-04-28T16:12:46.868Z","title":"WordPress WP Podcasts Manager plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Maulik Vora","product":"WP Podcasts Manager","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47596","published":"2025-05-07T14:20:26.061Z","updated":"2026-04-28T16:12:46.866Z","title":"WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Syed Balkhi","product":"Beacon Lead Magnets and Lead Capture","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47595","published":"2025-05-07T14:20:25.531Z","updated":"2026-04-28T16:12:46.877Z","title":"WordPress Color Your Bar plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Darshan Saroya","product":"Color Your Bar","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47594","published":"2025-05-07T14:20:24.977Z","updated":"2026-04-28T16:12:46.866Z","title":"WordPress Soccer Live Scores <= 1.0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DAEXT","product":"Soccer Live Scores","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47593","published":"2025-05-07T14:20:24.383Z","updated":"2026-04-28T16:12:46.501Z","title":"WordPress Really Simple Under Construction Page plugin <= 1.4.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jonas Hjalmarsson","product":"Really Simple Under Construction Page","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47592","published":"2025-05-07T14:20:23.500Z","updated":"2026-04-28T16:12:46.543Z","title":"WordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Árpád Lehel Mátyus","product":"Terms Popup On User Login","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47591","published":"2025-05-07T14:20:22.887Z","updated":"2026-04-28T16:12:46.563Z","title":"WordPress Bulk Featured Image plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreedAlly","product":"Bulk Featured Image","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-47590","published":"2025-05-07T14:20:22.351Z","updated":"2026-04-28T16:12:46.332Z","title":"WordPress WPSpeed plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"JExtensions Store","product":"WPSpeed","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47589","published":"2025-05-07T14:20:21.787Z","updated":"2026-04-28T16:12:46.776Z","title":"WordPress Ebook Store plugin <= 5.8009 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"motov.net","product":"Ebook Store","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47587","published":"2025-05-07T14:20:21.213Z","updated":"2026-04-28T16:12:46.186Z","title":"WordPress YaySMTP plugin <= 2.6.4 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YaySMTP","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47551","published":"2025-05-07T14:20:20.643Z","updated":"2026-04-28T16:12:44.657Z","title":"WordPress Wiki Embed plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ctltwp","product":"Wiki Embed","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47550","published":"2025-05-07T14:20:20.099Z","updated":"2026-04-28T16:12:44.721Z","title":"WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Themefic","product":"Instantio","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-47549","published":"2025-05-07T14:20:19.539Z","updated":"2026-04-28T16:12:44.560Z","title":"WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Themefic","product":"BEAF","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2025-47548","published":"2025-05-07T14:20:18.942Z","updated":"2026-04-28T16:12:44.572Z","title":"WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin <= 1.4.4 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Varun Dubey","product":"Wbcom Designs - Activity Link Preview For BuddyPress","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-47547","published":"2025-05-07T14:20:18.403Z","updated":"2026-04-28T16:12:44.672Z","title":"WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SendPulse","product":"SendPulse Email Marketing Newsletter","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-47546","published":"2025-05-07T14:20:17.786Z","updated":"2026-04-28T16:12:44.551Z","title":"WordPress WP Compress plugin <= 6.30.30 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-47545","published":"2025-05-07T14:20:17.169Z","updated":"2026-04-28T16:12:44.969Z","title":"WordPress Poll Maker plugin <= 5.7.7 - Race Condition Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ays Pro","product":"Poll Maker","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-47544","published":"2025-05-07T14:20:16.605Z","updated":"2026-04-28T16:12:44.547Z","title":"WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.8 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"acowebs","product":"Dynamic Pricing With Discount Rules for WooCommerce","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2025-47543","published":"2025-05-07T14:20:15.997Z","updated":"2026-04-28T16:12:44.430Z","title":"WordPress TrueBooker plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"themetechmount","product":"TrueBooker","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47542","published":"2025-05-07T14:20:15.355Z","updated":"2026-04-28T16:12:44.478Z","title":"WordPress Simple calendar for Elementor plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Michael","product":"Simple calendar for Elementor","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47540","published":"2025-05-07T14:20:14.711Z","updated":"2026-04-28T16:12:44.387Z","title":"WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weMail","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2025-47538","published":"2025-05-07T14:20:14.024Z","updated":"2026-04-28T16:12:44.325Z","title":"WordPress Cart tracking for WooCommerce plugin <= 1.0.17 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"wpdever","product":"Cart tracking for WooCommerce","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2025-47537","published":"2025-05-07T14:20:13.398Z","updated":"2026-04-28T16:12:44.334Z","title":"WordPress PDF Invoice Builder for WooCommerce plugin <= 5.3.8 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"add-ons.org","product":"PDF Invoice Builder for WooCommerce","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47533","published":"2025-05-07T14:20:12.585Z","updated":"2026-04-28T16:12:44.250Z","title":"WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Iqonic Design","product":"Graphina","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-47531","published":"2025-05-07T14:20:11.860Z","updated":"2026-04-28T16:12:44.156Z","title":"WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Xylus Themes","product":"XT Event Widget for Social Events","kev":false,"epss":0.00689,"kevAdded":null},{"id":"CVE-2025-47528","published":"2025-05-07T14:20:11.205Z","updated":"2026-04-28T16:12:44.106Z","title":"WordPress Ovation Elements plugin <= 1.1.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"pewilliams","product":"Ovation Elements","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-47526","published":"2025-05-07T14:20:10.473Z","updated":"2026-04-28T16:12:44.023Z","title":"WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"GS Plugins","product":"GS Variation Swatches for WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47525","published":"2025-05-07T14:20:09.901Z","updated":"2026-04-28T16:12:43.807Z","title":"WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-47524","published":"2025-05-07T14:20:09.315Z","updated":"2026-05-12T00:15:01.726Z","title":"WordPress Quran multilanguage Text & Audio plugin <= 2.3.23 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"karim42","product":"Quran multilanguage Text & Audio","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47523","published":"2025-05-07T14:20:08.535Z","updated":"2026-04-28T16:12:43.835Z","title":"WordPress Seznam Webmaster plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Lukáš Hartmann","product":"Seznam Webmaster","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47522","published":"2025-05-07T14:20:07.896Z","updated":"2026-04-28T16:12:43.696Z","title":"WordPress AWEOS WP Lock plugin <= 1.4.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"AWEOS GmbH","product":"AWEOS WP Lock","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47521","published":"2025-05-07T14:20:07.296Z","updated":"2026-04-28T16:12:43.788Z","title":"WordPress Robo Gallery plugin <= 5.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"robosoft","product":"Robo Gallery","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47520","published":"2025-05-07T14:20:06.767Z","updated":"2026-04-28T16:12:43.693Z","title":"WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47519","published":"2025-05-07T14:20:06.232Z","updated":"2026-04-28T16:12:43.747Z","title":"WordPress Easy PayPal Events plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Scott Paterson","product":"Easy PayPal Events","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47518","published":"2025-05-07T14:20:05.704Z","updated":"2026-04-28T16:12:43.743Z","title":"WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Scott Paterson","product":"Contact Form 7 – PayPal & Stripe Add-on","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47517","published":"2025-05-07T14:20:05.164Z","updated":"2026-04-28T16:12:43.846Z","title":"WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Scott Paterson","product":"Accept Donations with PayPal & Stripe","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-47516","published":"2025-05-07T14:20:04.612Z","updated":"2026-04-28T16:12:43.753Z","title":"WordPress Time Clock plugin <= 1.2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Scott Paterson","product":"Time Clock","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47515","published":"2025-05-07T14:20:04.052Z","updated":"2026-04-28T16:12:43.648Z","title":"WordPress WP DPE-GES plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Seb","product":"WP DPE-GES","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-47514","published":"2025-05-07T14:20:03.010Z","updated":"2026-04-28T16:12:43.402Z","title":"WordPress ELI's Related Posts Footer Links and Widget plugin <= 1.2.04.20 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Eli","product":"ELI's Related Posts Footer Links and Widget","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-47510","published":"2025-05-07T14:20:02.450Z","updated":"2026-04-28T16:12:43.322Z","title":"WordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"fullworks","product":"Display Eventbrite Events","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47509","published":"2025-05-07T14:20:01.441Z","updated":"2026-04-28T16:12:43.323Z","title":"WordPress Top 10 plugin <= 4.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ajay","product":"Top 10","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47508","published":"2025-05-07T14:20:00.876Z","updated":"2026-04-28T16:12:43.492Z","title":"WordPress GamiPress plugin <= 7.3.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47507","published":"2025-05-07T14:20:00.240Z","updated":"2026-04-28T16:12:43.523Z","title":"WordPress Better Search plugin <= 4.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ajay","product":"Better Search","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47506","published":"2025-05-07T14:19:59.589Z","updated":"2026-04-28T16:12:43.490Z","title":"WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ajay","product":"Contextual Related Posts","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-47505","published":"2025-05-07T14:19:59.049Z","updated":"2026-05-12T00:15:15.174Z","title":"WordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ProWCPlugins","product":"Product Time Countdown for WooCommerce","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47504","published":"2025-05-07T14:19:58.472Z","updated":"2026-05-12T00:15:56.884Z","title":"WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Custom Checkout Fields for WooCommerce","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47503","published":"2025-05-07T14:19:57.932Z","updated":"2026-04-28T16:12:43.063Z","title":"WordPress NGG Smart Image Search plugin <= 3.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpo-HR","product":"NGG Smart Image Search","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47502","published":"2025-05-07T14:19:57.397Z","updated":"2026-04-28T16:12:43.160Z","title":"WordPress Mollie Forms plugin <= 2.7.12 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nick van Wobbie","product":"Mollie Forms","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47501","published":"2025-05-07T14:19:56.858Z","updated":"2026-04-28T16:12:42.966Z","title":"WordPress Content Control plugin <= 2.6.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Daniel Iser","product":"Content Control","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47499","published":"2025-05-07T14:19:56.307Z","updated":"2026-05-12T00:15:43.919Z","title":"WordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Starr","product":"Simple Blog Stats","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47498","published":"2025-05-07T14:19:55.784Z","updated":"2026-04-28T16:12:42.901Z","title":"WordPress Hotel Booking plugin <= 3.6 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47497","published":"2025-05-07T14:19:55.254Z","updated":"2026-04-28T16:12:42.910Z","title":"WordPress Logo Showcase plugin <= 3.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Logo Showcase","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-47496","published":"2025-05-07T14:19:54.712Z","updated":"2026-04-28T16:12:42.896Z","title":"WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47495","published":"2025-05-07T14:19:54.179Z","updated":"2026-04-28T16:12:42.902Z","title":"WordPress Blockspare plugin <= 3.2.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Blockspare","product":"Blockspare","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47494","published":"2025-05-07T14:19:53.669Z","updated":"2026-04-28T16:12:42.779Z","title":"WordPress EventON plugin <= 2.4.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47493","published":"2025-05-07T14:19:53.136Z","updated":"2026-04-28T16:12:42.766Z","title":"WordPress Ultimate Blocks plugin <= 3.2.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ultimate Blocks","product":"Ultimate Blocks","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-47491","published":"2025-05-07T14:19:52.529Z","updated":"2026-04-28T16:12:42.730Z","title":"WordPress Contact Form Widget plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.4,"vendor":"A WP Life","product":"Contact Form Widget","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-47490","published":"2025-05-07T14:19:51.954Z","updated":"2026-04-28T16:12:42.780Z","title":"WordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Rustaurius","product":"Ultimate WP Mail","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-47489","published":"2025-05-07T14:19:51.412Z","updated":"2026-04-28T16:12:42.605Z","title":"WordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"markkinchin","product":"Beds24 Online Booking","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47488","published":"2025-05-07T14:19:50.895Z","updated":"2026-04-28T16:12:42.732Z","title":"WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-47486","published":"2025-05-07T14:19:50.173Z","updated":"2026-04-28T16:12:42.631Z","title":"WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CyberChimps","product":"Responsive Plus","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-47485","published":"2025-05-07T14:19:49.606Z","updated":"2026-04-28T16:12:42.772Z","title":"WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-47484","published":"2025-05-07T14:19:49.070Z","updated":"2026-04-28T16:12:42.699Z","title":"WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Oliver Campion","product":"Display Remote Posts Block","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-47483","published":"2025-05-07T14:19:48.533Z","updated":"2026-04-28T16:12:42.532Z","title":"WordPress Easy Replace Image plugin <= 3.5.0 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Iulia Cazan","product":"Easy Replace Image","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-47482","published":"2025-05-07T14:19:47.987Z","updated":"2026-04-28T16:12:42.620Z","title":"WordPress SKT Skill Bar plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Skill Bar","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47481","published":"2025-05-07T14:19:47.462Z","updated":"2026-04-28T16:12:42.588Z","title":"WordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"GS Plugins","product":"GS Testimonial Slider","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-47480","published":"2025-05-07T14:19:46.919Z","updated":"2026-04-28T16:12:42.324Z","title":"WordPress Graphina plugin <= 3.0.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Iqonic Design","product":"Graphina","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47476","published":"2025-05-07T14:19:46.405Z","updated":"2026-04-28T16:12:42.306Z","title":"WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"add-ons.org","product":"Cost Calculator for Elementor","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47475","published":"2025-05-07T14:19:45.866Z","updated":"2026-04-28T16:12:42.161Z","title":"WordPress JupiterX Core plugin <= 4.8.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"artbees","product":"JupiterX Core","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2025-47473","published":"2025-05-07T14:19:45.328Z","updated":"2026-04-28T16:12:42.109Z","title":"WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pimwick","product":"PW WooCommerce Bulk Edit","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-47472","published":"2025-05-07T14:19:44.797Z","updated":"2026-04-28T16:12:42.391Z","title":"WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"codepeople","product":"Music Player for WooCommerce","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47471","published":"2025-05-07T14:19:44.249Z","updated":"2026-04-28T16:12:42.431Z","title":"WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EnvoThemes","product":"Envo Extra","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-47470","published":"2025-05-07T14:19:43.736Z","updated":"2026-04-28T16:12:42.137Z","title":"WordPress GPT3 AI Content Writer plugin <= 1.9.14 - Cross Site Request Forgery (CSRF) to Prompt Generation vulnerability","severity":"MEDIUM","score":4.3,"vendor":"senols","product":"GPT3 AI Content Writer","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47469","published":"2025-05-07T14:19:43.203Z","updated":"2026-04-28T16:12:42.129Z","title":"WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"slui","product":"Media Hygiene","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47468","published":"2025-05-07T14:19:42.668Z","updated":"2026-04-28T16:12:42.008Z","title":"WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"hashthemes","product":"Hash Form","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47467","published":"2025-05-07T14:19:42.133Z","updated":"2026-04-28T16:12:41.781Z","title":"WordPress GS Testimonial Slider plugin <= 3.3.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"GS Plugins","product":"GS Testimonial Slider","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-47466","published":"2025-05-07T14:19:41.585Z","updated":"2026-04-28T16:12:42.017Z","title":"WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Rustaurius","product":"Ultimate WP Mail","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-47465","published":"2025-05-07T14:19:41.065Z","updated":"2026-04-28T16:12:42.018Z","title":"WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"creativethemeshq","product":"Blocksy","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-47464","published":"2025-05-07T14:19:40.549Z","updated":"2026-04-28T16:12:41.908Z","title":"WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"solacewp","product":"Solace Extra","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-47462","published":"2025-05-07T14:19:40.037Z","updated":"2026-05-12T00:15:36.970Z","title":"WordPress Challan plugin <= 3.7.58 - CSRF to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WebAppick","product":"Challan","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-47460","published":"2025-05-07T14:19:39.465Z","updated":"2026-04-28T16:12:41.693Z","title":"WordPress TrackShip for WooCommerce plugin <= 1.9.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"TrackShip","product":"TrackShip for WooCommerce","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-47459","published":"2025-05-07T14:19:38.923Z","updated":"2026-04-28T16:12:41.634Z","title":"WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47457","published":"2025-05-07T14:19:38.392Z","updated":"2026-05-12T00:14:45.310Z","title":"WordPress LocateAndFilter plugin <= 1.6.16 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"dgamoni","product":"LocateAndFilter","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2025-47456","published":"2025-05-07T14:19:37.838Z","updated":"2026-04-28T16:12:41.504Z","title":"WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Zendesk","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-47455","published":"2025-05-07T14:19:37.300Z","updated":"2026-04-28T16:12:41.191Z","title":"WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"Integration for WooCommerce and Salesforce","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-47454","published":"2025-05-07T14:19:36.753Z","updated":"2026-04-28T16:12:41.239Z","title":"WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"CRM Perks","product":"WP Gravity Forms Dynamics CRM","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-47451","published":"2025-05-07T14:19:36.213Z","updated":"2026-04-28T16:12:40.847Z","title":"WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"silverplugins217","product":"Product Quantity Dropdown For Woocommerce","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47450","published":"2025-05-07T14:19:35.682Z","updated":"2026-04-28T16:12:40.893Z","title":"WordPress Simple File List plugin <= 6.1.13 - Settings Change Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2025-47449","published":"2025-05-07T14:19:35.143Z","updated":"2026-05-12T00:14:24.649Z","title":"WordPress Meow Gallery plugin <= 5.2.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Jordy Meow","product":"Meow Gallery","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-47448","published":"2025-05-07T14:19:34.598Z","updated":"2026-04-28T16:12:40.907Z","title":"WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"WP Hotel Booking","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47447","published":"2025-05-07T14:19:34.070Z","updated":"2026-04-28T16:12:40.993Z","title":"WordPress Cool Author Box plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hossni Mubarak","product":"Cool Author Box","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47446","published":"2025-05-07T14:19:33.520Z","updated":"2026-04-28T16:12:40.810Z","title":"WordPress Listamester plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"listamester","product":"Listamester","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-47443","published":"2025-05-07T14:19:32.982Z","updated":"2026-04-28T16:12:41.274Z","title":"WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevart","product":"Widget Countdown","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-47442","published":"2025-05-07T14:19:32.404Z","updated":"2026-04-28T16:12:40.902Z","title":"WordPress CC BMI Calculator plugin <= 2.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CC","product":"CC BMI Calculator","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47441","published":"2025-05-07T14:19:31.824Z","updated":"2026-05-12T00:14:38.206Z","title":"WordPress Progress Bar plugin <= 2.2.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chris Reynolds","product":"Progress Bar","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-47440","published":"2025-05-07T14:19:31.226Z","updated":"2026-04-28T16:12:40.918Z","title":"WordPress WPAdverts plugin <= 2.2.2 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-47439","published":"2025-05-07T14:19:30.638Z","updated":"2026-04-28T16:12:40.906Z","title":"WordPress Download Monitor plugin <= 5.0.22 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00798,"kevAdded":null},{"id":"CVE-2025-39361","published":"2025-05-07T09:03:05.729Z","updated":"2026-05-12T00:14:03.703Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Royal","product":"Royal Elementor Addons","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-39363","published":"2025-05-05T06:10:50.653Z","updated":"2026-04-28T16:12:29.475Z","title":"WordPress Custom Login and Registration <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AlphaEfficiencyTeam","product":"Custom Login and Registration","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-27007","published":"2025-05-01T10:54:56.209Z","updated":"2026-04-28T16:11:46.411Z","title":"WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.54188,"kevAdded":null},{"id":"CVE-2025-39413","published":"2025-04-30T17:18:59.319Z","updated":"2026-04-28T16:12:30.603Z","title":"WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Gwyer","product":"Simple Sitemap – Create a Responsive HTML Sitemap","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-39367","published":"2025-04-28T09:07:23.071Z","updated":"2026-04-28T16:12:29.568Z","title":"WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SeventhQueen","product":"Kleo","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46535","published":"2025-04-25T08:05:56.925Z","updated":"2026-04-28T16:12:40.124Z","title":"WordPress Custom Login and Registration plugin <= 1.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"AlphaEfficiencyTeam","product":"Custom Login and Registration","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-46482","published":"2025-04-25T07:52:09.343Z","updated":"2026-04-28T16:12:39.144Z","title":"WordPress WP Quiz plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MyThemeShop","product":"WP Quiz","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-46498","published":"2025-04-24T16:09:27.592Z","updated":"2026-04-28T16:12:39.242Z","title":"WordPress Zalo Official Live Chat plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"nghialuu","product":"Zalo Official Live Chat","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-46473","published":"2025-04-24T16:09:27.002Z","updated":"2026-04-28T16:12:38.449Z","title":"WordPress Social Counter plugin <= 2.0.5 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"Prisna","product":"Social Counter","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-46523","published":"2025-04-24T16:09:26.412Z","updated":"2026-04-28T16:12:40.096Z","title":"WordPress COVID-19 (Coronavirus) Update Your Customers plugin <= 1.5.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"devignstudiosltd","product":"COVID-19 (Coronavirus) Update Your Customers","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46507","published":"2025-04-24T16:09:25.870Z","updated":"2026-04-28T16:12:39.648Z","title":"WordPress Unsafe Mimetypes plugin <= 0.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ldrumm","product":"Unsafe Mimetypes","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46481","published":"2025-04-24T16:09:25.310Z","updated":"2026-04-28T16:12:39.149Z","title":"WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability","severity":"HIGH","score":7.2,"vendor":"Michael Cannon","product":"Flickr Shortcode Importer","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-46447","published":"2025-04-24T16:09:24.737Z","updated":"2026-04-28T16:12:37.624Z","title":"WordPress Fable Extra plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFable","product":"Fable Extra","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46531","published":"2025-04-24T16:09:24.176Z","updated":"2026-04-28T16:12:40.067Z","title":"WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Ankur Vishwakarma","product":"WP AVCL Automation Helper (formerly WPFlyLeads)","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-46519","published":"2025-04-24T16:09:23.610Z","updated":"2026-04-28T16:12:39.767Z","title":"WordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"M.Code","product":"Media Library Downloader","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-46511","published":"2025-04-24T16:09:23.029Z","updated":"2026-04-28T16:12:39.705Z","title":"WordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Derek Springer","product":"BeerXML Shortcode","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-46503","published":"2025-04-24T16:09:22.403Z","updated":"2026-04-28T16:12:39.660Z","title":"WordPress Simple Google Photos Grid plugin <= 1.5 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"josheli","product":"Simple Google Photos Grid","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-46489","published":"2025-04-24T16:09:21.826Z","updated":"2026-04-28T16:12:39.160Z","title":"WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"vinodvaswani9","product":"Bulk Assign Linked Products For WooCommerce","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-46485","published":"2025-04-24T16:09:21.243Z","updated":"2026-04-28T16:12:39.210Z","title":"WordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Carlo La Pera","product":"WP Customize Login Page","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-46477","published":"2025-04-24T16:09:20.659Z","updated":"2026-04-28T16:12:38.608Z","title":"WordPress WP Customize Login Page plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Carlo La Pera","product":"WP Customize Login Page","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-46469","published":"2025-04-24T16:09:20.096Z","updated":"2026-04-28T16:12:38.699Z","title":"WordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Benjamin Buddle","product":"Send From","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-46459","published":"2025-04-24T16:09:19.533Z","updated":"2026-05-12T00:13:30.084Z","title":"WordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ralf Hortt","product":"Confirm User Registration","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-46451","published":"2025-04-24T16:09:18.875Z","updated":"2026-04-28T16:12:37.593Z","title":"WordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Syed Balkhi","product":"Floating Social Bar","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-46442","published":"2025-04-24T16:09:18.296Z","updated":"2026-05-12T00:13:16.759Z","title":"WordPress Loan Calculator plugin <= 1.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Casey Johnson","product":"Loan Calculator","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46541","published":"2025-04-24T16:09:17.735Z","updated":"2026-04-28T16:12:40.713Z","title":"WordPress WP-reCAPTCHA-bp plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"elrata_","product":"WP-reCAPTCHA-bp","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46533","published":"2025-04-24T16:09:17.200Z","updated":"2026-04-28T16:12:40.187Z","title":"WordPress Landing pages and Domain aliases for WordPress plugin <= 0.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpdrift.no","product":"Landing pages and Domain aliases for WordPress","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46529","published":"2025-04-24T16:09:16.627Z","updated":"2026-04-28T16:12:40.097Z","title":"WordPress Business Contact Widget plugin <= 2.7.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"StressFree Sites","product":"Business Contact Widget","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46525","published":"2025-04-24T16:09:15.981Z","updated":"2026-04-28T16:12:40.074Z","title":"WordPress WP Cookie Consent plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"msmitley","product":"WP Cookie Consent","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46521","published":"2025-04-24T16:09:15.417Z","updated":"2026-04-28T16:12:40.067Z","title":"WordPress WS Force Login Page plugin <= 3.0.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Silver Muru","product":"WS Force Login Page","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46517","published":"2025-04-24T16:09:14.847Z","updated":"2026-04-28T16:12:39.783Z","title":"WordPress Blog Manager WP plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpdiscover","product":"Blog Manager WP","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46513","published":"2025-04-24T16:09:14.256Z","updated":"2026-04-28T16:12:39.649Z","title":"WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Codebangers","product":"All in One Time Clock Lite","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-46509","published":"2025-04-24T16:09:13.671Z","updated":"2026-04-28T16:12:39.719Z","title":"WordPress 360 View plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Andrey Mikhalchuk","product":"360 View","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46505","published":"2025-04-24T16:09:13.086Z","updated":"2026-04-28T16:12:39.693Z","title":"WordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"farinspace","product":"Peekaboo","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46501","published":"2025-04-24T16:09:12.520Z","updated":"2026-04-28T16:12:39.602Z","title":"WordPress Mixcloud Embed plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"biancardi","product":"Mixcloud Embed","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46496","published":"2025-04-24T16:09:11.948Z","updated":"2026-04-28T16:12:39.283Z","title":"WordPress Mini twitter feed plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"oniswap","product":"Mini twitter feed","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46491","published":"2025-04-24T16:09:11.340Z","updated":"2026-04-28T16:12:39.087Z","title":"WordPress Multi-Column Taxonomy List plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Matthew Muro","product":"Multi-Column Taxonomy List","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46483","published":"2025-04-24T16:09:10.780Z","updated":"2026-04-28T16:12:39.175Z","title":"WordPress Peadig’s Google +1 Button plugin <= 0.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Alex Moss","product":"Peadig’s Google +1 Button","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46479","published":"2025-04-24T16:09:10.182Z","updated":"2026-04-28T16:12:38.797Z","title":"WordPress BBCode Deluxe plugin <= 2020.08.01.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DevynCJohnson","product":"BBCode Deluxe","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46475","published":"2025-04-24T16:09:09.631Z","updated":"2026-04-28T16:12:38.510Z","title":"WordPress Able Player plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Joe Dolson","product":"Able Player","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46471","published":"2025-04-24T16:09:09.084Z","updated":"2026-04-28T16:12:38.102Z","title":"WordPress WP Custom Post Popup plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"gnanavelshenll","product":"WP Custom Post Popup","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46467","published":"2025-04-24T16:09:08.500Z","updated":"2026-04-28T16:12:38.171Z","title":"WordPress RAphicon plugin <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rahendra Putra K™","product":"RAphicon","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46461","published":"2025-04-24T16:09:07.900Z","updated":"2026-04-28T16:12:38.054Z","title":"WordPress RRSSB plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Relentless Apps","product":"RRSSB","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46457","published":"2025-04-24T16:09:07.315Z","updated":"2026-04-28T16:12:37.864Z","title":"WordPress Wp Custom CMS Block plugin <= 2.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Ahsanullah Akanda","product":"Wp Custom CMS Block","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46453","published":"2025-04-24T16:09:06.761Z","updated":"2025-05-10T02:55:25.315Z","title":"WordPress Zoho Creator Forms <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CreatorTeam","product":"Zoho Creator Forms","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46449","published":"2025-04-24T16:09:06.198Z","updated":"2026-04-28T16:12:37.472Z","title":"WordPress WoWHead Tooltips plugin <= 2.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Novium","product":"WoWHead Tooltips","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-46445","published":"2025-04-24T16:09:05.610Z","updated":"2026-04-28T16:12:37.640Z","title":"WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pReya","product":"External Markdown","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46438","published":"2025-04-24T16:09:04.975Z","updated":"2026-04-28T16:12:37.474Z","title":"WordPress GTDB Guitar Tuners plugin <= 4.2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"warmwhisky","product":"GTDB Guitar Tuners","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46542","published":"2025-04-24T16:09:04.346Z","updated":"2026-04-28T16:12:40.632Z","title":"WordPress Xpert Tab plugin <=  1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeXpert","product":"Xpert Tab","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-46540","published":"2025-04-24T16:09:03.777Z","updated":"2026-05-12T00:13:10.233Z","title":"WordPress GNA Search Shortcode plugin <= 0.9.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chris Mok","product":"GNA Search Shortcode","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-46538","published":"2025-04-24T16:09:03.118Z","updated":"2026-04-28T16:12:40.215Z","title":"WordPress Inline Text Popup plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webplanetsoft","product":"Inline Text Popup","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-46536","published":"2025-04-24T16:09:02.349Z","updated":"2026-04-28T16:12:40.089Z","title":"WordPress Carousel-of-post-images plugin <= 1.07 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RichardHarrison","product":"Carousel-of-post-images","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-46534","published":"2025-04-24T16:09:01.686Z","updated":"2026-04-28T16:12:40.177Z","title":"WordPress Image Style Hover plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DanielRiera","product":"Image Style Hover","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-46532","published":"2025-04-24T16:09:00.993Z","updated":"2026-04-28T16:12:40.066Z","title":"WordPress Tooltip plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Haris Zulfiqar","product":"Tooltip","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-46530","published":"2025-04-24T16:09:00.348Z","updated":"2026-04-28T16:12:40.153Z","title":"WordPress Hacklog Remote Attachment plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"HuangYe WuDeng","product":"Hacklog Remote Attachment","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46528","published":"2025-04-24T16:08:59.415Z","updated":"2026-04-28T16:12:40.206Z","title":"WordPress Availability Calendar plugin <= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Steve","product":"Availability Calendar","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46524","published":"2025-04-24T16:08:58.832Z","updated":"2026-05-12T00:13:03.622Z","title":"WordPress WP Filter Post Category plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"stesvis","product":"WP Filter Post Category","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46522","published":"2025-04-24T16:08:58.176Z","updated":"2026-04-28T16:12:40.012Z","title":"WordPress Tabs plugin <= 4.0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Billy Bryant","product":"Tabs","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46520","published":"2025-04-24T16:08:57.612Z","updated":"2026-04-28T16:12:40.031Z","title":"WordPress Related Posts via Taxonomies plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"alphasis","product":"Related Posts via Taxonomies","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46516","published":"2025-04-24T16:08:57.029Z","updated":"2026-04-28T16:12:39.733Z","title":"WordPress Twitter Card Generator plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"silencecm","product":"Twitter Card Generator","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46514","published":"2025-04-24T16:08:56.469Z","updated":"2026-04-28T16:12:39.606Z","title":"WordPress Milat jQuery Automatic Popup plugin <= 1.3.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"milat","product":"Milat jQuery Automatic Popup","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46512","published":"2025-04-24T16:08:55.906Z","updated":"2026-04-28T16:12:39.770Z","title":"WordPress Custom Functions Plugin plugin <= 1.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamim Hasan","product":"Custom Functions Plugin","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-46510","published":"2025-04-24T16:08:55.340Z","updated":"2026-04-28T16:12:39.746Z","title":"WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"harrysudana","product":"Contact Form 7 Calendar","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-46508","published":"2025-04-24T16:08:54.763Z","updated":"2026-04-28T16:12:39.776Z","title":"WordPress Advanced lazy load plugin <=  1.6.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"kasonzhao","product":"Advanced lazy load","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46506","published":"2025-04-24T16:08:54.198Z","updated":"2026-05-12T00:13:57.315Z","title":"WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Lora77","product":"WpZon – Amazon Affiliate Plugin","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46504","published":"2025-04-24T16:08:53.617Z","updated":"2026-04-28T16:12:39.726Z","title":"WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Olar Marius","product":"Vasaio QR Code","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46502","published":"2025-04-24T16:08:53.027Z","updated":"2026-04-28T16:12:39.695Z","title":"WordPress LSD Custom taxonomy and category meta plugin <= 1.3.2 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Bas Matthee","product":"LSD Custom taxonomy and category meta","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-46499","published":"2025-04-24T16:08:52.364Z","updated":"2026-04-28T16:12:39.200Z","title":"WordPress PayPal Express Checkout plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"hccoder","product":"PayPal Express Checkout","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-46497","published":"2025-04-24T16:08:51.811Z","updated":"2026-04-28T16:12:39.331Z","title":"WordPress Navegg Analytics plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Navegg","product":"Navegg Analytics","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46495","published":"2025-04-24T16:08:51.253Z","updated":"2026-05-12T00:13:50.880Z","title":"WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tomontoast","product":"Drop Caps","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-46492","published":"2025-04-24T16:08:50.656Z","updated":"2026-04-28T16:12:39.216Z","title":"WordPress Call Now PHT Blog plugin <= 2.4.1 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Pham Thanh","product":"Call Now PHT Blog","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46484","published":"2025-04-24T16:08:50.044Z","updated":"2026-05-12T00:13:36.985Z","title":"WordPress Image Hover Effects For WPBakery Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nasir179125","product":"Image Hover Effects For WPBakery Page Builder","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46480","published":"2025-04-24T16:08:49.476Z","updated":"2026-04-28T16:12:38.720Z","title":"WordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Padam Shankhadev","product":"Nepali Post Date","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46478","published":"2025-04-24T16:08:48.936Z","updated":"2026-04-28T16:12:38.927Z","title":"WordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"metaloha","product":"Dropdown Content","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-46476","published":"2025-04-24T16:08:48.389Z","updated":"2026-04-28T16:12:39.038Z","title":"WordPress Awesome Wp Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nayon46","product":"Awesome Wp Image Gallery","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-46472","published":"2025-04-24T16:08:47.811Z","updated":"2026-04-28T16:12:38.692Z","title":"WordPress The Pack Elementor addons plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webangon","product":"The Pack Elementor addons","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46470","published":"2025-04-24T16:08:47.237Z","updated":"2026-04-28T16:12:38.423Z","title":"WordPress Smart Hashtags [#hashtagger] plugin <= 7.2.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Peter Raschendorfer","product":"Smart Hashtags [#hashtagger]","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-46466","published":"2025-04-24T16:08:46.654Z","updated":"2026-04-28T16:12:38.631Z","title":"WordPress Modern Polls plugin <= 1.0.10 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"felixtz","product":"Modern Polls","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46465","published":"2025-04-24T16:08:46.067Z","updated":"2026-04-28T16:12:38.601Z","title":"WordPress Print Science Designer plugin <= 1.3.155 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"John Weissberg","product":"Print Science Designer","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46462","published":"2025-04-24T16:08:45.464Z","updated":"2026-04-28T16:12:37.963Z","title":"WordPress WPVN plugin <= 0.7.8 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Trân Minh-Quân","product":"WPVN","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-46452","published":"2025-04-24T16:08:44.886Z","updated":"2026-04-28T16:12:37.675Z","title":"WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Olav Kolbu","product":"Google News","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46450","published":"2025-04-24T16:08:44.315Z","updated":"2026-04-28T16:12:37.460Z","title":"WordPress occupancyplan plugin <= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"x000x","product":"occupancyplan","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-46443","published":"2025-04-24T16:08:43.760Z","updated":"2026-04-28T16:12:37.662Z","title":"WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Adam Pery","product":"Animate","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-46436","published":"2025-04-24T16:08:43.210Z","updated":"2026-04-28T16:12:37.399Z","title":"WordPress SCSS-Library plugin <= 0.4.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sebastian Echeverry","product":"SCSS-Library","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-46439","published":"2025-04-24T16:08:42.652Z","updated":"2026-04-28T16:12:37.644Z","title":"WordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"Vladimir Prelovac","product":"Plugin Central","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-46435","published":"2025-04-24T16:08:42.077Z","updated":"2026-05-12T00:13:23.152Z","title":"WordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Yash Binani","product":"Time Based Greeting","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-32921","published":"2025-04-24T16:08:41.481Z","updated":"2026-04-28T16:12:29.009Z","title":"WordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"wpoperations","product":"Arrival","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2025-39359","published":"2025-04-24T16:08:40.918Z","updated":"2026-05-12T00:12:43.814Z","title":"WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"codeworkweb","product":"CWW Portfolio","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39360","published":"2025-04-24T16:08:40.355Z","updated":"2026-04-28T16:12:29.462Z","title":"WordPress Grace Mag theme <= 1.1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"everestthemes","product":"Grace Mag","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39377","published":"2025-04-24T16:08:39.803Z","updated":"2026-05-12T00:12:50.235Z","title":"WordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"weDevs","product":"Appsero Helper","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2025-39378","published":"2025-04-24T16:08:39.225Z","updated":"2026-04-28T16:12:29.761Z","title":"WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Holest Engineering","product":"Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39379","published":"2025-04-24T16:08:38.642Z","updated":"2026-04-28T16:12:29.768Z","title":"WordPress Capturly plugin <= 2.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Capturly","product":"Capturly","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2025-39381","published":"2025-04-24T16:08:38.048Z","updated":"2026-04-28T16:12:29.819Z","title":"WordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Kiotviet","product":"KiotViet Sync","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39382","published":"2025-04-24T16:08:37.380Z","updated":"2026-04-28T16:12:29.807Z","title":"WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"danielpataki","product":"ACF: Google Font Selector","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39383","published":"2025-04-24T16:08:36.801Z","updated":"2026-05-12T00:12:56.652Z","title":"WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"codeworkweb","product":"Xews Lite","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39384","published":"2025-04-24T16:08:36.231Z","updated":"2026-04-28T16:12:29.775Z","title":"WordPress Product Lister for eBay plugin <= 2.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"cedcommerce","product":"Product Lister for eBay","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39385","published":"2025-04-24T16:08:35.631Z","updated":"2026-04-28T16:12:29.800Z","title":"WordPress Sirat theme <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"vowelweb","product":"Sirat","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-39387","published":"2025-04-24T16:08:35.023Z","updated":"2026-04-28T16:12:29.851Z","title":"WordPress Opstore theme <= 1.4.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"wpoperations","product":"Opstore","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39390","published":"2025-04-24T16:08:34.464Z","updated":"2026-04-28T16:12:30.225Z","title":"WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-39391","published":"2025-04-24T16:08:33.921Z","updated":"2026-04-29T09:51:54.966Z","title":"WordPress Checkout Field Visibility for WooCommerce plugin  <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"zamartz","product":"Checkout Field Visibility for WooCommerce","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39397","published":"2025-04-24T16:08:33.176Z","updated":"2026-04-28T16:12:30.211Z","title":"WordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gopiplus@hotmail.com","product":"Anything Popup","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39399","published":"2025-04-24T16:08:32.610Z","updated":"2026-04-28T16:12:30.199Z","title":"WordPress License For Envato plugin <= 1.0.0 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Ashraful Sarkar Naiem","product":"License For Envato","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2025-39400","published":"2025-04-24T16:08:32.039Z","updated":"2026-04-28T16:12:30.146Z","title":"WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2025-39404","published":"2025-04-24T16:08:31.465Z","updated":"2026-04-28T16:12:30.280Z","title":"WordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Heateor Support","product":"Sassy Social Share","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-39408","published":"2025-04-24T16:08:30.866Z","updated":"2026-04-28T16:12:30.574Z","title":"WordPress BruteGuard – Brute Force Login Protection plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EverPress","product":"BruteGuard – Brute Force Login Protection","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-46264","published":"2025-04-24T16:08:30.311Z","updated":"2026-04-28T16:12:37.343Z","title":"WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2025-46230","published":"2025-04-24T16:08:29.765Z","updated":"2026-05-12T00:13:43.900Z","title":"WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"GhozyLab","product":"Popup Builder","kev":false,"epss":0.00778,"kevAdded":null},{"id":"CVE-2025-46234","published":"2025-04-24T16:08:29.212Z","updated":"2026-04-28T16:12:36.722Z","title":"WordPress Control Listings plugin <= 1.0.4.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Habibur Rahman Razib","product":"Control Listings","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-46248","published":"2025-04-24T16:08:28.641Z","updated":"2026-04-28T16:12:36.940Z","title":"WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"M A Vinoth Kumar","product":"Frontend Dashboard","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-46260","published":"2025-04-24T16:08:28.044Z","updated":"2026-04-28T16:12:37.061Z","title":"WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wowDevs","product":"Sky Addons for Elementor","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-46261","published":"2025-04-24T16:08:27.421Z","updated":"2026-04-28T16:12:37.177Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Craig Hewitt","product":"Seriously Simple Podcasting","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-46254","published":"2025-04-22T09:53:35.769Z","updated":"2026-05-12T00:12:16.479Z","title":"WordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46253","published":"2025-04-22T09:53:35.152Z","updated":"2026-05-12T00:11:56.862Z","title":"WordPress GutenKit plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ataur R","product":"GutenKit","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46252","published":"2025-04-22T09:53:34.550Z","updated":"2026-08-24T16:36:55.834Z","title":"WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Kofi Mokome","product":"Message Filter for Contact Form 7","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-46251","published":"2025-04-22T09:53:33.910Z","updated":"2026-04-28T16:12:37.027Z","title":"WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRestaurants","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-46250","published":"2025-04-22T09:53:33.170Z","updated":"2026-04-28T16:12:37.042Z","title":"WordPress VForm plugin <= 3.1.14 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Vikas Ratudi","product":"VPSUForm","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-46249","published":"2025-04-22T09:53:32.446Z","updated":"2026-04-28T16:12:37.051Z","title":"WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Michael","product":"Simple calendar for Elementor","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-46247","published":"2025-04-22T09:53:31.891Z","updated":"2026-04-28T16:12:36.985Z","title":"WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"codepeople","product":"Appointment Booking Calendar","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2025-46246","published":"2025-04-22T09:53:31.292Z","updated":"2026-04-28T16:12:37.078Z","title":"WordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreativeMindsSolutions","product":"CM Answers","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-46245","published":"2025-04-22T09:53:30.649Z","updated":"2026-05-12T00:12:03.342Z","title":"WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CreativeMindsSolutions","product":"CM Ad Changer","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-46244","published":"2025-04-22T09:53:30.018Z","updated":"2026-04-28T16:12:37.089Z","title":"WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Dotstore","product":"Advanced Linked Variations for Woocommerce","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-46243","published":"2025-04-22T09:53:29.407Z","updated":"2026-04-28T16:12:36.892Z","title":"WordPress Recover abandoned cart for WooCommerce plugin <= 2.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sonalsinha21","product":"Recover abandoned cart for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-46242","published":"2025-04-22T09:53:28.836Z","updated":"2026-04-28T16:12:36.802Z","title":"WordPress Watu Quiz plugin <= 3.4.3 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Bob","product":"Watu Quiz","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-46241","published":"2025-04-22T09:53:28.272Z","updated":"2026-04-28T16:12:36.933Z","title":"WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"codepeople","product":"Appointment Booking Calendar","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-46240","published":"2025-04-22T09:53:27.711Z","updated":"2026-04-28T16:12:36.795Z","title":"WordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Starr","product":"Simple Download Counter","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46239","published":"2025-04-22T09:53:27.116Z","updated":"2026-05-12T00:12:30.461Z","title":"WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Starr","product":"Theme Switcha","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46238","published":"2025-04-22T09:53:26.476Z","updated":"2026-04-28T16:12:36.761Z","title":"WordPress List Last Changes plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"rbaer","product":"List Last Changes","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46237","published":"2025-04-22T09:53:25.888Z","updated":"2026-04-28T16:12:36.753Z","title":"WordPress Link Library plugin <= 7.8 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Yannick Lefebvre","product":"Link Library","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46236","published":"2025-04-22T09:53:25.263Z","updated":"2026-04-28T16:12:36.726Z","title":"WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Link Software LLC","product":"HTML Forms","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46235","published":"2025-04-22T09:53:24.616Z","updated":"2026-05-12T00:12:23.487Z","title":"WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Blocks","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46233","published":"2025-04-22T09:53:23.959Z","updated":"2026-04-28T16:12:36.771Z","title":"WordPress Sirv plugin <= 7.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sirv CDN and Image Hosting","product":"Sirv","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-46232","published":"2025-04-22T09:53:23.356Z","updated":"2026-04-28T16:12:36.699Z","title":"WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"alttextai","product":"Download Alt Text AI","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-46231","published":"2025-04-22T09:53:22.691Z","updated":"2026-04-28T16:12:36.655Z","title":"WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SERVIT Software Solutions","product":"affiliate-toolkit","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-46229","published":"2025-04-22T09:53:22.034Z","updated":"2026-05-12T00:12:10.003Z","title":"WordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Israpil","product":"Textmetrics","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-46228","published":"2025-04-22T09:53:21.279Z","updated":"2026-04-28T16:12:36.531Z","title":"WordPress Event post plugin <= 5.9.11 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bastien Ho","product":"Event post","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46227","published":"2025-04-22T09:53:20.549Z","updated":"2026-05-12T00:12:36.883Z","title":"WordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brecht","product":"Custom Related Posts","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-46226","published":"2025-04-22T09:53:19.931Z","updated":"2026-04-28T16:12:36.451Z","title":"WordPress MPL-Publisher plugin <= 2.18.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ferranfg","product":"MPL-Publisher","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-46225","published":"2025-04-22T09:53:19.295Z","updated":"2026-04-28T16:12:36.455Z","title":"WordPress Post in page for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Michael","product":"Post in page for Elementor","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-39469","published":"2025-04-18T04:31:51.451Z","updated":"2026-04-28T16:12:32.191Z","title":"WordPress Modal Survey plugin <= 2.0.2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pantherius","product":"Modal Survey","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-39470","published":"2025-04-18T04:30:31.772Z","updated":"2026-04-28T16:12:32.232Z","title":"WordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"ThimPress","product":"Ivy School","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2025-39471","published":"2025-04-18T04:27:58.846Z","updated":"2026-04-28T16:12:32.202Z","title":"WordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"pantherius","product":"Modal Survey","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-23443","published":"2025-04-17T15:48:30.887Z","updated":"2026-04-28T16:11:08.873Z","title":"WordPress Author Showcase plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Claire Ryan","product":"Author Showcase","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-23448","published":"2025-04-17T15:48:30.246Z","updated":"2026-04-28T16:11:09.177Z","title":"WordPress visualslider Sldier plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dastan800","product":"visualslider Sldier","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-23773","published":"2025-04-17T15:48:29.605Z","updated":"2026-05-12T10:19:01.413Z","title":"WordPress Delete All Posts plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"mingocommerce","product":"Delete All Posts","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-23782","published":"2025-04-17T15:48:28.870Z","updated":"2026-05-12T23:59:36.576Z","title":"WordPress TotalContest Lite Plugin <= 2.8.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TotalSuite","product":"TotalContest Lite","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-23855","published":"2025-04-17T15:48:28.229Z","updated":"2026-05-12T23:59:07.691Z","title":"WordPress SpiderDisplay plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fyljp","product":"SpiderDisplay","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-23858","published":"2025-04-17T15:48:27.630Z","updated":"2026-05-12T23:58:52.640Z","title":"WordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hiren Patel","product":"Custom Users Order","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-23906","published":"2025-04-17T15:48:26.860Z","updated":"2026-04-28T16:11:24.424Z","title":"WordPress WordPress Dashboard Tweeter plugin <= 1.3.2 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpseek","product":"WordPress Dashboard Tweeter","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-23958","published":"2025-04-17T15:48:25.883Z","updated":"2026-05-12T23:59:22.098Z","title":"WordPress Editor Wysiwyg Background Color plugin <= 1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FADI MED","product":"Editor Wysiwyg Background Color","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-24539","published":"2025-04-17T15:48:24.798Z","updated":"2026-05-12T23:58:08.833Z","title":"WordPress DeBounce Email Validator plugin <= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"debounce","product":"DeBounce Email Validator","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24548","published":"2025-04-17T15:48:23.739Z","updated":"2026-04-28T16:11:28.392Z","title":"WordPress Autoglot – Automatic WordPress Translation plugin <=2.4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Autoglot","product":"Autoglot – Automatic WordPress Translation","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24550","published":"2025-04-17T15:48:22.667Z","updated":"2026-05-12T23:58:23.213Z","title":"WordPress Job Manager plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"JobScore","product":"Job Manager","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-24553","published":"2025-04-17T15:48:21.675Z","updated":"2026-05-12T23:57:39.916Z","title":"WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Akadrama","product":"Shipping with Venipak for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24577","published":"2025-04-17T15:48:20.641Z","updated":"2026-04-28T16:11:28.816Z","title":"WordPress Poll Maker plugin <= 5.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ays Pro","product":"Poll Maker","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-24581","published":"2025-04-17T15:48:20.004Z","updated":"2026-05-12T23:56:56.583Z","title":"WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Instantio","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-24583","published":"2025-04-17T15:48:19.413Z","updated":"2026-04-28T16:11:29.044Z","title":"WordPress 12 Step Meeting List plugin <= 3.16.5 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AA Web Servant","product":"12 Step Meeting List","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2025-24586","published":"2025-04-17T15:48:18.785Z","updated":"2026-05-12T23:57:25.490Z","title":"WordPress Shipment Tracker for Woocommerce plugin <= 1.4.23 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bitsstech","product":"Shipment Tracker for Woocommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24619","published":"2025-04-17T15:48:18.177Z","updated":"2026-05-12T23:57:11.015Z","title":"WordPress WP Log Action Plugin <= 0.51 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"webheadcoder","product":"WP Log Action","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24621","published":"2025-04-17T15:48:17.373Z","updated":"2026-05-12T23:57:54.345Z","title":"WordPress Arconix Shortcodes plugin <= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tychesoftwares","product":"Arconix Shortcodes","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24624","published":"2025-04-17T15:48:16.800Z","updated":"2026-05-12T00:09:41.883Z","title":"WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"DevItems","product":"HT Event","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24637","published":"2025-04-17T15:48:16.247Z","updated":"2026-04-28T16:11:30.904Z","title":"WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Syed Balkhi","product":"Beacon Lead Magnets and Lead Capture","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24640","published":"2025-04-17T15:48:15.650Z","updated":"2026-04-28T16:11:30.916Z","title":"WordPress Empty Tags Remover Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dan-Lucian Stefancu","product":"Empty Tags Remover","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24645","published":"2025-04-17T15:48:14.991Z","updated":"2026-04-28T16:11:31.243Z","title":"WordPress Eazy Under Construction Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rob Scott","product":"Eazy Under Construction","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24651","published":"2025-04-17T15:48:14.409Z","updated":"2026-04-29T09:51:54.284Z","title":"WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WebToffee","product":"WordPress Backup & Migration","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-24655","published":"2025-04-17T15:48:13.833Z","updated":"2026-04-28T16:11:31.279Z","title":"WordPress Wishlist Plugin <= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PickPlugins","product":"Wishlist","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24670","published":"2025-04-17T15:48:13.200Z","updated":"2026-05-12T00:10:23.777Z","title":"WordPress Term Taxonomy Converter Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dhanendran Rajagopal","product":"Term Taxonomy Converter","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24737","published":"2025-04-17T15:48:12.563Z","updated":"2026-04-28T16:11:33.708Z","title":"WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mat Bao Corporation","product":"WP Helper Premium","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2025-24745","published":"2025-04-17T15:48:11.976Z","updated":"2026-04-28T16:11:33.943Z","title":"WordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-24752","published":"2025-04-17T15:48:11.325Z","updated":"2026-04-28T16:11:33.944Z","title":"WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.01233,"kevAdded":null},{"id":"CVE-2025-27282","published":"2025-04-17T15:48:10.700Z","updated":"2026-04-28T16:11:46.936Z","title":"WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"rockgod100","product":"Theme File Duplicator","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2025-27283","published":"2025-04-17T15:48:10.111Z","updated":"2026-04-28T16:11:47.027Z","title":"WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"rockgod100","product":"Theme File Duplicator","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2025-27284","published":"2025-04-17T15:48:09.489Z","updated":"2026-04-28T16:11:47.333Z","title":"WordPress Flagged Content Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"divspark","product":"Flagged Content","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27285","published":"2025-04-17T15:48:08.862Z","updated":"2026-04-28T16:11:47.300Z","title":"WordPress Easy Form by AYS Plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Easy Form","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27286","published":"2025-04-17T15:48:08.252Z","updated":"2026-04-28T16:11:46.957Z","title":"WordPress Saoshyant Slider Plugin <= 3.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"saoshyant1994","product":"Saoshyant Slider","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-27287","published":"2025-04-17T15:48:07.668Z","updated":"2026-04-28T16:11:47.056Z","title":"WordPress SS Quiz Plugin <= 2.0.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ssvadim","product":"SS Quiz","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-27288","published":"2025-04-17T15:48:07.107Z","updated":"2026-04-28T16:11:46.987Z","title":"WordPress File Icons Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BjornW","product":"File Icons","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27289","published":"2025-04-17T15:48:06.475Z","updated":"2026-04-28T16:11:47.043Z","title":"WordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Antoine Guillien","product":"Restrict Taxonomies","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27291","published":"2025-04-17T15:48:05.842Z","updated":"2026-04-28T16:11:46.958Z","title":"WordPress Photo Gallery – Image Gallery Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"uxgallery","product":"WordPress Photo Gallery – Image Gallery","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27292","published":"2025-04-17T15:48:05.243Z","updated":"2026-04-28T16:11:47.147Z","title":"WordPress WPYog Documents Plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PoppinsDigital.com","product":"WPYog Documents","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27293","published":"2025-04-17T15:48:04.626Z","updated":"2026-04-28T16:11:47.616Z","title":"WordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"webparexapp","product":"Shipmozo Courier Tracking","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27295","published":"2025-04-17T15:48:04.019Z","updated":"2026-04-28T16:11:47.167Z","title":"WordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpion","product":"Live css","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27299","published":"2025-04-17T15:48:03.403Z","updated":"2026-04-28T16:11:47.614Z","title":"WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Asia","product":"MyTicket Events","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2025-27302","published":"2025-04-17T15:48:02.789Z","updated":"2026-04-28T16:11:47.603Z","title":"WordPress CHATLIVE plugin <= 2.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Claudio Adrian Marrero","product":"CHATLIVE","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-27308","published":"2025-04-17T15:48:02.182Z","updated":"2026-04-28T16:11:47.684Z","title":"WordPress WP Video Posts plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"cmstactics","product":"WP Video Posts","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27309","published":"2025-04-17T15:48:01.580Z","updated":"2026-04-28T16:11:47.838Z","title":"WordPress flickr-slideshow-wrapper Plugin <= 5.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jeannot Muller","product":"flickr-slideshow-wrapper","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27310","published":"2025-04-17T15:48:00.971Z","updated":"2026-04-28T16:11:47.952Z","title":"WordPress Page and Post Lister plugin <= 1.2.1 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Radius of Thought","product":"Page and Post Lister","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2025-27313","published":"2025-04-17T15:48:00.380Z","updated":"2026-04-28T16:11:47.900Z","title":"WordPress Google Maps GPX Viewer Plugin <= 3.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bernd Altmeier","product":"Google Maps GPX Viewer","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27314","published":"2025-04-17T15:47:59.427Z","updated":"2026-04-28T16:11:48.094Z","title":"WordPress Kush Micro News Plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kush Sharma","product":"Kush Micro News","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27319","published":"2025-04-17T15:47:58.815Z","updated":"2026-04-28T16:11:48.200Z","title":"WordPress User List plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ivan82","product":"User List","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27322","published":"2025-04-17T15:47:58.100Z","updated":"2026-04-28T16:11:48.173Z","title":"WordPress QR Code for WooCommerce Plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bappa Mal","product":"QR Code for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27324","published":"2025-04-17T15:47:57.446Z","updated":"2026-04-28T16:11:48.291Z","title":"WordPress 17TRACK for WooCommerce Plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"17track","product":"17TRACK for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27333","published":"2025-04-17T15:47:56.842Z","updated":"2026-04-28T16:11:48.360Z","title":"WordPress Protected wp-login Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"alvego","product":"Protected wp-login","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27337","published":"2025-04-17T15:47:56.090Z","updated":"2026-04-28T16:11:48.732Z","title":"WordPress Fontsampler Plugin <= 0.4.14 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kontur","product":"Fontsampler","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27338","published":"2025-04-17T15:47:55.491Z","updated":"2026-04-28T16:11:48.762Z","title":"WordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"graphems","product":"List Urls","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27343","published":"2025-04-17T15:47:54.840Z","updated":"2026-04-28T16:11:48.847Z","title":"WordPress WooCommerce HTML5 Video Plugin <= 1.7.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Webilop","product":"WooCommerce HTML5 Video","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27345","published":"2025-04-17T15:47:54.277Z","updated":"2026-04-28T16:11:48.880Z","title":"WordPress  Booking Ultra Pro Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Deetronix","product":"Booking Ultra Pro","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27346","published":"2025-04-17T15:47:53.686Z","updated":"2026-04-29T09:51:54.768Z","title":"WordPress Rebuild Permalinks Plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gerrygooner","product":"Rebuild Permalinks","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-27354","published":"2025-04-17T15:47:53.098Z","updated":"2026-04-28T16:11:48.904Z","title":"WordPress Simple Email Subscriber plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"phil88530","product":"Simple Email Subscriber","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-31006","published":"2025-04-17T15:47:52.392Z","updated":"2026-04-28T16:12:03.644Z","title":"WordPress Activity Reactions For Buddypress plugin <= 1.0.22 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"arete-it","product":"Activity Reactions For Buddypress","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-31018","published":"2025-04-17T15:47:51.760Z","updated":"2026-04-28T16:12:03.670Z","title":"WordPress FireDrum Email Marketing plugin <= 1.64 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FireDrum","product":"FireDrum Email Marketing","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-31030","published":"2025-04-17T15:47:51.131Z","updated":"2026-04-28T16:12:03.885Z","title":"WordPress Ray Enterprise Translation plugin <= 1.7.0 - Local File Inclusion via CSRF Vulnerability","severity":"HIGH","score":7.5,"vendor":"Jiro Sasamoto","product":"Ray Enterprise Translation","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-31380","published":"2025-04-17T15:47:50.544Z","updated":"2026-04-28T16:12:05.517Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"videowhisper","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2025-32490","published":"2025-04-17T15:47:49.951Z","updated":"2026-04-28T16:12:22.241Z","title":"WordPress wp secure plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WebsiteDefender","product":"wp secure","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32504","published":"2025-04-17T15:47:49.364Z","updated":"2026-04-28T16:12:23.198Z","title":"WordPress Silvasoft boekhouden plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"silvasoft","product":"Silvasoft boekhouden","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32506","published":"2025-04-17T15:47:48.768Z","updated":"2026-04-28T16:12:23.234Z","title":"WordPress AT Internet SmartTag plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BenDlz","product":"AT Internet SmartTag","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32507","published":"2025-04-17T15:47:48.145Z","updated":"2026-04-28T16:12:23.203Z","title":"WordPress Event Espresso  plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aakif Kadiwala","product":"Event Espresso – Custom Email Template Shortcode","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32508","published":"2025-04-17T15:47:47.488Z","updated":"2026-04-28T16:12:23.276Z","title":"WordPress Course Booking System plugin <= 6.1.2 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"ComMotion","product":"Course Booking System","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32511","published":"2025-04-17T15:47:46.894Z","updated":"2026-05-12T00:11:10.303Z","title":"WordPress Make Email Customizer for WooCommerce plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Excellent Dynamics","product":"Make Email Customizer for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32512","published":"2025-04-17T15:47:46.259Z","updated":"2026-04-28T16:12:23.283Z","title":"WordPress Revamp CRM for WooCommerce plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"revampcrm","product":"Revamp CRM for WooCommerce","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32513","published":"2025-04-17T15:47:45.615Z","updated":"2026-04-28T16:12:23.120Z","title":"WordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"totalprocessing","product":"Nomupay Payment Processing Gateway","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32514","published":"2025-04-17T15:47:45.024Z","updated":"2026-04-28T16:12:23.187Z","title":"WordPress WooCommerce Estimate and Quote plugin <= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"cscode","product":"WooCommerce Estimate and Quote","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32515","published":"2025-04-17T15:47:44.341Z","updated":"2026-04-28T16:12:23.199Z","title":"WordPress Terminal Africa plugin <= 1.13.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"terminalafrica","product":"Terminal Africa","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32516","published":"2025-04-17T15:47:43.727Z","updated":"2026-04-28T16:12:23.267Z","title":"WordPress Related Videos for JW Player plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ilGhera","product":"Related Videos for JW Player","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32520","published":"2025-04-17T15:47:43.138Z","updated":"2026-04-28T16:12:23.513Z","title":"WordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"M. Ali Saleem","product":"WordPress Health and Server Condition – Integrated with Google Page Speed","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32521","published":"2025-04-17T15:47:42.422Z","updated":"2026-04-28T16:12:23.495Z","title":"WordPress Cool Flipbox plugin <= 1.8.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CoolHappy","product":"Cool Flipbox – Shortcode & Gutenberg Block","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32522","published":"2025-04-17T15:47:41.771Z","updated":"2026-04-28T16:12:23.619Z","title":"WordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"License Manager for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32526","published":"2025-04-17T15:47:41.166Z","updated":"2026-04-28T16:12:23.712Z","title":"WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan James","product":"Zephyr Project Manager","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-32527","published":"2025-04-17T15:47:40.552Z","updated":"2026-05-12T00:11:23.857Z","title":"WordPress T&P Gallery Slider plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pey22","product":"T&P Gallery Slider","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32528","published":"2025-04-17T15:47:39.924Z","updated":"2026-04-28T16:12:23.633Z","title":"WordPress iCal Feeds Plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maximevalette","product":"iCal Feeds","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32529","published":"2025-04-17T15:47:39.316Z","updated":"2026-04-28T16:12:23.714Z","title":"WordPress iONE360 configurator plugin <= 2.0.57 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iONE360","product":"iONE360 configurator","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32530","published":"2025-04-17T15:47:38.705Z","updated":"2026-04-28T16:12:23.617Z","title":"WordPress Wallet System for WooCommerce plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Wallet System for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32531","published":"2025-04-17T15:47:38.054Z","updated":"2026-04-28T16:12:23.776Z","title":"WordPress Arconix FAQ plugin <= 1.9.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tychesoftwares","product":"Arconix FAQ","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32532","published":"2025-04-17T15:47:37.429Z","updated":"2026-04-28T16:12:23.675Z","title":"WordPress UXsniff plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pei Yong Goh","product":"UXsniff","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32533","published":"2025-04-17T15:47:36.795Z","updated":"2026-04-28T16:12:23.599Z","title":"WordPress Deliver via Shipos for WooCommerce Plugin <= 2.1.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Matat Technologies","product":"Deliver via Shipos for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32535","published":"2025-04-17T15:47:36.129Z","updated":"2026-04-28T16:12:23.684Z","title":"WordPress DN Shipping by Weight for WooCommerce Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"digireturn","product":"DN Shipping by Weight for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32540","published":"2025-04-17T15:47:35.516Z","updated":"2026-04-28T16:12:23.793Z","title":"WordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"feedify","product":"Feedify – Web Push Notifications","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32544","published":"2025-04-17T15:47:34.882Z","updated":"2026-04-28T16:12:24.058Z","title":"WordPress WooCommerce Loyal Customers plugin <= 2.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"The Right Software","product":"WooCommerce Loyal Customers","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-32545","published":"2025-04-17T15:47:34.259Z","updated":"2026-04-29T09:51:54.970Z","title":"WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SOFTAGON","product":"WooCommerce Products without featured images","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-32546","published":"2025-04-17T15:47:33.662Z","updated":"2026-04-28T16:12:24.051Z","title":"WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gtlwpdev","product":"All push notification for WP","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-32548","published":"2025-04-17T15:47:32.998Z","updated":"2026-04-28T16:12:24.083Z","title":"WordPress Hamburger Icon Menu Lite Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"borisolhor","product":"Hamburger Icon Menu Lite","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32552","published":"2025-04-17T15:47:32.374Z","updated":"2026-04-28T16:12:24.075Z","title":"WordPress MSRP (RRP) Pricing for WooCommerce Plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFactory","product":"MSRP (RRP) Pricing for WooCommerce","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32554","published":"2025-04-17T15:47:31.803Z","updated":"2026-04-28T16:12:24.061Z","title":"WordPress Raptive Ads plugin <= 3.7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Raptive","product":"Raptive Ads","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32557","published":"2025-04-17T15:47:31.229Z","updated":"2026-04-28T16:12:24.068Z","title":"WordPress WP Featured Screenshot Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rico Macchi","product":"WP Featured Screenshot","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32560","published":"2025-04-17T15:47:30.634Z","updated":"2026-04-28T16:12:24.088Z","title":"WordPress WP-Hijri Plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohammad I. Okfie","product":"WP-Hijri","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32561","published":"2025-04-17T15:47:30.034Z","updated":"2026-04-28T16:12:24.004Z","title":"WordPress WP_DEBUG Toggle plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"plugins.club","product":"WP_DEBUG Toggle","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32562","published":"2025-04-17T15:47:29.400Z","updated":"2026-04-28T16:12:24.142Z","title":"WordPress WP Easy Poll Plugin <= 2.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"aviplugins.com","product":"WP Easy Poll","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32564","published":"2025-04-17T15:47:28.798Z","updated":"2026-04-28T16:12:24.292Z","title":"WordPress Stop Registration Spam Plugin <= 1.24 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tomroyal","product":"Stop Registration Spam","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32566","published":"2025-04-17T15:47:28.218Z","updated":"2026-04-28T16:12:24.518Z","title":"WordPress License For Envato Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ashraful Sarkar Naiem","product":"License For Envato","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32571","published":"2025-04-17T15:47:27.575Z","updated":"2026-04-28T16:12:24.313Z","title":"WordPress TuriTop Booking System Plugin <= 1.0.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"TuriTop","product":"TuriTop Booking System","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2025-32572","published":"2025-04-17T15:47:26.992Z","updated":"2026-04-28T16:12:24.409Z","title":"WordPress Kata Plus Plugin <= 1.5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Climax Themes","product":"Kata Plus","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-32573","published":"2025-04-17T15:47:26.367Z","updated":"2026-04-28T16:12:24.423Z","title":"WordPress KiotViet Sync Plugin <= 1.8.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Kiotviet","product":"KiotViet Sync","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2025-32578","published":"2025-04-17T15:47:25.782Z","updated":"2026-04-28T16:12:24.332Z","title":"WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mapro Collins","product":"Coming Soon Countdown","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32582","published":"2025-04-17T15:47:25.163Z","updated":"2026-05-12T00:11:30.569Z","title":"WordPress WP AutoKeyword Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EXEIdeas International","product":"WP AutoKeyword","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32583","published":"2025-04-17T15:47:24.575Z","updated":"2026-04-28T16:12:24.837Z","title":"WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"termel","product":"PDF 2 Post","kev":false,"epss":0.20328,"kevAdded":null},{"id":"CVE-2025-32588","published":"2025-04-17T15:47:23.961Z","updated":"2026-04-28T16:12:24.934Z","title":"WordPress Credova_Financial plugin <= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Credova Financial","product":"Credova_Financial","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32590","published":"2025-04-17T15:47:23.371Z","updated":"2026-04-28T16:12:24.970Z","title":"WordPress Web2application Plugin <= 6.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"tzin111","product":"Web2application","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32592","published":"2025-04-17T15:47:22.712Z","updated":"2026-04-28T16:12:25.015Z","title":"WordPress TableOn Plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32593","published":"2025-04-17T15:47:22.138Z","updated":"2026-04-28T16:12:25.053Z","title":"WordPress Add Product Frontend for WooCommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":8.2,"vendor":"Bytes Technolab","product":"Add Product Frontend for WooCommerce","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-32594","published":"2025-04-17T15:47:21.556Z","updated":"2026-04-28T16:12:25.035Z","title":"WordPress Simple WP Events plugin <= 1.8.17 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMinds","product":"Simple WP Events","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2025-32596","published":"2025-04-17T15:47:20.975Z","updated":"2026-04-28T16:12:25.111Z","title":"WordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.3,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-32602","published":"2025-04-17T15:47:20.398Z","updated":"2026-04-28T16:12:25.110Z","title":"WordPress WooMS Plugin <= 9.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpcraft","product":"WooMS","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32604","published":"2025-04-17T15:47:19.790Z","updated":"2026-05-12T00:11:43.874Z","title":"WordPress AWSA Shipping Plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sajjad Aslani","product":"AWSA Shipping","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32605","published":"2025-04-17T15:47:19.211Z","updated":"2026-04-28T16:12:25.206Z","title":"WordPress MemberPress Discord Addon Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"expresstechsoftware","product":"MemberPress Discord Addon","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32606","published":"2025-04-17T15:47:18.636Z","updated":"2026-04-28T16:12:25.290Z","title":"WordPress Listings for Buildium plugin <= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Deepak Khokhar","product":"Listings for Buildium","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-32608","published":"2025-04-17T15:47:17.900Z","updated":"2026-04-28T16:12:25.298Z","title":"WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Movylo","product":"Movylo Marketing Automation","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32609","published":"2025-04-17T15:47:17.299Z","updated":"2026-04-28T16:12:25.284Z","title":"WordPress Verowa Connect Plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Picture-Planet GmbH","product":"Verowa Connect","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32611","published":"2025-04-17T15:47:16.663Z","updated":"2026-04-28T16:12:25.284Z","title":"WordPress WooCommerce TBC Credit Card Payment Gateway (Free) Plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"We Are De","product":"WooCommerce TBC Credit Card Payment Gateway (Free)","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32613","published":"2025-04-17T15:47:16.044Z","updated":"2026-04-28T16:12:25.316Z","title":"WordPress Debug Log Manager plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bowo","product":"Debug Log Manager","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32615","published":"2025-04-17T15:47:15.421Z","updated":"2026-04-28T16:12:25.649Z","title":"WordPress Clinked Client Portal Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Clinked","product":"Clinked Client Portal","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32620","published":"2025-04-17T15:47:14.823Z","updated":"2026-04-28T16:12:25.690Z","title":"WordPress Doppler Forms plugin <= 2.4.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"fromdoppler","product":"Doppler Forms","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2025-32622","published":"2025-04-17T15:47:14.220Z","updated":"2026-04-28T16:12:25.693Z","title":"WordPress OTP-less one tap Sign in Plugin <= 2.0.58 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OTP-less","product":"OTP-less one tap Sign in","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32625","published":"2025-04-17T15:47:13.657Z","updated":"2026-04-28T16:12:25.683Z","title":"WordPress Mobile Blocks Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"pootlepress","product":"Mobile Pages","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32626","published":"2025-04-17T15:47:13.101Z","updated":"2026-04-28T16:12:25.612Z","title":"WordPress JS Job Manager plugin <= 2.0.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-32628","published":"2025-04-17T15:47:12.415Z","updated":"2026-04-28T16:12:25.688Z","title":"WordPress Crowdfunding for WooCommerce Plugin <= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Wham","product":"Crowdfunding for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32630","published":"2025-04-17T15:47:11.838Z","updated":"2026-04-28T16:12:25.686Z","title":"WordPress WP-BusinessDirectory Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CMSJunkie - WordPress Business Directory Plugins","product":"WP-BusinessDirectory","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32634","published":"2025-04-17T15:47:11.241Z","updated":"2026-05-12T00:11:17.422Z","title":"WordPress Run Contests, Raffles, and Giveaways plugin <= 2.1.1 -  Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mdedev","product":"Run Contests, Raffles, and Giveaways with ContestsWP","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32635","published":"2025-04-17T15:47:10.668Z","updated":"2026-04-28T16:12:25.947Z","title":"WordPress Hive Support plugin <= 1.2.6 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Hive Support","product":"Hive Support","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2025-32636","published":"2025-04-17T15:47:10.080Z","updated":"2026-04-28T16:12:26.807Z","title":"WordPress Local Magic plugin <= 2.9.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"matthewrubin","product":"Local Magic","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-32637","published":"2025-04-17T15:47:09.476Z","updated":"2026-04-28T16:12:26.634Z","title":"WordPress WP Donate Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ketanajani","product":"WP Donate","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32638","published":"2025-04-17T15:47:08.850Z","updated":"2026-05-12T00:11:36.967Z","title":"WordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weptile","product":"Mobile App for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32639","published":"2025-04-17T15:47:08.296Z","updated":"2026-04-28T16:12:26.242Z","title":"WordPress Affiliate Links plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wecantrack","product":"Affiliate Links Lite","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32646","published":"2025-04-17T15:47:07.717Z","updated":"2026-04-28T16:12:26.436Z","title":"WordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PickPlugins","product":"Question Answer","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32647","published":"2025-04-17T15:47:07.113Z","updated":"2026-04-28T16:12:26.890Z","title":"WordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PickPlugins","product":"Question Answer","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-32648","published":"2025-04-17T15:47:06.473Z","updated":"2026-04-28T16:12:26.394Z","title":"WordPress Projectopia plugin <= 5.1.24 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Projectopia","product":"Projectopia","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-32649","published":"2025-04-17T15:47:05.858Z","updated":"2026-04-28T16:12:26.352Z","title":"WordPress GB Gallery Slideshow Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"gb-plugins","product":"GB Gallery Slideshow","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32651","published":"2025-04-17T15:47:05.254Z","updated":"2026-04-28T16:12:26.511Z","title":"WordPress SERPed.net Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"serpednet","product":"SERPed.net","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-32652","published":"2025-04-17T15:47:04.678Z","updated":"2026-04-28T16:12:26.428Z","title":"WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"solacewp","product":"Solace Extra","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2025-32653","published":"2025-04-17T15:47:04.055Z","updated":"2026-04-28T16:12:26.357Z","title":"WordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lee Blue","product":"Cart66 Cloud","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32655","published":"2025-04-17T15:47:03.462Z","updated":"2026-04-28T16:12:26.728Z","title":"WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"DevriX","product":"Restrict User Registration","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-32658","published":"2025-04-17T15:47:02.871Z","updated":"2026-04-28T16:12:27.411Z","title":"WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpWax","product":"HelpGent","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-32660","published":"2025-04-17T15:47:02.285Z","updated":"2026-04-28T16:12:27.444Z","title":"WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2025-32662","published":"2025-04-17T15:47:01.613Z","updated":"2026-05-12T00:11:50.380Z","title":"WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-32665","published":"2025-04-17T15:47:00.870Z","updated":"2026-04-28T16:12:27.508Z","title":"WordPress Office Locator plugin <= 1.3.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WebbyTemplate","product":"Office Locator","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-32666","published":"2025-04-17T15:47:00.288Z","updated":"2026-04-28T16:12:27.492Z","title":"WordPress Hive Support plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hive Support","product":"Hive Support","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32670","published":"2025-04-17T15:46:59.578Z","updated":"2026-04-28T16:12:27.790Z","title":"WordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mark Parnell","product":"Spark GF Failed Submissions","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32674","published":"2025-04-17T15:46:58.955Z","updated":"2026-04-28T16:12:27.937Z","title":"WordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFactory","product":"Product Excel Import Export & Bulk Edit for WooCommerce","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-32682","published":"2025-04-17T15:46:58.355Z","updated":"2026-04-28T16:12:27.972Z","title":"WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.9,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2025-32686","published":"2025-04-17T15:46:57.736Z","updated":"2026-04-28T16:12:27.996Z","title":"WordPress Team Members plugin <= 3.4.4 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"WPSpeedo","product":"Team Members","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2025-39519","published":"2025-04-17T15:46:57.086Z","updated":"2026-04-28T16:12:33.931Z","title":"WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"runthings.dev","product":"Bulk Page Stub Creator","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39521","published":"2025-04-17T15:46:56.461Z","updated":"2026-04-28T16:12:33.956Z","title":"WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ashish Ajani","product":"Contact Form vCard Generator","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39526","published":"2025-04-17T15:46:55.857Z","updated":"2026-04-28T16:12:34.103Z","title":"WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2025-39527","published":"2025-04-17T15:46:55.251Z","updated":"2026-04-28T16:12:34.162Z","title":"WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"bestweblayout","product":"Rating by BestWebSoft","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2025-39532","published":"2025-04-17T15:46:54.592Z","updated":"2026-04-28T16:12:34.145Z","title":"WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"spicethemes","product":"Spice Blocks","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2025-39533","published":"2025-04-17T15:46:53.981Z","updated":"2026-04-28T16:12:34.270Z","title":"WordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Starfish Reviews","product":"Starfish Review Generation & Marketing","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-39535","published":"2025-04-17T15:46:53.344Z","updated":"2026-04-28T16:12:34.224Z","title":"WordPress Vitepos plugin <= 3.1.7 - Broken Authentication Vulnerability","severity":"HIGH","score":7.2,"vendor":"appsbd","product":"Vitepos","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2025-39542","published":"2025-04-17T15:46:52.675Z","updated":"2026-04-28T16:12:34.341Z","title":"WordPress Xelion Webchat plugin <= 9.1.0 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Jauhari Xelion","product":"Xelion Webchat","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-39550","published":"2025-04-17T15:46:52.069Z","updated":"2026-04-28T16:12:34.554Z","title":"WordPress FluentCommunity plugin <= 1.2.15 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Shahjahan Jewel","product":"FluentCommunity","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-39551","published":"2025-04-17T15:46:51.457Z","updated":"2026-04-28T16:12:34.563Z","title":"WordPress FluentBoards plugin <= 1.47 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2025-39554","published":"2025-04-17T15:46:50.827Z","updated":"2026-04-28T16:12:34.655Z","title":"WordPress AI Text to Speech plugin <= 3.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elliot Sowersby / RelyWP","product":"AI Text to Speech","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-39558","published":"2025-04-17T15:46:50.210Z","updated":"2026-04-28T16:12:34.688Z","title":"WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CRM Perks","product":"CRM Perks","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-39559","published":"2025-04-17T15:46:49.613Z","updated":"2026-05-12T00:09:21.615Z","title":"WordPress Bring Fraktguiden for WooCommerce plugin <= 1.11.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Eivin Landa","product":"Bring Fraktguiden for WooCommerce","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-39562","published":"2025-04-17T15:46:48.970Z","updated":"2026-04-29T09:51:55.510Z","title":"WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"codepeople","product":"Payment Form for PayPal Pro","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-39567","published":"2025-04-17T15:46:48.363Z","updated":"2026-04-28T16:12:34.877Z","title":"WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamalli","product":"Web Directory Free","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-39568","published":"2025-04-17T15:46:47.725Z","updated":"2026-04-28T16:12:34.928Z","title":"WordPress StoreContrl Woocommerce plugin <= 4.1.3 - Arbitrary File Download Vulnerability","severity":"HIGH","score":7.5,"vendor":"Arture B.V.","product":"StoreContrl Woocommerce","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-39569","published":"2025-04-17T15:46:47.156Z","updated":"2026-04-28T16:12:34.873Z","title":"WordPress Taskbuilder plugin <= 4.0.1 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-39580","published":"2025-04-17T15:46:46.532Z","updated":"2026-04-28T16:12:35.077Z","title":"WordPress Dashi plugin <= 3.1.8 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.8,"vendor":"jidaikobo","product":"Dashi","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-39583","published":"2025-04-17T15:46:45.911Z","updated":"2026-04-28T16:12:35.135Z","title":"WordPress BERTHA AI plugin <= 1.12.10.2 - Arbitrary Content Deletion Vulnerability","severity":"HIGH","score":7.1,"vendor":"Bertha AI – Andrew Palmer","product":"BERTHA AI","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-39586","published":"2025-04-17T15:46:45.272Z","updated":"2026-04-28T16:12:35.354Z","title":"WordPress ProfileGrid  plugin <= 5.9.4.8 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-39587","published":"2025-04-17T15:46:44.464Z","updated":"2026-04-28T16:12:35.219Z","title":"WordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Stylemix","product":"Cost Calculator Builder","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-39588","published":"2025-04-17T15:46:43.717Z","updated":"2026-04-28T16:12:35.203Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-39594","published":"2025-04-17T15:46:43.116Z","updated":"2026-04-28T16:12:35.756Z","title":"WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Arigato Autoresponder and Newsletter","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-39595","published":"2025-04-17T15:46:42.440Z","updated":"2026-05-12T00:08:59.648Z","title":"WordPress Quentn WP plugin <= 1.2.8 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Quentn.com GmbH","product":"Quentn WP","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-39596","published":"2025-04-17T15:46:41.592Z","updated":"2026-04-28T16:12:36.100Z","title":"WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Quentn.com GmbH","product":"Quentn WP","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2025-22340","published":"2025-04-17T15:17:22.634Z","updated":"2026-04-28T16:10:59.879Z","title":"WordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Think201","product":"Data Dash","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-22565","published":"2025-04-17T15:17:21.793Z","updated":"2026-04-28T16:11:01.664Z","title":"WordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bill Zimmerman","product":"vooPlayer v4","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-22636","published":"2025-04-17T15:17:20.978Z","updated":"2026-04-28T16:11:02.826Z","title":"WordPress VR-Frases plugin <= 4.0.1 - Reflected XSS to SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"Vicente Ruiz Gálvez","product":"VR-Frases","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-22651","published":"2025-04-17T15:17:20.144Z","updated":"2026-04-28T16:11:03.822Z","title":"WordPress Stylish Google Sheet Reader plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wppluginboxdev","product":"Stylish Google Sheet Reader","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-22655","published":"2025-04-17T15:17:19.331Z","updated":"2026-05-12T23:58:38.185Z","title":"WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Caio Web Dev","product":"CWD – Stealth Links","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2025-22692","published":"2025-04-17T15:17:18.395Z","updated":"2026-04-28T16:11:04.900Z","title":"WordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rachanaS","product":"Sponsered Link","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-22771","published":"2025-04-17T15:17:17.402Z","updated":"2026-04-28T16:11:07.029Z","title":"WordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Studio Hyperset","product":"The Great Firewords of China","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-22774","published":"2025-04-17T15:17:16.497Z","updated":"2026-04-28T16:11:07.014Z","title":"WordPress CRUDLab Scroll to Top Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CRUDLab","product":"CRUDLab Scroll to Top","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-22796","published":"2025-04-17T15:17:15.649Z","updated":"2026-04-28T16:11:07.544Z","title":"WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"platcom","product":"WP-Asambleas","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-26968","published":"2025-04-17T15:17:14.732Z","updated":"2026-04-28T16:11:45.412Z","title":"WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"webbernaut","product":"Cloak Front End Email","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2025-39414","published":"2025-04-17T15:17:13.931Z","updated":"2026-04-28T16:12:30.554Z","title":"WordPress spam-stopper plugin <= 3.1.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Mike","product":"spam-stopper","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39415","published":"2025-04-17T15:17:13.043Z","updated":"2026-04-28T16:12:30.579Z","title":"WordPress Social Media Links plugin <= 1.0.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Jayesh Parejiya","product":"Social Media Links","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39416","published":"2025-04-17T15:17:12.154Z","updated":"2026-04-28T16:12:30.747Z","title":"WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Ichi","product":"translit it!","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39417","published":"2025-04-17T15:17:11.289Z","updated":"2026-04-28T16:12:31.225Z","title":"WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Eslam Mahmoud","product":"Redirect wordpress to welcome or landing page","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39418","published":"2025-04-17T15:17:10.453Z","updated":"2026-04-28T16:12:30.793Z","title":"WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ajayver","product":"RSS Manager","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39419","published":"2025-04-17T15:17:09.630Z","updated":"2026-05-12T00:08:32.349Z","title":"WordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"David Miller","product":"Revision Diet","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39420","published":"2025-04-17T15:17:08.816Z","updated":"2026-04-28T16:12:31.096Z","title":"WordPress WP Twitter Button plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"ruudkok","product":"WP Twitter Button","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39421","published":"2025-04-17T15:17:07.891Z","updated":"2026-04-28T16:12:31.115Z","title":"WordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mustafa KUCUK","product":"WP Sticky Side Buttons","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39422","published":"2025-04-17T15:17:07.040Z","updated":"2026-05-12T00:08:28.381Z","title":"WordPress WP Social Bookmarking plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"PResponsive","product":"WP Social Bookmarking","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39423","published":"2025-04-17T15:17:06.219Z","updated":"2026-04-28T16:12:31.277Z","title":"WordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Jenst","product":"Add to Header","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39424","published":"2025-04-17T15:17:05.305Z","updated":"2026-04-28T16:12:30.711Z","title":"WordPress Simple Maps plugin <= 0.98 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"simplemaps","product":"Simple Maps","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39425","published":"2025-04-17T15:17:04.438Z","updated":"2026-05-12T00:09:13.864Z","title":"WordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"pixelgrade","product":"Style Manager","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39426","published":"2025-04-17T15:17:03.650Z","updated":"2026-04-28T16:12:30.872Z","title":"WordPress illow – Cookies Consent plugin <= 0.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"illow","product":"illow – Cookies Consent","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39427","published":"2025-04-17T15:17:02.846Z","updated":"2026-04-28T16:12:31.300Z","title":"WordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Beth Tucker Long","product":"WP Post to PDF Enhanced","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-39428","published":"2025-04-17T15:17:01.936Z","updated":"2026-04-28T16:12:31.201Z","title":"WordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Maros Pristas","product":"Gravity Forms CSS Themes with Fontawesome and Placeholders","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-39429","published":"2025-04-17T15:17:01.096Z","updated":"2026-04-28T16:12:31.312Z","title":"WordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Földesi, Mihály","product":"Széchenyi 2020 Logo","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-39430","published":"2025-04-17T15:17:00.249Z","updated":"2026-04-28T16:12:31.251Z","title":"WordPress mLanguage plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Alexander Rauscha","product":"mLanguage","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39431","published":"2025-04-17T15:16:59.280Z","updated":"2026-04-28T16:12:31.479Z","title":"WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Aaron Forgue","product":"Amazon Showcase WordPress Plugin","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39432","published":"2025-04-17T15:16:58.469Z","updated":"2026-04-28T16:12:31.275Z","title":"WordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"antonchanning","product":"bbPress2 shortcode whitelist","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39433","published":"2025-04-17T15:16:57.647Z","updated":"2026-04-28T16:12:31.298Z","title":"WordPress Bknewsticker plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"beke_ro","product":"Bknewsticker","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39434","published":"2025-04-17T15:16:56.834Z","updated":"2026-04-28T16:12:31.448Z","title":"WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Scott Taylor","product":"Avatar","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2025-39435","published":"2025-04-17T15:16:56.011Z","updated":"2026-05-12T00:09:07.545Z","title":"WordPress My Marginalia plugin <= 1.0.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"davidfcarr","product":"My Marginalia","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39436","published":"2025-04-17T15:16:55.185Z","updated":"2026-04-28T16:12:31.374Z","title":"WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"aidraw","product":"I Draw","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2025-39437","published":"2025-04-17T15:16:54.327Z","updated":"2026-04-28T16:12:31.395Z","title":"WordPress Anthologize plugin <= 0.8.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Boone Gorges","product":"Anthologize","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39438","published":"2025-04-17T15:16:53.443Z","updated":"2026-04-28T16:12:31.427Z","title":"WordPress Theme Changer plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"momen2009","product":"Theme Changer","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39439","published":"2025-04-17T15:16:52.531Z","updated":"2026-04-28T16:12:31.534Z","title":"WordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Markus Drubba","product":"wpLike2Get","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-39440","published":"2025-04-17T15:16:51.708Z","updated":"2026-04-28T16:12:31.464Z","title":"WordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Rajesh","product":"Broken Links Remover","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39441","published":"2025-04-17T15:16:50.867Z","updated":"2026-04-28T16:12:31.816Z","title":"WordPress Dashboard Notepads plugin <= 1.2.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"swedish boy","product":"Dashboard Notepads","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39442","published":"2025-04-17T15:16:49.917Z","updated":"2026-04-28T16:12:31.716Z","title":"WordPress Review Wave – Google Places Reviews plugin <=  1.4.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MessageMetric","product":"Review Wave – Google Places Reviews","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39444","published":"2025-04-17T15:16:48.145Z","updated":"2026-04-28T16:12:31.712Z","title":"WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"maxfoundry","product":"MaxButtons","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-39443","published":"2025-04-17T15:15:44.162Z","updated":"2026-04-28T16:12:31.767Z","title":"WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Soft8Soft LLC","product":"Verge3D","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39452","published":"2025-04-17T15:15:42.576Z","updated":"2026-04-28T16:12:31.907Z","title":"WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"WPCafe","kev":false,"epss":0.00801,"kevAdded":null},{"id":"CVE-2025-39453","published":"2025-04-17T15:15:41.737Z","updated":"2026-04-28T16:12:31.901Z","title":"WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"algol.plus","product":"Advanced Dynamic Pricing for WooCommerce","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-39455","published":"2025-04-17T15:15:40.863Z","updated":"2026-04-28T16:12:32.046Z","title":"WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IP2Location","product":"IP2Location Variables","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39456","published":"2025-04-17T15:15:40.060Z","updated":"2026-04-28T16:12:31.976Z","title":"WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"iTRON","product":"WP Logger","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-39457","published":"2025-04-17T15:15:39.241Z","updated":"2026-04-28T16:12:31.968Z","title":"WordPress Booking and Rental Manager plugin <= 2.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-39461","published":"2025-04-17T15:15:38.431Z","updated":"2026-05-12T00:08:38.644Z","title":"WordPress Docket Cache plugin <= 24.07.02 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Nawawi Jamili","product":"Docket Cache","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-39462","published":"2025-04-17T15:15:37.605Z","updated":"2026-05-12T00:08:45.314Z","title":"WordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"teamzt","product":"Smart Agreements","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2025-39464","published":"2025-04-17T15:15:36.747Z","updated":"2026-05-12T00:08:52.511Z","title":"WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rtowebsites","product":"AdminQuickbar","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39472","published":"2025-04-16T17:15:50.209Z","updated":"2026-05-12T00:07:51.765Z","title":"WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpweb","product":"WooCommerce Social Login","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-39512","published":"2025-04-16T12:45:54.497Z","updated":"2026-04-28T16:12:33.267Z","title":"WordPress Bulk Term Editor plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Yuya Hoshino","product":"Bulk Term Editor","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-39513","published":"2025-04-16T12:45:53.889Z","updated":"2026-04-28T16:12:33.783Z","title":"WordPress ActiveDEMAND plugin <= 0.2.46 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ActiveDEMAND Online Agency Marketing Automation","product":"ActiveDEMAND","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2025-39514","published":"2025-04-16T12:45:53.284Z","updated":"2026-04-28T16:12:33.875Z","title":"WordPress Asgaros Forum plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Asgaros","product":"Asgaros Forum","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39515","published":"2025-04-16T12:45:52.653Z","updated":"2026-04-28T16:12:34.068Z","title":"WordPress Attendance Manager plugin <= 0.6.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tnomi","product":"Attendance Manager","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39516","published":"2025-04-16T12:45:52.055Z","updated":"2026-04-28T16:12:34.103Z","title":"WordPress Author WIP Progress Bar plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Alan Petersen","product":"Author WIP Progress Bar","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39517","published":"2025-04-16T12:45:51.423Z","updated":"2026-04-28T16:12:34.000Z","title":"WordPress Basic Interactive World Map plugin <= 2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Map Plugins","product":"Basic Interactive World Map","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-39518","published":"2025-04-16T12:45:50.853Z","updated":"2026-04-28T16:12:34.232Z","title":"WordPress BMA Lite plugin <= 1.4.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"RedefiningTheWeb","product":"BMA Lite","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2025-39520","published":"2025-04-16T12:45:50.233Z","updated":"2026-04-28T16:12:33.907Z","title":"WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Wham","product":"Checkout Files Upload for WooCommerce","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39522","published":"2025-04-16T12:45:49.617Z","updated":"2026-04-28T16:12:34.006Z","title":"WordPress Dynamic Post plugin <= 5.03 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Service2Client LLC","product":"Dynamic Post","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-39524","published":"2025-04-16T12:45:49.051Z","updated":"2026-04-28T16:12:34.000Z","title":"WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39525","published":"2025-04-16T12:45:48.469Z","updated":"2026-04-28T16:12:34.073Z","title":"WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Logo Carousel Slider","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39528","published":"2025-04-16T12:45:47.835Z","updated":"2026-04-28T16:12:34.100Z","title":"WordPress Rescue Shortcodes plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rescue Themes","product":"Rescue Shortcodes","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2025-39529","published":"2025-04-16T12:45:47.259Z","updated":"2026-04-28T16:12:34.135Z","title":"WordPress Scriptless Social Sharing plugin <= 3.3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Robin Cornett","product":"Scriptless Social Sharing","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39530","published":"2025-04-16T12:45:46.630Z","updated":"2026-04-28T16:12:34.132Z","title":"WordPress Site Search 360 plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) to stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dsky","product":"Site Search 360","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-39531","published":"2025-04-16T12:45:46.004Z","updated":"2026-04-28T16:12:34.113Z","title":"WordPress Slazzer Background Changer plugin <= 3.14 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"slazzercom","product":"Slazzer Background Changer","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2025-39538","published":"2025-04-16T12:45:45.374Z","updated":"2026-04-28T16:12:34.306Z","title":"WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Mathieu Chartier","product":"WP-Advanced-Search","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-39540","published":"2025-04-16T12:45:44.743Z","updated":"2026-04-28T16:12:34.312Z","title":"WordPress WP Flipclock plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rhys Wynne","product":"WP Flipclock","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39543","published":"2025-04-16T12:44:40.666Z","updated":"2026-04-28T16:12:34.528Z","title":"WordPress Royal Elementor Addons plugin <= 1.3.977 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Royal","product":"Royal Elementor Addons","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39544","published":"2025-04-16T12:44:40.080Z","updated":"2026-04-28T16:12:34.448Z","title":"WordPress WP Tools plugin <= 5.18 - CSRF to Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"sminozzi","product":"WP Tools","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-39545","published":"2025-04-16T12:44:39.462Z","updated":"2026-04-28T16:12:34.514Z","title":"WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"miniOrange","product":"WordPress REST API Authentication","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2025-39546","published":"2025-04-16T12:44:38.814Z","updated":"2026-05-12T00:07:18.435Z","title":"WordPress ElementsReady Addons for Elementor plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"quomodosoft","product":"ElementsReady Addons for Elementor","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-39547","published":"2025-04-16T12:44:38.197Z","updated":"2026-05-12T00:08:19.391Z","title":"WordPress Internal Link Optimiser plugin <= 5.1.3 - CSRF to XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Toast Plugins","product":"Internal Link Optimiser","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-39548","published":"2025-04-16T12:44:37.588Z","updated":"2026-04-28T16:12:34.534Z","title":"WordPress Right Click Disable OR Ban plugin <= 1.1.17 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"A WP Life","product":"Right Click Disable OR Ban","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-39549","published":"2025-04-16T12:44:36.912Z","updated":"2026-05-12T00:08:06.058Z","title":"WordPress Most And Least Read Posts Widget plugin <= 2.5.20 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"whiletrue","product":"Most And Least Read Posts Widget","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39552","published":"2025-04-16T12:44:36.271Z","updated":"2026-04-28T16:12:34.694Z","title":"WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dylan James","product":"Zephyr Project Manager","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-39555","published":"2025-04-16T12:44:35.627Z","updated":"2026-04-28T16:12:34.691Z","title":"WordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2025-39556","published":"2025-04-16T12:44:34.974Z","updated":"2026-04-28T16:12:34.675Z","title":"WordPress Mediavine Control Panel plugin <= 2.10.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"mediavine","product":"Mediavine Control Panel","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2025-39557","published":"2025-04-16T12:44:34.355Z","updated":"2026-04-28T16:12:34.572Z","title":"WordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"StellarWP","product":"Kadence WooCommerce Email Designer","kev":false,"epss":0.0062,"kevAdded":null},{"id":"CVE-2025-39560","published":"2025-04-16T12:44:33.673Z","updated":"2026-04-28T16:12:34.882Z","title":"WordPress Live Forms plugin <= 4.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Shahjada","product":"Live Forms","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-39563","published":"2025-04-16T12:44:33.018Z","updated":"2026-04-28T16:12:34.865Z","title":"WordPress Conditional Payments for WooCommerce plugin <= 3.3.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Trio","product":"Conditional Payments for WooCommerce","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-39564","published":"2025-04-16T12:44:32.334Z","updated":"2026-04-28T16:12:34.850Z","title":"WordPress Conditional Shipping for WooCommerce plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Trio","product":"Conditional Shipping for WooCommerce","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-39565","published":"2025-04-16T12:44:31.718Z","updated":"2026-04-28T16:12:34.854Z","title":"WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Melapress","product":"MelaPress Login Security","kev":false,"epss":0.00911,"kevAdded":null},{"id":"CVE-2025-39566","published":"2025-04-16T12:44:31.129Z","updated":"2026-04-28T16:12:35.033Z","title":"WordPress Hostel plugin <= 1.1.5.6 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Bob","product":"Hostel","kev":false,"epss":0.00633,"kevAdded":null},{"id":"CVE-2025-39570","published":"2025-04-16T12:44:30.493Z","updated":"2026-05-12T00:07:32.586Z","title":"WordPress WPCOM Member plugin <= 1.7.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.8,"vendor":"Lomu","product":"WPCOM Member","kev":false,"epss":0.00773,"kevAdded":null},{"id":"CVE-2025-39571","published":"2025-04-16T12:44:29.883Z","updated":"2026-04-28T16:12:34.924Z","title":"WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPXPO","product":"WowStore","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-39572","published":"2025-04-16T12:44:29.327Z","updated":"2026-04-28T16:12:35.069Z","title":"WordPress Checkout for PayPal plugin <= 1.0.38 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"Checkout for PayPal","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-39573","published":"2025-04-16T12:44:28.750Z","updated":"2026-04-28T16:12:35.087Z","title":"WordPress WP Posts Carousel plugin <= 1.3.10 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"teastudio.pl","product":"WP Posts Carousel","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39574","published":"2025-04-16T12:44:28.162Z","updated":"2026-04-28T16:12:34.979Z","title":"WordPress Uix Shortcodes plugin <= 2.0.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UIUX Lab","product":"Uix Shortcodes","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39575","published":"2025-04-16T12:44:27.436Z","updated":"2026-04-28T16:12:34.977Z","title":"WordPress WPCasa plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPSight","product":"WPCasa","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39576","published":"2025-04-16T12:44:26.852Z","updated":"2026-04-28T16:12:35.072Z","title":"WordPress WPAdverts plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39577","published":"2025-04-16T12:44:26.279Z","updated":"2026-04-28T16:12:35.011Z","title":"WordPress PropertyHive plugin <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39578","published":"2025-04-16T12:44:25.659Z","updated":"2026-04-28T16:12:35.171Z","title":"WordPress Responsive Blocks plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CyberChimps","product":"Responsive Blocks","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39579","published":"2025-04-16T12:44:25.081Z","updated":"2026-05-12T00:07:25.282Z","title":"WordPress Membership For WooCommerce plugin <= 2.8.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Swings","product":"Membership For WooCommerce","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39581","published":"2025-04-16T12:44:24.457Z","updated":"2026-04-28T16:12:35.171Z","title":"WordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themifyme","product":"Themify Shortcodes","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39582","published":"2025-04-16T12:44:23.867Z","updated":"2026-05-12T00:08:12.941Z","title":"WordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39584","published":"2025-04-16T12:44:22.763Z","updated":"2026-04-28T16:12:35.217Z","title":"WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Arraytics","product":"Eventin","kev":false,"epss":0.00919,"kevAdded":null},{"id":"CVE-2025-39585","published":"2025-04-16T12:44:22.167Z","updated":"2026-04-28T16:12:35.136Z","title":"WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Travelfic Toolkit","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-39589","published":"2025-04-16T12:44:21.605Z","updated":"2026-04-28T16:12:35.200Z","title":"WordPress Essential Addons for Elementor plugin <= 6.1.9 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2025-39590","published":"2025-04-16T12:44:20.971Z","updated":"2026-04-28T16:12:35.220Z","title":"WordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-39591","published":"2025-04-16T12:44:20.381Z","updated":"2026-04-28T16:12:35.220Z","title":"WordPress WP Subscription Forms plugin <= 1.2.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Shuffle","product":"WP Subscription Forms","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2025-39592","published":"2025-04-16T12:44:19.752Z","updated":"2026-04-28T16:12:35.396Z","title":"WordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Shuffle","product":"Subscribe to Unlock Lite","kev":false,"epss":0.00908,"kevAdded":null},{"id":"CVE-2025-39593","published":"2025-04-16T12:44:19.155Z","updated":"2026-04-28T16:12:35.936Z","title":"WordPress Ever Accounting plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"EverAccounting","product":"Ever Accounting","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-39597","published":"2025-04-16T12:44:18.550Z","updated":"2026-05-12T00:07:39.077Z","title":"WordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Arthur Yarwood","product":"Fast eBay Listings","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2025-39598","published":"2025-04-16T12:44:17.890Z","updated":"2026-04-28T16:12:35.742Z","title":"WordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Quý Lê 91","product":"Administrator Z","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2025-39599","published":"2025-04-16T12:44:16.869Z","updated":"2026-04-28T16:12:35.922Z","title":"WordPress Listdom plugin <= 4.0.0 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-39600","published":"2025-04-16T12:44:16.285Z","updated":"2026-05-12T00:07:58.625Z","title":"WordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CRM Perks","product":"Integration for WooCommerce and QuickBooks","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-39601","published":"2025-04-16T12:44:15.534Z","updated":"2026-05-12T00:07:45.374Z","title":"WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability","severity":"CRITICAL","score":9.6,"vendor":"WPFactory","product":"Custom CSS, JS & PHP","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-39602","published":"2025-04-16T12:44:14.828Z","updated":"2026-04-28T16:12:35.722Z","title":"WordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Product Table","product":"WooCommerce Product Table Lite","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2025-30960","published":"2025-04-16T10:23:51.746Z","updated":"2026-04-28T16:12:02.172Z","title":"WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability","severity":"HIGH","score":8.3,"vendor":"fs-code","product":"FS Poster","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-32923","published":"2025-04-15T21:53:58.229Z","updated":"2026-04-28T16:12:29.244Z","title":"WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GoodLayers","product":"Tourmaster","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-30984","published":"2025-04-15T21:53:15.127Z","updated":"2026-04-28T16:12:02.976Z","title":"WordPress SEO Tools plugin <= 4.0.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dzynit","product":"SEO Tools","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-30982","published":"2025-04-15T21:53:14.959Z","updated":"2026-04-28T16:12:02.959Z","title":"WordPress MyBookProgress by Stormhill Media plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"zookatron","product":"MyBookProgress by Stormhill Media","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-30970","published":"2025-04-15T21:53:14.721Z","updated":"2026-04-28T16:12:02.291Z","title":"WordPress Easy Contact plugin <= 0.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scottwallick","product":"Easy Contact","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-30967","published":"2025-04-15T21:53:14.550Z","updated":"2026-04-28T16:12:02.282Z","title":"WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"NotFound","product":"WPJobBoard","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-30966","published":"2025-04-15T21:53:14.341Z","updated":"2026-04-28T16:12:02.205Z","title":"WordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerability","severity":"MEDIUM","score":5.4,"vendor":"NotFound","product":"WPJobBoard","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-27011","published":"2025-04-15T21:53:14.148Z","updated":"2026-04-28T16:11:46.680Z","title":"WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2025-27008","published":"2025-04-15T21:53:13.855Z","updated":"2026-04-29T09:51:54.731Z","title":"WordPress Unlimited Timeline < 1.6.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"NotFound","product":"Unlimited Timeline","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-26998","published":"2025-04-15T21:53:13.666Z","updated":"2026-04-28T16:11:46.245Z","title":"WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Blocks","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-26996","published":"2025-04-15T21:53:13.376Z","updated":"2026-04-28T16:11:46.228Z","title":"WordPress Sign-up Sheets plugin <= 2.3.0.1 - Shortcode Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fetch Designs","product":"Sign-up Sheets","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-26953","published":"2025-04-15T21:53:13.200Z","updated":"2026-04-29T09:51:54.717Z","title":"WordPress JetMenu plugin <= 2.4.9 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetMenu","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-26951","published":"2025-04-15T21:53:13.040Z","updated":"2026-04-28T16:11:44.793Z","title":"WordPress C9 Blocks plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"covertnine","product":"C9 Blocks","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26950","published":"2025-04-15T21:53:12.788Z","updated":"2026-04-28T16:11:44.796Z","title":"WordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AddonsPress","product":"Nepali Date Converter","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26934","published":"2025-04-15T21:53:12.631Z","updated":"2026-04-28T16:11:44.291Z","title":"WordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"graphthemes","product":"Glossy Blog","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26930","published":"2025-04-15T21:53:12.473Z","updated":"2026-04-28T16:11:44.296Z","title":"WordPress Home Services plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"alleythemes","product":"Home Services","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26927","published":"2025-04-15T21:53:12.307Z","updated":"2026-04-28T16:11:44.276Z","title":"WordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"LiquidThemes","product":"AI Hub","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-26919","published":"2025-04-15T21:53:11.998Z","updated":"2026-04-28T16:11:43.894Z","title":"WordPress Tainá plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tainacan","product":"Tainá","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26908","published":"2025-04-15T21:53:11.785Z","updated":"2026-04-28T16:11:43.904Z","title":"WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Gurmehub","product":"Kargo Entegratör","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-26906","published":"2025-04-15T21:53:11.597Z","updated":"2026-04-28T16:11:43.589Z","title":"WordPress WP Delete User Accounts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ren Ventura","product":"WP Delete User Accounts","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26903","published":"2025-04-15T21:53:11.417Z","updated":"2026-04-28T16:11:43.824Z","title":"WordPress InPost Gallery plugin <= 2.1.4.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"RealMag777","product":"InPost Gallery","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-26880","published":"2025-04-15T21:53:11.279Z","updated":"2026-04-28T16:11:42.000Z","title":"WordPress SKT Skill Bar plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sonalsinha21","product":"SKT Skill Bar","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26870","published":"2025-04-15T21:53:11.010Z","updated":"2026-04-28T16:11:40.858Z","title":"WordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26749","published":"2025-04-15T21:53:10.737Z","updated":"2026-04-28T16:11:39.938Z","title":"WordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFactory","product":"Additional Custom Product Tabs for WooCommerce","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26748","published":"2025-04-15T21:53:10.560Z","updated":"2026-04-28T16:11:39.879Z","title":"WordPress Arkhe theme <= 3.12.0 - CSRF to Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"looswebstudio","product":"Arkhe","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2025-26746","published":"2025-04-15T21:53:10.409Z","updated":"2026-04-28T16:11:39.857Z","title":"WordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"caalami","product":"Advanced Custom Fields: Link Picker Field","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-26740","published":"2025-04-15T21:53:10.238Z","updated":"2026-04-28T16:11:39.695Z","title":"WordPress SpaBiz plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"burgersoftware","product":"SpaBiz","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-26730","published":"2025-04-15T21:53:09.964Z","updated":"2026-04-28T16:11:39.733Z","title":"WordPress Macro Calculator with Admin Email Optin & Data plugin <= 1.0 - Multiple Vulnerabilities vulnerability","severity":"HIGH","score":7.5,"vendor":"NotFound","product":"Macro Calculator with Admin Email Optin & Data","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2025-22269","published":"2025-04-15T21:53:09.816Z","updated":"2026-04-28T16:10:57.686Z","title":"WordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShapedPlugin LLC","product":"Real Testimonials","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-22268","published":"2025-04-15T21:53:09.632Z","updated":"2026-04-28T16:10:57.729Z","title":"WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-22263","published":"2025-04-15T21:53:09.352Z","updated":"2026-04-28T16:10:57.738Z","title":"WordPress Global Gallery plugin <= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NotFound","product":"Global Gallery","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-31011","published":"2025-04-15T11:59:08.265Z","updated":"2026-04-28T16:12:03.592Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ReichertBrothers","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-30985","published":"2025-04-15T11:59:08.069Z","updated":"2026-04-28T16:12:02.914Z","title":"WordPress GNUCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"kagla","product":"GNUCommerce","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-30965","published":"2025-04-15T11:59:07.738Z","updated":"2026-04-28T16:12:02.201Z","title":"WordPress WPJobBoard plugin < 5.11.1 - Multiple Cross Site Request Forgery (CSRF) vulnerabilities vulnerability","severity":"MEDIUM","score":4.3,"vendor":"NotFound","product":"WPJobBoard","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-30964","published":"2025-04-15T11:59:07.576Z","updated":"2026-04-28T16:12:02.151Z","title":"WordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Photography","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-30962","published":"2025-04-15T11:59:07.372Z","updated":"2026-04-28T16:12:02.125Z","title":"WordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fs-code","product":"FS Poster","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-26990","published":"2025-04-15T11:59:07.117Z","updated":"2026-04-28T16:11:45.994Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.4,"vendor":"WP Royal","product":"Royal Elementor Addons","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-26982","published":"2025-04-15T11:59:06.973Z","updated":"2026-04-28T16:11:45.803Z","title":"WordPress DSGVO Youtube plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Eric-Oliver Mächler","product":"DSGVO Youtube","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-26959","published":"2025-04-15T11:59:06.838Z","updated":"2026-04-28T16:11:44.836Z","title":"WordPress Administrator Z <= 2025.03.24 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Quý Lê 91","product":"Administrator Z","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-26958","published":"2025-04-15T11:59:06.703Z","updated":"2026-04-29T09:51:54.730Z","title":"WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-26955","published":"2025-04-15T11:59:06.566Z","updated":"2026-04-28T16:11:44.784Z","title":"WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"vowelweb","product":"Industrial Lite","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-26954","published":"2025-04-15T11:59:06.374Z","updated":"2026-04-28T16:11:44.793Z","title":"WordPress ZooEffect plugin <= 1.11 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"1pluginjquery","product":"ZooEffect","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-26944","published":"2025-04-15T11:59:06.144Z","updated":"2026-04-28T16:11:44.430Z","title":"WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-26942","published":"2025-04-15T11:59:05.976Z","updated":"2026-05-12T00:07:11.935Z","title":"WordPress JetTricks plugin <= 1.5.1 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetTricks","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-26894","published":"2025-04-15T11:59:05.829Z","updated":"2026-04-28T16:11:42.523Z","title":"WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Mobeen Abdullah","product":"Coming Soon, Maintenance Mode","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-26889","published":"2025-04-15T11:59:05.561Z","updated":"2026-04-28T16:11:42.176Z","title":"WordPress hockeydata LOS plugin <= 1.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"hockeydata","product":"hockeydata LOS","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2025-26745","published":"2025-04-15T11:59:05.387Z","updated":"2026-04-28T16:11:39.898Z","title":"WordPress RS Elements Elementor Addon plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RSTheme","product":"RS Elements Elementor Addon","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-26744","published":"2025-04-15T11:59:05.240Z","updated":"2026-04-28T16:11:39.899Z","title":"WordPress JetBlog plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-26743","published":"2025-04-15T11:59:05.071Z","updated":"2026-04-28T16:11:39.871Z","title":"WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TC.K","product":"Advance WP Query Search Filter","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-26741","published":"2025-04-15T11:59:04.878Z","updated":"2026-04-28T16:11:39.820Z","title":"WordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"AWEOS GmbH","product":"Email Notifications for Updates","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-32929","published":"2025-04-15T11:58:09.738Z","updated":"2026-04-28T16:12:29.287Z","title":"WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Generator for WooCommerce","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2025-26992","published":"2025-04-15T11:58:09.461Z","updated":"2026-04-28T16:11:46.252Z","title":"WordPress Landing Page Cat plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fatcatapps","product":"Landing Page Cat","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-27009","published":"2025-04-14T11:05:34.699Z","updated":"2026-04-28T16:11:46.647Z","title":"WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-32681","published":"2025-04-11T08:43:03.157Z","updated":"2026-04-28T16:12:27.899Z","title":"WordPress Error Log Viewer By WP Guru plugin <= 1.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WP Guru","product":"Error Log Viewer","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-32672","published":"2025-04-11T08:43:02.771Z","updated":"2026-04-28T16:12:27.863Z","title":"WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"g5theme","product":"Ultimate Bootstrap Elements for Elementor","kev":false,"epss":0.00944,"kevAdded":null},{"id":"CVE-2025-32671","published":"2025-04-11T08:43:02.559Z","updated":"2026-04-28T16:12:27.756Z","title":"WordPress Print Science Designer plugin <= 1.3.155 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"John Weissberg","product":"Print Science Designer","kev":false,"epss":0.00747,"kevAdded":null},{"id":"CVE-2025-32663","published":"2025-04-11T08:43:02.352Z","updated":"2026-04-28T16:12:27.250Z","title":"WordPress FAT Cooming Soon plugin <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"roninwp","product":"FAT Cooming Soon","kev":false,"epss":0.00944,"kevAdded":null},{"id":"CVE-2025-32656","published":"2025-04-11T08:43:02.173Z","updated":"2026-05-12T00:06:57.610Z","title":"WordPress Testimonial Slider and Showcase Pro plugin <= 2.3.15 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"RadiusTheme","product":"Testimonial Slider And Showcase Pro","kev":false,"epss":0.00944,"kevAdded":null},{"id":"CVE-2025-32654","published":"2025-04-11T08:43:01.943Z","updated":"2026-04-28T16:12:26.535Z","title":"WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00944,"kevAdded":null},{"id":"CVE-2025-32650","published":"2025-04-11T08:43:01.760Z","updated":"2026-04-28T16:12:26.221Z","title":"WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ability, Inc","product":"Accessibility Suite","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-32633","published":"2025-04-11T08:43:01.535Z","updated":"2026-04-28T16:12:25.806Z","title":"WordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"neoslab","product":"Database Toolset","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2025-32632","published":"2025-04-11T08:43:01.251Z","updated":"2026-04-28T16:12:25.697Z","title":"WordPress Automatic Ban IP Plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KaizenCoders","product":"Automatic Ban IP","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-32631","published":"2025-04-11T08:43:01.011Z","updated":"2026-04-28T16:12:25.655Z","title":"WordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"oxygensuite","product":"Oxygen MyData for WooCommerce","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2025-32629","published":"2025-04-11T08:43:00.841Z","updated":"2026-04-28T16:12:25.684Z","title":"WordPress WP-BusinessDirectory Plugin <= 3.1.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"CMSJunkie - WordPress Business Directory Plugins","product":"WP-BusinessDirectory","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2025-32627","published":"2025-04-11T08:43:00.418Z","updated":"2026-04-28T16:12:25.761Z","title":"WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00954,"kevAdded":null},{"id":"CVE-2025-32618","published":"2025-04-11T08:42:59.944Z","updated":"2026-05-12T00:06:37.302Z","title":"WordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PickPlugins","product":"Wishlist","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-32614","published":"2025-04-11T08:42:59.793Z","updated":"2026-05-12T00:06:30.372Z","title":"WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.01883,"kevAdded":null},{"id":"CVE-2025-32607","published":"2025-04-11T08:42:59.659Z","updated":"2026-04-28T16:12:25.206Z","title":"WordPress WpBookingly plugin <= 1.3.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"magepeopleteam","product":"WpBookingly","kev":false,"epss":0.00894,"kevAdded":null},{"id":"CVE-2025-32603","published":"2025-04-11T08:42:59.507Z","updated":"2026-04-28T16:12:25.167Z","title":"WordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"HK","product":"WP Online Users Stats","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2025-32601","published":"2025-04-11T08:42:59.353Z","updated":"2026-04-28T16:12:25.161Z","title":"WordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"twispay","product":"Twispay Credit Card Payments","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-32600","published":"2025-04-11T08:42:59.147Z","updated":"2026-04-28T16:12:25.160Z","title":"WordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tournamatch","product":"Tournamatch","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-32599","published":"2025-04-11T08:42:58.990Z","updated":"2026-04-28T16:12:25.163Z","title":"WordPress Task Scheduler Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miunosoft","product":"Task Scheduler","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-32598","published":"2025-04-11T08:42:58.825Z","updated":"2026-04-28T16:12:25.166Z","title":"WordPress WP Table Builder plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Table Builder","product":"WP Table Builder","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-32589","published":"2025-04-11T08:42:58.606Z","updated":"2026-04-28T16:12:24.963Z","title":"WordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"odude","product":"Flexi – Guest Submit","kev":false,"epss":0.01021,"kevAdded":null},{"id":"CVE-2025-32587","published":"2025-04-11T08:42:58.410Z","updated":"2026-05-12T00:06:43.740Z","title":"WordPress WooCommerce Pickupp plugin <= 2.4.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"pickupp","product":"WooCommerce Pickupp","kev":false,"epss":0.0099,"kevAdded":null},{"id":"CVE-2025-32586","published":"2025-04-11T08:42:58.141Z","updated":"2026-04-28T16:12:24.750Z","title":"WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ABA Bank","product":"ABA PayWay Payment Gateway for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-32585","published":"2025-04-11T08:42:57.793Z","updated":"2026-04-28T16:12:24.903Z","title":"WordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Trusty Plugins","product":"Shop Products Filter","kev":false,"epss":0.00939,"kevAdded":null},{"id":"CVE-2025-32579","published":"2025-04-11T08:42:57.452Z","updated":"2026-04-28T16:12:24.369Z","title":"WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"SoftClever Limited","product":"Sync Posts","kev":false,"epss":0.00741,"kevAdded":null},{"id":"CVE-2025-32577","published":"2025-04-11T08:42:57.280Z","updated":"2026-04-28T16:12:24.627Z","title":"WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"hakeemnala","product":"Build App Online","kev":false,"epss":0.00833,"kevAdded":null},{"id":"CVE-2025-32569","published":"2025-04-11T08:42:57.099Z","updated":"2026-04-28T16:12:24.380Z","title":"WordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00895,"kevAdded":null},{"id":"CVE-2025-32568","published":"2025-04-11T08:42:56.940Z","updated":"2026-04-28T16:12:24.337Z","title":"WordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"empik","product":"EmpikPlace for Woocommerce","kev":false,"epss":0.00895,"kevAdded":null},{"id":"CVE-2025-32567","published":"2025-04-11T08:42:56.709Z","updated":"2026-04-28T16:12:24.375Z","title":"WordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"dev02ali","product":"Easy Post Duplicator","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-32565","published":"2025-04-11T08:42:56.513Z","updated":"2026-04-28T16:12:24.301Z","title":"WordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"vertim","product":"Neon Product Designer","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2025-32558","published":"2025-04-11T08:42:56.299Z","updated":"2026-04-28T16:12:24.043Z","title":"WordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ketanajani","product":"Duplicate Title Checker","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-32553","published":"2025-04-11T08:42:56.054Z","updated":"2026-04-28T16:12:24.004Z","title":"WordPress RestroPres plugin <= 3.2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32551","published":"2025-04-11T08:42:55.876Z","updated":"2026-04-28T16:12:24.055Z","title":"WordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jaap Jansma","product":"Connector to CiviCRM with CiviMcRestFace","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32542","published":"2025-04-11T08:42:55.599Z","updated":"2026-04-28T16:12:23.871Z","title":"WordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.8,"vendor":"EazyPlugins","product":"Eazy Plugin Manager","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2025-32541","published":"2025-04-11T08:42:55.297Z","updated":"2026-04-28T16:12:23.792Z","title":"WordPress WooCommerce Sales MIS Report Plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"infosoftplugin","product":"WooCommerce Sales MIS Report","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2025-32539","published":"2025-04-11T08:42:55.148Z","updated":"2026-04-28T16:12:23.774Z","title":"WordPress WooCommerce – Store Exporter plugin <= 2.7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Josh Kohlbach","product":"Store Exporter","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32538","published":"2025-04-11T08:42:54.821Z","updated":"2026-04-28T16:12:23.728Z","title":"WordPress Easy Post Duplicator Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dev02ali","product":"Easy Post Duplicator","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32537","published":"2025-04-11T08:42:54.641Z","updated":"2026-04-28T16:12:23.640Z","title":"WordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rachel Cherry","product":"Lock Your Updates","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32536","published":"2025-04-11T08:42:54.454Z","updated":"2026-04-28T16:12:23.640Z","title":"WordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sandeep Verma","product":"HTML5 Video Player with Playlist","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32534","published":"2025-04-11T08:42:54.256Z","updated":"2026-04-28T16:12:23.686Z","title":"WordPress Workbox Video from Vimeo & Youtube Plugin Plugin <= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Workbox","product":"Workbox Video from Vimeo & Youtube","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32525","published":"2025-04-11T08:42:53.980Z","updated":"2026-04-28T16:12:23.653Z","title":"WordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"MapGeo","product":"Interactive Geo Maps","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32524","published":"2025-04-11T08:42:53.440Z","updated":"2026-04-28T16:12:23.627Z","title":"WordPress MyWorks WooCommerce Sync for QuickBooks Online plugin <= 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"MyWorks","product":"MyWorks WooCommerce Sync for QuickBooks Online","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32523","published":"2025-04-11T08:42:52.766Z","updated":"2026-04-28T16:12:23.677Z","title":"WordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"payphone","product":"WooCommerce – Payphone Gateway","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32519","published":"2025-04-11T08:42:52.527Z","updated":"2026-04-28T16:12:23.445Z","title":"WordPress IDonate plugin <= 2.1.18 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Foysal Imran","product":"IDonate","kev":false,"epss":0.00912,"kevAdded":null},{"id":"CVE-2025-32517","published":"2025-04-11T08:42:52.243Z","updated":"2026-04-28T16:12:23.317Z","title":"WordPress MultiMailer plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SCAND","product":"MultiMailer","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-32509","published":"2025-04-11T08:42:52.035Z","updated":"2026-04-28T16:12:23.295Z","title":"WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMinds","product":"Simple WP Events","kev":false,"epss":0.00881,"kevAdded":null},{"id":"CVE-2025-32491","published":"2025-04-11T08:42:51.818Z","updated":"2026-05-12T00:06:50.629Z","title":"WordPress Rankology SEO – On-site SEO  plugin <= 2.2.4 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Rankology","product":"Rankology SEO – On-site SEO","kev":false,"epss":0.00798,"kevAdded":null},{"id":"CVE-2025-32144","published":"2025-04-11T08:42:51.450Z","updated":"2026-04-28T16:12:17.035Z","title":"WordPress Job Board Manager Plugin <= 2.1.61 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PickPlugins","product":"Job Board Manager","kev":false,"epss":0.01061,"kevAdded":null},{"id":"CVE-2025-32143","published":"2025-04-11T08:42:51.243Z","updated":"2026-04-28T16:12:17.047Z","title":"WordPress Accordion plugin <= 2.3.11 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.01061,"kevAdded":null},{"id":"CVE-2025-31599","published":"2025-04-11T08:42:51.037Z","updated":"2026-04-28T16:12:10.045Z","title":"WordPress Bulk Product Sync plugin <= 8.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"N-Media","product":"Bulk Product Sync","kev":false,"epss":0.00661,"kevAdded":null},{"id":"CVE-2025-31565","published":"2025-04-11T08:42:50.779Z","updated":"2026-05-12T00:07:05.010Z","title":"WordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Lisandro Martinez","product":"WPSmartContracts","kev":false,"epss":0.00661,"kevAdded":null},{"id":"CVE-2025-31379","published":"2025-04-11T08:42:50.580Z","updated":"2026-04-28T16:12:05.603Z","title":"WordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"programphases","product":"Insert HTML Here","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-31378","published":"2025-04-11T08:42:50.304Z","updated":"2026-04-28T16:12:05.493Z","title":"WordPress Oppso Unit Converter plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"danbwb","product":"Oppso Unit Converter","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2025-31041","published":"2025-04-11T08:42:50.083Z","updated":"2026-04-28T16:12:04.201Z","title":"WordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"AnyTrack","product":"AnyTrack Affiliate Link Manager","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2025-31040","published":"2025-04-11T08:42:49.906Z","updated":"2026-04-28T16:12:04.113Z","title":"WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Exthemes","product":"WP Food ordering and Restaurant Menu","kev":false,"epss":0.01165,"kevAdded":null},{"id":"CVE-2025-31028","published":"2025-04-11T08:42:49.730Z","updated":"2026-04-28T16:12:03.884Z","title":"WordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Huseyin Berberoglu","product":"WP Hide Categories","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2025-31021","published":"2025-04-11T08:42:49.435Z","updated":"2026-04-28T16:12:03.872Z","title":"WordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dolby_uk","product":"Mobile Smart","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2025-31015","published":"2025-04-11T08:42:49.225Z","updated":"2026-04-28T16:12:03.629Z","title":"WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Adrian Tobey","product":"WordPress SMTP Service, Email Delivery Solved! — MailHawk","kev":false,"epss":0.00898,"kevAdded":null},{"id":"CVE-2025-31014","published":"2025-04-11T08:42:48.612Z","updated":"2026-04-28T16:12:03.669Z","title":"WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Hossein","product":"Material Dashboard","kev":false,"epss":0.01121,"kevAdded":null},{"id":"CVE-2025-27350","published":"2025-04-10T10:21:37.799Z","updated":"2026-04-28T16:11:48.879Z","title":"WordPress Vice Versa plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hugh Mungus","product":"Vice Versa","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31411","published":"2025-04-10T10:16:12.191Z","updated":"2026-04-28T16:12:06.930Z","title":"WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.12 - Arbitrary File Read/Deletion vulnerability","severity":"MEDIUM","score":5.9,"vendor":"aribhour","product":"Linet ERP-Woocommerce Integration","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2025-22279","published":"2025-04-10T08:58:57.947Z","updated":"2026-04-28T16:10:58.183Z","title":"WordPress JetCompareWishlist plugin <= 1.5.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetCompareWishlist","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-32282","published":"2025-04-10T08:09:48.186Z","updated":"2026-04-28T16:12:20.596Z","title":"WordPress ShareThis Dashboard for Google Analytics plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ShareThis","product":"ShareThis Dashboard for Google Analytics","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-32275","published":"2025-04-10T08:09:47.813Z","updated":"2026-04-29T09:51:54.971Z","title":"WordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ays Pro","product":"Survey Maker","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2025-32260","published":"2025-04-10T08:09:47.644Z","updated":"2026-04-28T16:12:19.898Z","title":"WordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Detheme","product":"DethemeKit For Elementor","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-32259","published":"2025-04-10T08:09:47.488Z","updated":"2026-05-12T00:06:23.945Z","title":"WordPress WP ULike plugin <=  4.7.9.1 - Content Spoofing Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Alimir","product":"WP ULike","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-32244","published":"2025-04-10T08:09:47.326Z","updated":"2026-04-28T16:12:19.671Z","title":"WordPress SEO Help plugin <= 6.7.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"QuantumCloud","product":"SEO Help","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-32243","published":"2025-04-10T08:09:47.134Z","updated":"2026-04-28T16:12:19.628Z","title":"WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Toast Plugins","product":"Internal Link Optimiser","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-32242","published":"2025-04-10T08:09:46.853Z","updated":"2026-04-28T16:12:19.642Z","title":"WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hive Support","product":"Hive Support","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-32240","published":"2025-04-10T08:09:46.691Z","updated":"2026-04-28T16:12:19.631Z","title":"WordPress Site Notify plugin <= 1.0 - Broken Access Control Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpvsingh","product":"Site Notify","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-32236","published":"2025-04-10T08:09:46.527Z","updated":"2026-04-28T16:12:19.382Z","title":"WordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Vagonic","product":"Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-32230","published":"2025-04-10T08:09:46.362Z","updated":"2026-04-28T16:12:19.672Z","title":"WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2025-32228","published":"2025-04-10T08:09:46.158Z","updated":"2026-04-28T16:12:19.415Z","title":"WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"Ai Image Alt Text Generator for WP","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-32227","published":"2025-04-10T08:09:46.011Z","updated":"2026-04-29T09:51:54.969Z","title":"WordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Asgaros","product":"Asgaros Forum","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2025-32221","published":"2025-04-10T08:09:45.868Z","updated":"2026-04-28T16:12:19.204Z","title":"WordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Spider Themes","product":"EazyDocs","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-32216","published":"2025-04-10T08:09:45.727Z","updated":"2026-04-28T16:12:19.149Z","title":"WordPress Spider Elements – Addons for Elementor plugin <= 1.6.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Spider Themes","product":"Spider Elements","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-32215","published":"2025-04-10T08:09:45.576Z","updated":"2026-04-28T16:12:19.134Z","title":"WordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ability, Inc","product":"Accessibility Suite","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-32214","published":"2025-04-10T08:09:45.392Z","updated":"2026-05-12T00:06:11.014Z","title":"WordPress Hive Support plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hive Support","product":"Hive Support","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-32213","published":"2025-04-10T08:09:45.212Z","updated":"2026-05-12T00:06:04.094Z","title":"WordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"flothemesplugins","product":"Flo Forms","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-32212","published":"2025-04-10T08:09:44.923Z","updated":"2026-04-28T16:12:19.147Z","title":"WordPress Specia Companion plugin <= 6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Specia Theme","product":"Specia Companion","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2025-32210","published":"2025-04-10T08:09:44.744Z","updated":"2026-04-28T16:12:19.073Z","title":"WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CreativeMindsSolutions","product":"CM Registration and Invitation Codes","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2025-32209","published":"2025-04-10T08:09:44.590Z","updated":"2026-04-28T16:12:19.049Z","title":"WordPress Total processing card payments for WooCommerce Plugin <= 7.1.5 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"totalprocessing","product":"Nomupay Payment Processing Gateway","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2025-32208","published":"2025-04-10T08:09:44.425Z","updated":"2026-04-28T16:12:19.075Z","title":"WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hive Support","product":"Hive Support","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2025-32206","published":"2025-04-10T08:09:44.271Z","updated":"2026-04-28T16:12:18.911Z","title":"WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"LABCAT","product":"Processing Projects","kev":false,"epss":0.00621,"kevAdded":null},{"id":"CVE-2025-32205","published":"2025-04-10T08:09:44.109Z","updated":"2026-04-29T09:51:54.917Z","title":"WordPress Piotnet Forms plugin <= 1.0.30 - Path Traversal vulnerability","severity":"LOW","score":2.7,"vendor":"piotnetdotcom","product":"Piotnet Forms","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-32202","published":"2025-04-10T08:09:43.889Z","updated":"2026-04-28T16:12:19.045Z","title":"WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000025 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Brian Batt - elearningfreak.com","product":"Insert or Embed Articulate Content into WordPress","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2025-32199","published":"2025-04-10T08:09:43.693Z","updated":"2026-04-28T16:12:18.646Z","title":"WordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eyale-vc","product":"Contact Form Builder by vcita","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-32198","published":"2025-04-10T08:09:43.505Z","updated":"2026-04-28T16:12:18.792Z","title":"WordPress Brizy plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themefusecom","product":"Brizy","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-32160","published":"2025-04-10T08:09:43.277Z","updated":"2026-04-28T16:12:17.923Z","title":"WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.00835,"kevAdded":null},{"id":"CVE-2025-32158","published":"2025-04-10T08:09:42.747Z","updated":"2026-04-28T16:12:17.800Z","title":"WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"aThemes Addons for Elementor","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2025-32145","published":"2025-04-10T08:09:42.557Z","updated":"2026-04-28T16:12:17.184Z","title":"WordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"WpEvently","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-32140","published":"2025-04-10T08:09:42.357Z","updated":"2026-04-28T16:12:17.002Z","title":"WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Nirmal Kumar Ram","product":"WP Remote Thumbnail","kev":false,"epss":0.00562,"kevAdded":null},{"id":"CVE-2025-32139","published":"2025-04-10T08:09:42.166Z","updated":"2026-04-28T16:12:17.012Z","title":"WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"FooPlugins","product":"FooBox Image Lightbox","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-32128","published":"2025-04-10T08:09:41.987Z","updated":"2026-05-12T00:06:17.439Z","title":"WordPress Nearby Locations Plugin <= 1.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"aaronfrey","product":"Nearby Locations","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2025-32119","published":"2025-04-10T08:09:41.813Z","updated":"2026-04-29T09:51:54.883Z","title":"WordPress CardGate Payments for WooCommerce plugin <= 3.2.1 - SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"CardGate","product":"CardGate Payments for WooCommerce","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2025-32116","published":"2025-04-10T08:09:41.623Z","updated":"2026-04-28T16:12:16.588Z","title":"WordPress  QR Master plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Studi7","product":"QR Master","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-32115","published":"2025-04-10T08:09:41.405Z","updated":"2026-04-28T16:12:16.623Z","title":"WordPress  Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Popping Content Light","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-32114","published":"2025-04-10T08:09:41.233Z","updated":"2026-04-28T16:12:16.540Z","title":"WordPress 5sterrenspecialist plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"5sterrenspecialist","product":"WordPress 5sterrenspecialist Plugin","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31524","published":"2025-04-10T08:09:41.061Z","updated":"2026-04-28T16:12:08.036Z","title":"WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"John James Jacoby","product":"WP User Profiles","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-30582","published":"2025-04-10T08:09:40.881Z","updated":"2026-04-28T16:11:54.654Z","title":"WordPress DyaPress ERP/CRM plugin <= 18.0.2.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"aytechnet","product":"DyaPress ERP/CRM","kev":false,"epss":0.00704,"kevAdded":null},{"id":"CVE-2025-32687","published":"2025-04-10T08:09:40.702Z","updated":"2026-04-28T16:12:28.452Z","title":"WordPress Review Stars Count For WooCommerce plugin <= 2.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Magnigenie","product":"Review Stars Count For WooCommerce","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-32668","published":"2025-04-10T08:09:40.484Z","updated":"2026-04-28T16:12:27.443Z","title":"WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2025-26888","published":"2025-04-09T19:35:42.843Z","updated":"2026-04-28T16:11:42.561Z","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Amir Helzer","product":"WooCommerce Multilingual & Multicurrency","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-26902","published":"2025-04-09T19:30:15.905Z","updated":"2026-04-28T16:11:43.728Z","title":"WordPress Brizy Pro plugin <= 2.6.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brizy","product":"Brizy Pro","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-26901","published":"2025-04-09T19:28:10.429Z","updated":"2026-04-28T16:11:42.622Z","title":"WordPress Brizy Pro plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brizy","product":"Brizy Pro","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-32695","published":"2025-04-09T16:13:50.263Z","updated":"2026-04-28T16:12:28.958Z","title":"WordPress Checkout Mestres WP plugin <= 8.7.5 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mestres do WP","product":"Checkout Mestres WP","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31383","published":"2025-04-09T16:13:33.869Z","updated":"2026-04-28T16:12:05.572Z","title":"WordPress FrescoChat Live Chat plugin <= 3.2.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"sodena","product":"FrescoChat Live Chat","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31385","published":"2025-04-09T16:13:33.162Z","updated":"2026-04-28T16:12:05.617Z","title":"WordPress Site Table of Contents plugin <= 0.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"intelcaprep","product":"Site Table of Contents","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31002","published":"2025-04-09T16:10:21.173Z","updated":"2026-04-28T16:12:03.328Z","title":"WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Bogdan Bendziukov","product":"Squeeze","kev":false,"epss":0.00683,"kevAdded":null},{"id":"CVE-2025-31003","published":"2025-04-09T16:10:20.595Z","updated":"2026-04-28T16:12:03.354Z","title":"WordPress Squeeze plugin <= 1.6 - Full Path Disclosure (FPD) vulnerability","severity":"LOW","score":2.7,"vendor":"Bogdan Bendziukov","product":"Squeeze","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-31004","published":"2025-04-09T16:10:20.010Z","updated":"2026-04-28T16:12:03.448Z","title":"WordPress Rich Table of Contents plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Croover.inc","product":"Rich Table of Contents","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-31005","published":"2025-04-09T16:10:19.412Z","updated":"2026-04-28T16:12:03.365Z","title":"WordPress Easyfonts plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Uzair","product":"Easyfonts","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-31008","published":"2025-04-09T16:10:18.775Z","updated":"2026-04-28T16:12:03.675Z","title":"WordPress YouTube Embed plugin <= 5.3.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Embeds For YouTube Plugin Support","product":"YouTube Embed","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-31009","published":"2025-04-09T16:10:18.184Z","updated":"2026-04-28T16:12:03.652Z","title":"WordPress IndieBlocks plugin <= 0.13.1 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Jan Boddez","product":"IndieBlocks","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-31012","published":"2025-04-09T16:10:17.589Z","updated":"2026-04-28T16:12:03.648Z","title":"WordPress Age Gate plugin <= 3.5.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Phil","product":"Age Gate","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2025-31017","published":"2025-04-09T16:10:16.940Z","updated":"2026-04-28T16:12:03.671Z","title":"WordPress Nav Menu Manager plugin <= 3.2.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Robert Noakes","product":"Nav Menu Manager","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-31020","published":"2025-04-09T16:10:16.303Z","updated":"2026-04-28T16:12:03.869Z","title":"WordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webliberty","product":"Simple Spoiler","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-31023","published":"2025-04-09T16:10:15.706Z","updated":"2026-04-28T16:12:03.934Z","title":"WordPress Seo Meta Tags plugin <= 1.4 - CSRF to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Purab","product":"Seo Meta Tags","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-31026","published":"2025-04-09T16:10:15.005Z","updated":"2026-04-28T16:12:03.949Z","title":"WordPress Comment Validation Reloaded plugin <=  0.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Austin","product":"Comment Validation Reloaded","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31032","published":"2025-04-09T16:10:14.368Z","updated":"2026-04-28T16:12:03.989Z","title":"WordPress Pagopar – WooCommerce Gateway plugin <= 2.7.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Pagopar - Grupo M S.A.","product":"Pagopar – WooCommerce Gateway","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31033","published":"2025-04-09T16:10:13.782Z","updated":"2026-04-28T16:12:03.940Z","title":"WordPress Buddypress Humanity plugin <= 1.2 - CSRF to Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Adam Nowak","product":"Buddypress Humanity","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-31034","published":"2025-04-09T16:10:12.927Z","updated":"2026-04-28T16:12:03.927Z","title":"WordPress Customize Login Page plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AboZain Albanna","product":"Customize Login Page","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-31035","published":"2025-04-09T16:10:12.161Z","updated":"2026-04-28T16:12:03.928Z","title":"WordPress WP Editor.md – The Perfect Markdown Editor plugin <= 10.2.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Benjamin Chris","product":"WP Editor.md – The Perfect WordPress Markdown Editor","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-31036","published":"2025-04-09T16:10:11.430Z","updated":"2026-04-28T16:12:03.928Z","title":"WordPress WPSolr plugin <= 24.0 - CSRF to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WPSOLR","product":"WPSolr","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-31038","published":"2025-04-09T16:10:10.750Z","updated":"2026-04-28T16:12:03.979Z","title":"WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Essential Marketer","product":"Essential Breadcrumbs","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-31042","published":"2025-04-09T16:10:10.033Z","updated":"2026-04-28T16:12:04.182Z","title":"WordPress Sandwich Adsense plugin <= 4.0.2 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"rtakao","product":"Sandwich Adsense","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2025-31375","published":"2025-04-09T16:10:09.380Z","updated":"2026-04-28T16:12:05.285Z","title":"WordPress Scheduled plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"bhoogterp","product":"Scheduled","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31377","published":"2025-04-09T16:10:08.706Z","updated":"2026-04-28T16:12:05.451Z","title":"WordPress Woo Product Feed For Marketing Channels plugin <= 1.9.0 - Broken Access Control Vulnerability","severity":"HIGH","score":7.5,"vendor":"Asaquzzaman mishu","product":"Woo Product Feed For Marketing Channels","kev":false,"epss":0.00717,"kevAdded":null},{"id":"CVE-2025-31382","published":"2025-04-09T16:10:07.904Z","updated":"2026-04-28T16:12:05.602Z","title":"WordPress Language Field plugin <=  0.9 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"theode","product":"Language Field","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31388","published":"2025-04-09T16:10:05.955Z","updated":"2026-04-28T16:12:05.457Z","title":"WordPress The World plugin <= 0.4 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"doa","product":"The World","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31390","published":"2025-04-09T16:10:05.098Z","updated":"2026-05-12T00:05:48.360Z","title":"WordPress Social Crowd plugin <= 0.9.6.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"bdoga","product":"Social Crowd","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31391","published":"2025-04-09T16:10:04.247Z","updated":"2026-05-12T00:05:38.464Z","title":"WordPress Script Compressor plugin <= 1.7.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"regen","product":"Script Compressor","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31392","published":"2025-04-09T16:10:03.600Z","updated":"2026-04-28T16:12:05.734Z","title":"WordPress Smart Product Gallery Slider plugin <= 1.0.4 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Shameem Reza","product":"Smart Product Gallery Slider","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31393","published":"2025-04-09T16:10:02.869Z","updated":"2026-04-28T16:12:05.677Z","title":"WordPress Social Bookmarking RELOADED plugin <= 3.18 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"vfvalent","product":"Social Bookmarking RELOADED","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31394","published":"2025-04-09T16:10:02.000Z","updated":"2026-04-28T16:12:05.707Z","title":"WordPress More Mime Type Filters plugin <= 0.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Kailey (trepmal)","product":"More Mime Type Filters","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-31395","published":"2025-04-09T16:10:00.929Z","updated":"2026-05-12T00:05:56.989Z","title":"WordPress Easy Custom CSS plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"a.ankit","product":"Easy Custom CSS","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31399","published":"2025-04-09T16:10:00.303Z","updated":"2026-04-28T16:12:06.119Z","title":"WordPress CG Scroll To Top plugin <= 3.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Chandan Garg","product":"CG Scroll To Top","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31400","published":"2025-04-09T16:09:59.594Z","updated":"2026-04-28T16:12:06.241Z","title":"WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"icyleaf","product":"WS Audio Player","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31401","published":"2025-04-09T16:09:58.891Z","updated":"2026-04-28T16:12:06.307Z","title":"WordPress MMX – Make Me Christmas plugin <= 1.0.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"mmetrodw","product":"MMX – Make Me Christmas","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31402","published":"2025-04-09T16:09:58.306Z","updated":"2026-04-28T16:12:06.113Z","title":"WordPress NewsBoard Post and RSS Scroller plugin <= 1.2.12 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"NewsBoard Plugin","product":"NewsBoard Post and RSS Scroller","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31404","published":"2025-04-09T16:09:57.664Z","updated":"2026-04-28T16:12:06.195Z","title":"WordPress AF Tell a Friend plugin <= 1.4 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Wladyslaw Madejczyk","product":"AF Tell a Friend","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32476","published":"2025-04-09T16:09:57.023Z","updated":"2026-04-28T16:12:21.958Z","title":"WordPress Advanced Tag Lists plugin <= 1.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"blueinstyle","product":"Advanced Tag Lists","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32477","published":"2025-04-09T16:09:56.433Z","updated":"2026-04-28T16:12:21.852Z","title":"WordPress WP-Easy Menu plugin <= 0.41 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Jordi Salord","product":"WP-Easy Menu","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32478","published":"2025-04-09T16:09:55.796Z","updated":"2026-04-28T16:12:22.113Z","title":"WordPress WP SexyLightBox plugin <= 0.5.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Mario Aguiar","product":"WP SexyLightBox","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32479","published":"2025-04-09T16:09:55.138Z","updated":"2026-04-28T16:12:22.641Z","title":"WordPress Flags Widget plugin <= 1.0.7 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ab-tools","product":"Flags Widget","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32480","published":"2025-04-09T16:09:54.496Z","updated":"2026-04-28T16:12:22.214Z","title":"WordPress Windows Live Writer plugin <=  0.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dalziel","product":"Windows Live Writer","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32481","published":"2025-04-09T16:09:53.874Z","updated":"2026-04-28T16:12:22.109Z","title":"WordPress Nino Social Connect plugin <= 2.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ninotheme","product":"Nino Social Connect","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32482","published":"2025-04-09T16:09:53.272Z","updated":"2026-05-12T00:05:13.725Z","title":"WordPress Custom Smilies plugin <= 1.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"quanganhdo","product":"Custom Smilies","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32483","published":"2025-04-09T16:09:52.604Z","updated":"2026-04-28T16:12:22.188Z","title":"WordPress Request Call Back plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Scott Salisbury","product":"Request Call Back","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32484","published":"2025-04-09T16:09:51.981Z","updated":"2026-04-28T16:12:22.207Z","title":"WordPress WP-Planification – WP-Planning plugin <= 2.3.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Mathieu Chartier","product":"WP-Planification","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32485","published":"2025-04-09T16:09:51.357Z","updated":"2026-04-28T16:12:22.269Z","title":"WordPress WP Performance Pack plugin <= 2.5.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bjoern","product":"WP Performance Pack","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-32487","published":"2025-04-09T16:09:50.757Z","updated":"2026-04-28T16:12:22.731Z","title":"WordPress Waymark plugin <= 1.5.2 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Joe","product":"Waymark","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-32488","published":"2025-04-09T16:09:50.179Z","updated":"2026-04-28T16:12:22.675Z","title":"WordPress Aria Font plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"آریا وردپرس","product":"Aria Font","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32489","published":"2025-04-09T16:09:49.585Z","updated":"2026-04-28T16:12:22.208Z","title":"WordPress Wetterwarner plugin <= 2.7.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tim","product":"Wetterwarner","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32492","published":"2025-04-09T16:09:48.852Z","updated":"2026-04-28T16:12:22.183Z","title":"WordPress Admin Menu Post List plugin <= 2.0.7 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Eliot Akira","product":"Admin Menu Post List","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32493","published":"2025-04-09T16:09:48.180Z","updated":"2026-04-28T16:12:22.799Z","title":"WordPress BP Social Connect plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"VibeThemes","product":"BP Social Connect","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-32494","published":"2025-04-09T16:09:47.607Z","updated":"2026-04-28T16:12:23.099Z","title":"WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"bozdoz","product":"reCAPTCHA Jetpack","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-32495","published":"2025-04-09T16:09:47.006Z","updated":"2026-04-28T16:12:22.871Z","title":"WordPress Waymark plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Joe","product":"Waymark","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-32496","published":"2025-04-09T16:09:46.419Z","updated":"2026-04-28T16:12:22.917Z","title":"WordPress Ultra Demo Importer plugin <= 1.0.5 - CSRF to RCE vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Uncodethemes","product":"Ultra Demo Importer","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-32497","published":"2025-04-09T16:09:45.802Z","updated":"2026-04-28T16:12:23.056Z","title":"WordPress Spoiler Block plugin <= 1.7 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"squiter","product":"Spoiler Block","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32498","published":"2025-04-09T16:09:45.214Z","updated":"2026-04-28T16:12:22.912Z","title":"WordPress VKontakte Cross-Post plugin <=  0.3.2 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"oleglark","product":"VKontakte Cross-Post","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32499","published":"2025-04-09T16:09:44.529Z","updated":"2026-04-28T16:12:22.986Z","title":"WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Logo Showcase Ultimate","kev":false,"epss":0.00769,"kevAdded":null},{"id":"CVE-2025-32500","published":"2025-04-09T16:09:43.925Z","updated":"2026-04-28T16:12:22.966Z","title":"WordPress Codescar Radio Widget plugin <= 0.4.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sudavar","product":"Codescar Radio Widget","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32501","published":"2025-04-09T16:09:43.309Z","updated":"2026-04-28T16:12:22.976Z","title":"WordPress RentSyst plugin <= 2.0.92 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dimafreund","product":"Rentsyst","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32502","published":"2025-04-09T16:09:42.675Z","updated":"2026-05-12T00:05:21.827Z","title":"WordPress ePaper Lister for Yumpu plugin <= 1.4.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"lemmentwickler","product":"ePaper Lister for Yumpu","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32503","published":"2025-04-09T16:09:42.039Z","updated":"2026-04-28T16:12:23.241Z","title":"WordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jose Conti","product":"Link Shield","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-32505","published":"2025-04-09T16:09:41.314Z","updated":"2026-04-28T16:12:23.118Z","title":"WordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"SCAND","product":"MultiMailer","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32518","published":"2025-04-09T16:09:40.642Z","updated":"2026-04-28T16:12:23.320Z","title":"WordPress ALD Login Page plugin <= 1.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"hossainawlad","product":"ALD Login Page","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32543","published":"2025-04-09T16:09:39.930Z","updated":"2026-04-28T16:12:24.016Z","title":"WordPress Canonical Attachments Plugin <= 1.8 - Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hivedigital","product":"Canonical Attachments","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-32547","published":"2025-04-09T16:09:39.304Z","updated":"2026-05-12T00:04:51.552Z","title":"WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"gtlwpdev","product":"All push notification for WP","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-32550","published":"2025-04-09T16:09:38.648Z","updated":"2026-04-28T16:12:24.089Z","title":"WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ClickandPledge","product":"Click & Pledge Connect Plugin","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-32555","published":"2025-04-09T16:09:37.984Z","updated":"2026-04-28T16:12:24.000Z","title":"WordPress SEO, Nutrition and Print for Recipes by Edamam plugin <= 3.3 - CSRF to Cross-Site Scripting vulnerability","severity":"HIGH","score":7.1,"vendor":"Edamam","product":"SEO, Nutrition and Print for Recipes by Edamam","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32556","published":"2025-04-09T16:09:37.267Z","updated":"2026-04-28T16:12:24.039Z","title":"WordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability","severity":"HIGH","score":7.1,"vendor":"Sandor Kovacs","product":"Simple Post Meta Manager","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32559","published":"2025-04-09T16:09:36.597Z","updated":"2026-04-28T16:12:24.012Z","title":"WordPress REVE Chat plugin <= 6.4.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"REVE Chat","product":"REVE Chat","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32563","published":"2025-04-09T16:09:35.794Z","updated":"2026-05-12T00:04:57.977Z","title":"WordPress WP Calais Auto Tagger plugin <= 2.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"dangrossman","product":"WP Calais Auto Tagger","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32570","published":"2025-04-09T16:09:35.212Z","updated":"2026-04-28T16:12:24.334Z","title":"WordPress ChillPay WooCommerce Plugin <= 2.5.3 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ChillPay","product":"ChillPay WooCommerce","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-32575","published":"2025-04-09T16:09:34.630Z","updated":"2026-04-28T16:12:24.376Z","title":"WordPress WP w3all phpBB Plugin <= 2.9.9 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32576","published":"2025-04-09T16:09:33.954Z","updated":"2026-04-28T16:12:24.337Z","title":"WordPress WP shop plugin <= 2.6.1 - CSRF to Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Agence web Eoxia - Montpellier","product":"WP shop","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-32580","published":"2025-04-09T16:09:33.152Z","updated":"2026-04-28T16:12:24.450Z","title":"WordPress DeBounce Email Validator plugin <= 5.7.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"debounce","product":"DeBounce Email Validator","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-32581","published":"2025-04-09T16:09:32.300Z","updated":"2026-04-28T16:12:24.443Z","title":"WordPress WordPress Spam Blocker Plugin <= 2.0.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Ankit Singla","product":"WordPress Spam Blocker","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-32584","published":"2025-04-09T16:09:31.680Z","updated":"2026-04-28T16:12:24.721Z","title":"WordPress Chat2 plugin <= 4.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Chat2","product":"Chat2","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32591","published":"2025-04-09T16:09:30.957Z","updated":"2026-04-28T16:12:25.006Z","title":"WordPress WP Abstracts Plugin <= 2.7.5 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevon Adonis","product":"WP Abstracts","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32597","published":"2025-04-09T16:09:30.285Z","updated":"2026-04-28T16:12:25.154Z","title":"WordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting vulnerability","severity":"HIGH","score":7.1,"vendor":"George Sexton","product":"WordPress Events Calendar Plugin – connectDaily","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32610","published":"2025-04-09T16:09:29.644Z","updated":"2026-04-28T16:12:25.236Z","title":"WordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"Foliopress WYSIWYG","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32612","published":"2025-04-09T16:09:29.029Z","updated":"2026-04-28T16:12:25.315Z","title":"WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"rafasashi","product":"User Session Synchronizer","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32616","published":"2025-04-09T16:09:28.354Z","updated":"2026-04-28T16:12:25.689Z","title":"WordPress Nimbata Call Tracking plugin <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"nimbata","product":"Nimbata Call Tracking","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32617","published":"2025-04-09T16:09:27.370Z","updated":"2026-04-28T16:12:25.798Z","title":"WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Ydesignservices","product":"Multiple Location Google Map","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32619","published":"2025-04-09T16:09:26.688Z","updated":"2026-04-28T16:12:25.673Z","title":"WordPress KeyCAPTCHA plugin <= 2.5.1 - CSRF to Stored  XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"KeyCAPTCHA","product":"KeyCAPTCHA","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32621","published":"2025-04-09T16:09:26.010Z","updated":"2026-04-28T16:12:25.525Z","title":"WordPress WP Map Route Planner plugin <= 1.0.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Vsourz Digital","product":"WP Map Route Planner","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32623","published":"2025-04-09T16:09:25.334Z","updated":"2026-04-28T16:12:25.731Z","title":"WordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"plainware","product":"PlainInventory","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-32624","published":"2025-04-09T16:09:24.688Z","updated":"2026-04-28T16:12:25.647Z","title":"WordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"czater","product":"Czater.pl – live chat i telefon","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2025-32640","published":"2025-04-09T16:09:23.982Z","updated":"2026-04-28T16:12:26.832Z","title":"WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Elementor","product":"Ally","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-32641","published":"2025-04-09T16:09:23.282Z","updated":"2026-04-28T16:12:26.437Z","title":"WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability","severity":"CRITICAL","score":9.6,"vendor":"anantaddons","product":"Anant Addons for Elementor","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2025-32642","published":"2025-04-09T16:09:22.376Z","updated":"2026-04-28T16:12:26.824Z","title":"WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"appsbd","product":"Vite Coupon","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2025-32644","published":"2025-04-09T16:09:21.782Z","updated":"2026-04-28T16:12:26.352Z","title":"WordPress IP2Location World Clock Plugin <= 1.1.9 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"IP2Location","product":"IP2Location World Clock","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32645","published":"2025-04-09T16:09:21.120Z","updated":"2026-04-28T16:12:26.567Z","title":"WordPress Custom Posts Order Plugin <= 4.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hiren Patel","product":"Custom Posts Order","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32659","published":"2025-04-09T16:09:20.467Z","updated":"2026-04-28T16:12:26.992Z","title":"WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.8 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"fraudlabspro","product":"FraudLabs Pro for WooCommerce","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32661","published":"2025-04-09T16:09:19.897Z","updated":"2026-04-28T16:12:27.159Z","title":"WordPress Interactive US Map plugin <= 2.7 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Map Plugins","product":"Interactive US Map","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32664","published":"2025-04-09T16:09:19.309Z","updated":"2026-05-12T00:05:30.528Z","title":"WordPress Nepali Date Utilities plugin <= 1.0.15 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ashokbasnet","product":"Nepali Date Utilities","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32667","published":"2025-04-09T16:09:18.672Z","updated":"2026-04-28T16:12:27.452Z","title":"WordPress Doppler Forms plugin <= 2.5.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"fromdoppler","product":"Doppler Forms","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32669","published":"2025-04-09T16:09:17.859Z","updated":"2026-04-28T16:12:27.566Z","title":"WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MERGADO","product":"Mergado Pack","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32673","published":"2025-04-09T16:09:17.194Z","updated":"2026-04-28T16:12:27.857Z","title":"WordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"epeken","product":"Epeken All Kurir","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-32675","published":"2025-04-09T16:09:16.556Z","updated":"2026-04-28T16:12:28.160Z","title":"WordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.8,"vendor":"QuantumCloud","product":"SEO Help","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-32676","published":"2025-04-09T16:09:15.913Z","updated":"2026-04-28T16:12:27.981Z","title":"WordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Picture-Planet GmbH","product":"Verowa Connect","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-32677","published":"2025-04-09T16:09:15.311Z","updated":"2026-04-28T16:12:27.954Z","title":"WordPress WP Social Stream Designer plugin <= 1.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"solwininfotech","product":"WP Social Stream Designer","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-32678","published":"2025-04-09T16:09:14.684Z","updated":"2026-04-28T16:12:28.054Z","title":"WordPress WP Show Stats plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ashish Ajani","product":"WP Show Stats","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32679","published":"2025-04-09T16:09:14.030Z","updated":"2026-05-12T00:05:06.236Z","title":"WordPress User Registration Using Contact Form 7 plugin <= 2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ZealousWeb","product":"User Registration Using Contact Form 7","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2025-32680","published":"2025-04-09T16:09:13.264Z","updated":"2026-04-28T16:12:27.979Z","title":"WordPress Review Stream plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Grade Us, Inc.","product":"Review Stream","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-32683","published":"2025-04-09T16:09:12.288Z","updated":"2026-04-28T16:12:27.936Z","title":"WordPress MapSVG Lite plugin <= 8.6.6 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-32684","published":"2025-04-09T16:09:11.637Z","updated":"2026-04-28T16:12:27.948Z","title":"WordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5,"vendor":"RomanCode","product":"MapSVG","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-32685","published":"2025-04-09T16:09:10.967Z","updated":"2026-04-28T16:12:27.924Z","title":"WordPress WP Inquiries plugin <= 0.2.1 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"Aristo Rinjuang","product":"WP Inquiries","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2025-32690","published":"2025-04-09T16:09:10.294Z","updated":"2026-04-28T16:12:28.399Z","title":"WordPress PowerPress Podcasting plugin <= 11.12.5 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-32691","published":"2025-04-09T16:09:09.697Z","updated":"2026-04-28T16:12:29.074Z","title":"WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability","severity":"MEDIUM","score":4.9,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2025-32692","published":"2025-04-09T16:09:08.930Z","updated":"2026-04-28T16:12:28.611Z","title":"WordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Shuffle","product":"WP Subscription Forms","kev":false,"epss":0.00926,"kevAdded":null},{"id":"CVE-2025-32693","published":"2025-04-09T16:09:08.148Z","updated":"2026-04-28T16:12:28.502Z","title":"WordPress WebinarPress plugin <= 1.33.28 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"WPWebinarSystem","product":"WebinarPress","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-32694","published":"2025-04-09T16:09:07.065Z","updated":"2026-04-28T16:12:28.847Z","title":"WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Rustaurius","product":"Ultimate WP Mail","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-32279","published":"2025-04-08T16:59:34.603Z","updated":"2026-05-12T00:04:42.589Z","title":"WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Shahjada","product":"Live Forms","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2025-32211","published":"2025-04-08T16:59:34.413Z","updated":"2026-04-28T16:12:19.143Z","title":"WordPress Broadstreet plugin <= 1.52.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Broadstreet","product":"Broadstreet Ads","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-32164","published":"2025-04-08T16:59:34.230Z","updated":"2026-04-28T16:12:17.730Z","title":"WordPress m1.DownloadList plugin <= 0.24 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"maennchen1.de","product":"m1.DownloadList","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2025-32117","published":"2025-04-08T16:59:33.948Z","updated":"2026-05-12T00:04:36.025Z","title":"WordPress Widgetize Pages Light plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Widgetize Pages Light","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-32178","published":"2025-04-04T15:59:52.038Z","updated":"2026-05-12T00:03:52.956Z","title":"WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"6Storage","product":"6Storage Rentals","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32250","published":"2025-04-04T15:59:51.415Z","updated":"2026-05-12T00:02:29.724Z","title":"WordPress Rollbar plugin <= 2.7.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"rollbar","product":"Rollbar","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-32239","published":"2025-04-04T15:59:50.732Z","updated":"2026-04-28T16:12:19.663Z","title":"WordPress Social Share Buttons & Analytics Plugin plugin <= 4.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Joao Romao","product":"Social Share Buttons & Analytics Plugin – GetSocial.io","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32224","published":"2025-04-04T15:59:50.124Z","updated":"2026-05-12T00:03:15.449Z","title":"WordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Shivam Mani Tripathi","product":"Privyr CRM Integration","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32280","published":"2025-04-04T15:59:49.424Z","updated":"2026-04-28T16:12:20.936Z","title":"WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-32278","published":"2025-04-04T15:59:48.783Z","updated":"2026-04-28T16:12:20.632Z","title":"WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wprio","product":"Table Block by RioVizual","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32277","published":"2025-04-04T15:59:48.123Z","updated":"2026-04-28T16:12:20.603Z","title":"WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ateeq Rafeeq","product":"RepairBuddy","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-32276","published":"2025-04-04T15:59:47.428Z","updated":"2026-04-28T16:12:20.571Z","title":"WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Quý Lê 91","product":"Administrator Z","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32274","published":"2025-04-04T15:59:46.707Z","updated":"2026-04-28T16:12:20.526Z","title":"WordPress w3all phpBB integration Plugin <= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32273","published":"2025-04-04T15:59:46.031Z","updated":"2026-04-28T16:12:20.560Z","title":"WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"freetobook","product":"Freetobook Responsive Widget","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32272","published":"2025-04-04T15:59:45.434Z","updated":"2026-04-28T16:12:20.372Z","title":"WordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PickPlugins","product":"Wishlist","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32271","published":"2025-04-04T15:59:44.635Z","updated":"2026-04-28T16:12:20.464Z","title":"WordPress Woocommerce Role Pricing Plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ablancodev","product":"Woocommerce Role Pricing","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32270","published":"2025-04-04T15:59:43.923Z","updated":"2026-04-28T16:12:20.313Z","title":"WordPress Broadstreet plugin <= 1.52.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Broadstreet","product":"Broadstreet Ads","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32269","published":"2025-04-04T15:59:43.268Z","updated":"2026-04-28T16:12:20.289Z","title":"WordPress  WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CRM Perks","product":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32268","published":"2025-04-04T15:59:42.535Z","updated":"2026-05-12T00:03:45.823Z","title":"WordPress QR Code Tag for WC plugin <= 1.9.42 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"www.15.to","product":"QR Code Tag for WC","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32267","published":"2025-04-04T15:59:41.905Z","updated":"2026-04-28T16:12:20.069Z","title":"WordPress WP to Hootsuite plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wpzinc","product":"Post to Social Media – WordPress to Hootsuite","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32266","published":"2025-04-04T15:59:40.870Z","updated":"2026-04-28T16:12:20.048Z","title":"WordPress 404 Image Redirection (Replace Broken Images) plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wp-buy","product":"404 Image Redirection (Replace Broken Images)","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-32265","published":"2025-04-04T15:59:40.160Z","updated":"2026-04-28T16:12:20.036Z","title":"WordPress JobWP plugin <= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hossni Mubarak","product":"JobWP","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32264","published":"2025-04-04T15:59:39.503Z","updated":"2026-04-28T16:12:19.996Z","title":"WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Saiful Islam","product":"UltraAddons Elementor Lite","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32263","published":"2025-04-04T15:59:38.824Z","updated":"2026-04-28T16:12:20.078Z","title":"WordPress Sequential Order Numbers for WooCommerce plugin <= 3.6.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BeRocket","product":"Sequential Order Numbers for WooCommerce","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-32262","published":"2025-04-04T15:59:38.154Z","updated":"2026-04-28T16:12:20.026Z","title":"WordPress RDP Wiki Embed plugin <= 1.2.20 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Robert D Payne","product":"RDP Wiki Embed","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-32261","published":"2025-04-04T15:59:31.894Z","updated":"2026-04-28T16:12:19.966Z","title":"WordPress Advanced All in One Admin Search by WP Spotlight plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Kuppuraj","product":"Advanced All in One Admin Search by WP Spotlight","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-32258","published":"2025-04-04T15:59:31.151Z","updated":"2026-04-28T16:12:19.942Z","title":"WordPress Simple Website Logo plugin <= 1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"InfoGiants","product":"Simple Website Logo","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-32257","published":"2025-04-04T15:59:30.490Z","updated":"2026-04-28T16:12:19.936Z","title":"WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"1clickmigration","product":"1 Click WordPress Migration","kev":false,"epss":0.00834,"kevAdded":null},{"id":"CVE-2025-32256","published":"2025-04-04T15:59:29.737Z","updated":"2026-05-12T00:02:50.027Z","title":"WordPress SurveyJS plugin <= 1.12.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"devsoftbaltic","product":"SurveyJS","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-32255","published":"2025-04-04T15:59:29.126Z","updated":"2026-04-28T16:12:19.945Z","title":"WordPress StaffList plugin <= 3.2.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ERA404","product":"StaffList","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-32254","published":"2025-04-04T15:59:28.387Z","updated":"2026-04-28T16:12:19.925Z","title":"WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Iqonic Design","product":"WPBookit","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-32253","published":"2025-04-04T15:59:27.712Z","updated":"2026-04-28T16:12:19.852Z","title":"WordPress Course Booking System Plugin <= 6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ComMotion","product":"Course Booking System","kev":false,"epss":0.00642,"kevAdded":null},{"id":"CVE-2025-32252","published":"2025-04-04T15:59:26.942Z","updated":"2026-04-28T16:12:19.979Z","title":"WordPress WP Genealogy plugin <= 0.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Black and White","product":"WP Genealogy – Your Family History Website","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2025-32251","published":"2025-04-04T15:59:26.278Z","updated":"2026-04-28T16:12:19.899Z","title":"WordPress Jetpack Feedback Exporter plugin <= 1.23 - Sensitive Data Exposure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"J. Tyler Wiest","product":"Jetpack Feedback Exporter","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2025-32249","published":"2025-04-04T15:59:25.655Z","updated":"2026-05-12T00:03:08.570Z","title":"WordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-32248","published":"2025-04-04T15:59:25.020Z","updated":"2026-04-28T16:12:19.748Z","title":"WordPress SwiftXR (3D/AR/VR) Viewer plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SwiftXR","product":"SwiftXR (3D/AR/VR) Viewer","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-32247","published":"2025-04-04T15:59:24.313Z","updated":"2026-04-28T16:12:19.773Z","title":"WordPress AI Content Creator plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ABCdatos","product":"AI Content Creator","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-32246","published":"2025-04-04T15:59:23.633Z","updated":"2026-04-28T16:12:19.771Z","title":"WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Tim Nguyen","product":"1-Click Backup & Restore Database","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32241","published":"2025-04-04T15:59:22.875Z","updated":"2026-04-28T16:12:19.516Z","title":"WordPress Official CleverReach WooCommerce Integration plugin <= 3.4.6 - CSRF to Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CleverReach®","product":"Official CleverReach Plugin for WooCommerce","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2025-32238","published":"2025-04-04T15:59:22.174Z","updated":"2026-05-12T00:02:23.350Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2025-32237","published":"2025-04-04T15:59:21.344Z","updated":"2026-04-28T16:12:19.557Z","title":"WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32235","published":"2025-04-04T15:59:20.555Z","updated":"2026-04-28T16:12:19.545Z","title":"WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-32234","published":"2025-04-04T15:59:19.819Z","updated":"2026-04-28T16:12:19.508Z","title":"WordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"aleswebs","product":"AdMail – Multilingual Back in-Stock Notifier for WooCommerce","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32233","published":"2025-04-04T15:59:19.181Z","updated":"2026-04-28T16:12:19.565Z","title":"WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Revive.so","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32232","published":"2025-04-04T15:59:18.442Z","updated":"2026-04-28T16:12:19.675Z","title":"WordPress StaffList plugin <= 3.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ERA404","product":"StaffList","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-32231","published":"2025-04-04T15:59:17.505Z","updated":"2026-04-28T16:12:19.607Z","title":"WordPress Bookingor plugin <= 2.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bookingor","product":"Bookingor","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32229","published":"2025-04-04T15:59:16.854Z","updated":"2026-04-28T16:12:19.670Z","title":"WordPress Variable Inspector plugin <= 2.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Bowo","product":"Variable Inspector","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32226","published":"2025-04-04T15:59:15.993Z","updated":"2026-05-12T00:02:37.155Z","title":"WordPress Display product variations dropdown on shop page plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Anzar Ahmed","product":"Display product variations dropdown on shop page","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2025-32225","published":"2025-04-04T15:59:15.248Z","updated":"2026-04-28T16:12:19.424Z","title":"WordPress WP Event Manager plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Event Manager","product":"WP Event Manager","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2025-32220","published":"2025-04-04T15:59:14.531Z","updated":"2026-10-05T07:02:03.727Z","title":"WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2025-32219","published":"2025-04-04T15:59:13.765Z","updated":"2026-04-28T16:12:19.212Z","title":"WordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Syntactics, Inc.","product":"eaSYNC","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32218","published":"2025-04-04T15:59:13.069Z","updated":"2026-04-28T16:12:19.211Z","title":"WordPress TableOn plugin <= 1.0.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RealMag777","product":"TableOn","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32217","published":"2025-04-04T15:59:12.391Z","updated":"2026-04-28T16:12:19.197Z","title":"WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Messiah","product":"Ai Image Alt Text Generator for WP","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-32207","published":"2025-04-04T15:59:11.760Z","updated":"2026-05-12T00:03:02.113Z","title":"WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Anzar Ahmed","product":"Ni WooCommerce Cost Of Goods","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32204","published":"2025-04-04T15:59:11.179Z","updated":"2026-05-12T00:03:24.641Z","title":"WordPress Split Test For Elementor Plugin <= 1.8.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"rocketelements","product":"Split Test For Elementor","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32203","published":"2025-04-04T15:59:10.522Z","updated":"2026-04-28T16:12:18.837Z","title":"WordPress Falling things Plugin <= 1.08 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"manu225","product":"Falling things","kev":false,"epss":0.00645,"kevAdded":null},{"id":"CVE-2025-32201","published":"2025-04-04T15:59:09.841Z","updated":"2026-04-28T16:12:18.653Z","title":"WordPress Xpro Theme Builder Plugin <= 1.2.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Xpro","product":"Xpro Theme Builder","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-32197","published":"2025-04-04T15:59:08.565Z","updated":"2026-04-28T16:12:18.637Z","title":"WordPress Piotnet Addons For Elementor plugin <= 2.4.36 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"piotnetdotcom","product":"Piotnet Addons For Elementor","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32196","published":"2025-04-04T15:59:07.935Z","updated":"2026-05-12T00:04:22.106Z","title":"WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32195","published":"2025-04-04T15:59:07.287Z","updated":"2026-04-28T16:12:18.695Z","title":"WordPress Ecwid Shopping Cart plugin <= 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ecwid by Lightspeed Ecommerce Shopping Cart","product":"Ecwid Shopping Cart","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32194","published":"2025-04-04T15:59:06.621Z","updated":"2026-04-28T16:12:18.696Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32193","published":"2025-04-04T15:59:05.877Z","updated":"2026-04-28T16:12:18.695Z","title":"WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMinds","product":"Simple WP Events","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32192","published":"2025-04-04T15:59:05.247Z","updated":"2026-04-28T16:12:18.730Z","title":"WordPress Ultra Addons Lite for Elementor plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UltraPress","product":"Ultra Addons Lite for Elementor","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32191","published":"2025-04-04T15:59:04.562Z","updated":"2026-05-12T00:03:38.254Z","title":"WordPress News Element Elementor Blog Magazine plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webangon","product":"News Element Elementor Blog Magazine","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32190","published":"2025-04-04T15:59:03.929Z","updated":"2026-04-28T16:12:18.635Z","title":"WordPress Musician's Pack For Elementor plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"smartwpress","product":"Musician's Pack For Elementor","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32189","published":"2025-04-04T15:59:03.290Z","updated":"2026-05-12T00:03:59.930Z","title":"WordPress BWD Elementor Addons plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Best WP Developer","product":"BWD Elementor Addons","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32188","published":"2025-04-04T15:59:02.676Z","updated":"2026-04-28T16:12:18.751Z","title":"WordPress Advanced Woo Labels plugin <= 2.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ILLID","product":"Advanced Woo Labels","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32187","published":"2025-04-04T15:59:01.437Z","updated":"2026-05-12T00:03:31.358Z","title":"WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Quý Lê 91","product":"Administrator Z","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32186","published":"2025-04-04T15:59:00.350Z","updated":"2026-04-28T16:12:19.141Z","title":"WordPress Turbo Addons for Elementor plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Turbo Addons","product":"Turbo Addons Elementor","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32185","published":"2025-04-04T15:58:59.459Z","updated":"2026-04-28T16:12:18.271Z","title":"WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Extend Themes","product":"Colibri Page Builder","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-32184","published":"2025-04-04T15:58:58.751Z","updated":"2026-04-28T16:12:18.268Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32183","published":"2025-04-04T15:58:58.127Z","updated":"2026-04-28T16:12:18.260Z","title":"WordPress Video Playlist For YouTube plugin <= 6.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Galaxy Weblinks","product":"Video Playlist For YouTube","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32182","published":"2025-04-04T15:58:57.361Z","updated":"2026-04-28T16:12:18.283Z","title":"WordPress Spider Elements – Addons for Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Spider Themes","product":"Spider Elements","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32181","published":"2025-04-04T15:58:56.730Z","updated":"2026-04-28T16:12:18.262Z","title":"WordPress Search, Filters & Merchandising for WooCommerce plugin <= 3.0.58 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fast Simon","product":"Search, Filters & Merchandising for WooCommerce","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32179","published":"2025-04-04T15:58:56.118Z","updated":"2026-04-28T16:12:18.192Z","title":"WordPress Maps for WP Plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"icopydoc","product":"Maps for WP","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32177","published":"2025-04-04T15:58:55.465Z","updated":"2026-04-28T16:12:18.236Z","title":"WordPress Embed Chessboard plugin <= 3.08.00 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pgn4web","product":"Embed Chessboard","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32176","published":"2025-04-04T15:58:54.802Z","updated":"2026-04-28T16:12:18.308Z","title":"WordPress Gallery Blocks with Lightbox plugin <= 3.2.5 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GalleryCreator","product":"SimpLy Gallery","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32175","published":"2025-04-04T15:58:54.185Z","updated":"2026-04-28T16:12:18.115Z","title":"WordPress VK Filter Search plugin <= 2.20.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Vektor,Inc.","product":"VK Filter Search","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32174","published":"2025-04-04T15:58:53.569Z","updated":"2026-04-28T16:12:18.087Z","title":"WordPress Tockify Events Calendar plugin <= 2.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tockify","product":"Tockify Events Calendar","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32173","published":"2025-04-04T15:58:52.948Z","updated":"2026-04-28T16:12:18.196Z","title":"WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32172","published":"2025-04-04T15:58:52.335Z","updated":"2026-04-28T16:12:17.935Z","title":"WordPress YaMaps for WordPress plugin <= 0.6.40 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Yuri Baranov","product":"YaMaps for WordPress","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-32171","published":"2025-04-04T15:58:51.690Z","updated":"2026-04-28T16:12:18.040Z","title":"WordPress Table Block by Tableberg plugin <= 0.6.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Imtiaz Rayhan","product":"Table Block by Tableberg","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32170","published":"2025-04-04T15:58:50.839Z","updated":"2026-04-28T16:12:18.191Z","title":"WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32169","published":"2025-04-04T15:58:49.896Z","updated":"2026-04-28T16:12:18.107Z","title":"WordPress Showeblogin Social plugin <= 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Suresh Prasad","product":"Showeblogin Social","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32168","published":"2025-04-04T15:58:48.813Z","updated":"2026-04-28T16:12:17.953Z","title":"WordPress Gutenify plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodeYatri","product":"Gutenify","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32167","published":"2025-04-04T15:58:47.708Z","updated":"2026-04-28T16:12:17.948Z","title":"WordPress SurveyJS plugin <= 1.12.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"devsoftbaltic","product":"SurveyJS","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32166","published":"2025-04-04T15:58:46.522Z","updated":"2026-04-28T16:12:17.755Z","title":"WordPress Emma for WordPress plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"John Housholder","product":"Emma for WordPress","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32165","published":"2025-04-04T15:58:45.526Z","updated":"2026-04-28T16:12:17.813Z","title":"WordPress Doppler Forms plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fromdoppler","product":"Doppler Forms","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32163","published":"2025-04-04T15:58:44.575Z","updated":"2026-04-28T16:12:17.865Z","title":"WordPress Xpro Elementor Addons plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32162","published":"2025-04-04T15:58:43.903Z","updated":"2026-04-28T16:12:17.666Z","title":"WordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Morgan Kay","product":"Chamber Dashboard Business Directory","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32161","published":"2025-04-04T15:58:43.130Z","updated":"2026-04-28T16:12:17.853Z","title":"WordPress Arkhe Blocks plugin <= 2.27.1 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ryo","product":"Arkhe Blocks","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2025-32159","published":"2025-04-04T15:58:42.442Z","updated":"2026-04-28T16:12:17.965Z","title":"WordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"RadiusTheme","product":"Radius Blocks","kev":false,"epss":0.01022,"kevAdded":null},{"id":"CVE-2025-32157","published":"2025-04-04T15:58:41.761Z","updated":"2026-04-28T16:12:17.773Z","title":"WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Jakub Glos","product":"Sparkle Elementor Kit","kev":false,"epss":0.01142,"kevAdded":null},{"id":"CVE-2025-32156","published":"2025-04-04T15:58:41.127Z","updated":"2026-05-12T00:02:43.632Z","title":"WordPress Just Post Preview Widget plugin <= 1.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Alex Prokopenko / JustCoded","product":"Just Post Preview Widget","kev":false,"epss":0.01142,"kevAdded":null},{"id":"CVE-2025-32155","published":"2025-04-04T15:58:40.397Z","updated":"2026-04-28T16:12:17.654Z","title":"WordPress Beds24 Online Booking plugin <= 2.0.28 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"markkinchin","product":"Beds24 Online Booking","kev":false,"epss":0.00913,"kevAdded":null},{"id":"CVE-2025-32154","published":"2025-04-04T15:58:39.687Z","updated":"2026-04-28T16:12:17.647Z","title":"WordPress Catch Dark Mode plugin <= 2.0.1 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Catch Themes","product":"Catch Dark Mode","kev":false,"epss":0.00988,"kevAdded":null},{"id":"CVE-2025-32153","published":"2025-04-04T15:58:39.022Z","updated":"2026-04-28T16:12:17.591Z","title":"WordPress VG WooCarousel plugin <= 1.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"vinagecko","product":"VG WooCarousel","kev":false,"epss":0.01142,"kevAdded":null},{"id":"CVE-2025-32152","published":"2025-04-04T15:58:38.379Z","updated":"2026-04-28T16:12:17.573Z","title":"WordPress Slider a SlidersPack Plugin <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Essential Plugin","product":"Slider a SlidersPack","kev":false,"epss":0.01142,"kevAdded":null},{"id":"CVE-2025-32151","published":"2025-04-04T15:58:37.665Z","updated":"2026-10-07T07:43:17.055Z","title":"WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Themekraft","product":"BuddyForms","kev":false,"epss":0.00988,"kevAdded":null},{"id":"CVE-2025-32150","published":"2025-04-04T15:58:37.049Z","updated":"2026-04-28T16:12:17.463Z","title":"WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"Rameez Iqbal","product":"Real Estate Manager","kev":false,"epss":0.01142,"kevAdded":null},{"id":"CVE-2025-32149","published":"2025-04-04T15:58:36.438Z","updated":"2026-04-28T16:12:17.561Z","title":"WordPress teachPress plugin <= 9.0.11 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"winkm89","product":"teachPress","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2025-32148","published":"2025-04-04T15:58:35.750Z","updated":"2026-04-28T16:12:17.652Z","title":"WordPress Daisycon prijsvergelijkers plugin <= 4.8.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Daisycon","product":"Daisycon prijsvergelijkers","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-32147","published":"2025-04-04T15:58:35.054Z","updated":"2026-04-28T16:12:17.764Z","title":"WordPress Easy WP Optimizer Plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.8,"vendor":"coothemes","product":"Easy WP Optimizer","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-32146","published":"2025-04-04T15:58:34.392Z","updated":"2026-04-28T16:12:17.038Z","title":"WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00797,"kevAdded":null},{"id":"CVE-2025-32142","published":"2025-04-04T15:58:33.712Z","updated":"2026-04-28T16:12:17.032Z","title":"WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-32141","published":"2025-04-04T15:58:33.031Z","updated":"2026-04-28T16:12:17.025Z","title":"WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2025-32138","published":"2025-04-04T15:58:32.318Z","updated":"2026-04-28T16:12:17.022Z","title":"WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability","severity":"MEDIUM","score":6.6,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2025-32137","published":"2025-04-04T15:58:31.692Z","updated":"2026-04-28T16:12:17.038Z","title":"WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Cristián Lávaque","product":"s2Member","kev":false,"epss":0.00799,"kevAdded":null},{"id":"CVE-2025-32136","published":"2025-04-04T15:58:31.050Z","updated":"2026-04-28T16:12:17.013Z","title":"WordPress ActiveCampaign Plugin <= 8.1.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"activecampaign","product":"ActiveCampaign","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32135","published":"2025-04-04T15:58:30.306Z","updated":"2026-04-28T16:12:16.962Z","title":"WordPress Split Test For Elementor plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"rocketelements","product":"Split Test For Elementor","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32134","published":"2025-04-04T15:58:29.682Z","updated":"2026-04-28T16:12:16.962Z","title":"WordPress URL Shortify Plugin <= 1.10.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"KaizenCoders","product":"URL Shortify","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32133","published":"2025-04-04T15:58:29.039Z","updated":"2026-04-28T16:12:16.952Z","title":"WordPress Secure Copy Content Protection and Content Locking plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Ays Pro","product":"Secure Copy Content Protection and Content Locking","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32132","published":"2025-04-04T15:58:28.306Z","updated":"2026-04-28T16:12:16.951Z","title":"WordPress FunnelCockpit Plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"FunnelCockpit","product":"FunnelCockpit","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32131","published":"2025-04-04T15:58:27.668Z","updated":"2026-04-28T16:12:16.868Z","title":"WordPress Social Intents plugin <= 1.6.19 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"socialintents","product":"Social Intents","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32130","published":"2025-04-04T15:58:26.928Z","updated":"2026-04-28T16:12:16.922Z","title":"WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Data443 Risk Mitigation, Inc.","product":"Posts Footer Manager","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32129","published":"2025-04-04T15:58:26.296Z","updated":"2026-04-28T16:12:16.910Z","title":"WordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Data443 Risk Mitigation, Inc.","product":"Welcome Bar","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2025-32127","published":"2025-04-04T15:58:25.606Z","updated":"2026-04-28T16:12:16.870Z","title":"WordPress onOffice for WP-Websites plugin <= 5.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"onOffice GmbH","product":"onOffice for WP-Websites","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32126","published":"2025-04-04T15:58:24.826Z","updated":"2026-05-12T00:04:15.678Z","title":"WordPress Pay with Contact Form 7 Plugin <= 1.0.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"cmsMinds","product":"Pay with Contact Form 7","kev":false,"epss":0.00645,"kevAdded":null},{"id":"CVE-2025-32125","published":"2025-04-04T15:58:24.215Z","updated":"2026-04-28T16:12:16.778Z","title":"WordPress Silvasoft boekhouden plugin <= 3.0.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"silvasoft","product":"Silvasoft boekhouden","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32124","published":"2025-04-04T15:58:23.559Z","updated":"2026-04-28T16:12:16.746Z","title":"WordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"eleopard","product":"Behance Portfolio Manager","kev":false,"epss":0.00645,"kevAdded":null},{"id":"CVE-2025-32122","published":"2025-04-04T15:58:22.949Z","updated":"2026-04-28T16:12:16.741Z","title":"WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32121","published":"2025-04-04T15:58:22.311Z","updated":"2026-04-28T16:12:16.700Z","title":"WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"SuitePlugins","product":"Video & Photo Gallery for Ultimate Member","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32120","published":"2025-04-04T15:58:21.491Z","updated":"2026-04-28T16:12:16.781Z","title":"WordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerability","severity":"HIGH","score":7.6,"vendor":"edanzer","product":"Easy Query – WP Query Builder","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-32118","published":"2025-04-04T15:58:20.718Z","updated":"2026-04-28T16:12:16.747Z","title":"WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"NiteoThemes","product":"CMP – Coming Soon & Maintenance","kev":false,"epss":0.00683,"kevAdded":null},{"id":"CVE-2025-32113","published":"2025-04-04T15:58:20.052Z","updated":"2026-04-28T16:12:16.448Z","title":"WordPress Libro de Reclamaciones y Quejas plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Renzo Tejada","product":"Libro de Reclamaciones y Quejas","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-32112","published":"2025-04-04T15:58:19.304Z","updated":"2026-04-28T16:12:16.569Z","title":"WordPress  Sidebar Manager Light plugin <= 1.18 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"OTWthemes","product":"Sidebar Manager Light","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-22285","published":"2025-04-04T13:53:34.223Z","updated":"2026-04-29T09:56:32.094Z","title":"WordPress Pallet Packaging for WooCommerce Plugin <= 1.1.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"enituretechnology","product":"Pallet Packaging for WooCommerce","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-22281","published":"2025-04-04T13:52:32.086Z","updated":"2026-04-28T16:10:57.870Z","title":"WordPress Simplish theme <= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"joshix","product":"Simplish","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2024-51800","published":"2025-04-04T13:47:14.367Z","updated":"2026-04-28T16:10:36.583Z","title":"WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Favethemes","product":"Homey","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-31381","published":"2025-04-04T13:44:44.022Z","updated":"2026-04-28T16:12:05.679Z","title":"WordPress Booking Calendar and Notification plugin <= 4.0.3 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"shiptrack","product":"Booking Calendar and Notification","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-31384","published":"2025-04-04T13:43:15.491Z","updated":"2026-04-28T16:12:05.570Z","title":"WordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aviplugins","product":"Videos","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-31389","published":"2025-04-04T13:36:50.506Z","updated":"2026-04-28T16:12:05.532Z","title":"WordPress Sequel plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Introvoke Inc. dba Sequel.io","product":"Sequel","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-31403","published":"2025-04-04T13:34:42.539Z","updated":"2026-05-12T00:04:29.105Z","title":"WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"shiptrack","product":"Booking Calendar and Notification","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-31405","published":"2025-04-04T13:26:10.946Z","updated":"2026-04-28T16:12:06.211Z","title":"WordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerability","severity":"HIGH","score":7.5,"vendor":"zankover","product":"Fami WooCommerce Compare","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2025-31407","published":"2025-04-04T13:24:56.744Z","updated":"2026-04-28T16:12:06.194Z","title":"WordPress Tiger theme <= 2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hutsixdigital","product":"Tiger","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-31416","published":"2025-04-04T13:21:57.498Z","updated":"2026-04-28T16:12:06.604Z","title":"WordPress Awesome Event Booking plugin <= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AwesomeTOGI","product":"Awesome Event Booking","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-31418","published":"2025-04-04T13:20:48.054Z","updated":"2026-04-28T16:12:07.091Z","title":"WordPress Gravel theme <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"noonnoo","product":"Gravel","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-31420","published":"2025-04-04T13:00:13.600Z","updated":"2026-04-29T09:51:54.736Z","title":"WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.6,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31421","published":"2025-04-04T12:59:15.703Z","updated":"2026-04-29T09:51:54.805Z","title":"WordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Oblak Studio","product":"Srbtranslatin","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2025-22282","published":"2025-04-04T10:43:12.176Z","updated":"2026-04-28T16:10:57.873Z","title":"WordPress ez Form Calculator Premouium plugin <= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"keksdieb","product":"ez Form Calculator Premium","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31911","published":"2025-04-03T13:27:18.177Z","updated":"2026-04-28T16:12:15.945Z","title":"WordPress Social Share And Social Locker plugin <= 1.4.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"reputeinfosystems","product":"Social Share And Social Locker","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-31909","published":"2025-04-03T13:27:17.836Z","updated":"2026-04-28T16:12:15.844Z","title":"WordPress Apptivo Business Site CRM plugin <= 5.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Apptivo","product":"Apptivo Business Site CRM","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31907","published":"2025-04-03T13:27:17.573Z","updated":"2026-04-28T16:12:15.830Z","title":"WordPress Team Builder plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Labib Ahmed","product":"Team Builder","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31905","published":"2025-04-03T13:27:17.404Z","updated":"2026-04-28T16:12:16.043Z","title":"WordPress Team Rosters Plugin <= 4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mark O'Donnell","product":"Team Rosters","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31903","published":"2025-04-03T13:27:17.122Z","updated":"2026-04-28T16:12:15.877Z","title":"WordPress XV Random Quotes plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Xavi Ivars","product":"XV Random Quotes","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31902","published":"2025-04-03T13:27:16.933Z","updated":"2026-04-28T16:12:15.871Z","title":"WordPress Social Share And Social Locker Plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"reputeinfosystems","product":"Social Share And Social Locker","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31901","published":"2025-04-03T13:27:16.750Z","updated":"2026-04-28T16:12:15.835Z","title":"WordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Digihood","product":"Digihood HTML Sitemap","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31900","published":"2025-04-03T13:27:16.436Z","updated":"2026-04-28T16:12:15.755Z","title":"WordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"lexicata","product":"Lexicata","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31899","published":"2025-04-03T13:27:16.235Z","updated":"2026-04-28T16:12:15.851Z","title":"WordPress Awesome Logos plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpshopee","product":"Awesome Logos","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31898","published":"2025-04-03T13:27:15.866Z","updated":"2026-05-12T00:02:03.966Z","title":"WordPress MediaView plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"dustinscarberry","product":"MediaView","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-31896","published":"2025-04-03T13:27:15.691Z","updated":"2026-04-28T16:12:15.712Z","title":"WordPress GetBookingsWP Plugin <= 1.1.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"istmoplugins","product":"GetBookingsWP","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2025-31893","published":"2025-04-03T13:27:15.343Z","updated":"2026-04-28T16:12:15.267Z","title":"WordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"cheesefather","product":"Botnet Attack Blocker","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31876","published":"2025-04-03T13:27:15.172Z","updated":"2026-04-28T16:12:14.958Z","title":"WordPress Payday plugin <= 3.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.8,"vendor":"gunnarpayday","product":"Payday","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2025-31858","published":"2025-04-03T13:27:14.992Z","updated":"2026-04-28T16:12:14.735Z","title":"WordPress Local Magic plugin <= 2.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"matthewrubin","product":"Local Magic","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-31841","published":"2025-04-03T13:27:14.820Z","updated":"2026-04-28T16:12:14.192Z","title":"WordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Frank P. Walentynowicz","product":"FPW Category Thumbnails","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-31827","published":"2025-04-03T13:27:14.647Z","updated":"2026-04-28T16:12:13.913Z","title":"WordPress Fonto plugin <= 1.2.2 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"vlad.olaru","product":"Fonto","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2025-31825","published":"2025-04-03T13:27:14.464Z","updated":"2026-04-28T16:12:13.786Z","title":"WordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"pixelgrade","product":"Category Icon","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2025-31800","published":"2025-04-03T13:27:14.301Z","updated":"2026-04-28T16:12:12.996Z","title":"WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability","severity":"MEDIUM","score":6.5,"vendor":"publitio","product":"Publitio","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2025-31795","published":"2025-04-03T13:27:14.134Z","updated":"2026-04-28T16:12:12.869Z","title":"WordPress Shopify to WooCommerce Migration plugin <= 1.3.0 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugin Devs","product":"Shopify to WooCommerce Migration","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-31794","published":"2025-04-03T13:27:13.963Z","updated":"2026-04-28T16:12:12.859Z","title":"WordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Web Ready Now","product":"WR Price List Manager For Woocommerce","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2025-31789","published":"2025-04-03T13:27:13.733Z","updated":"2026-04-28T16:12:12.713Z","title":"WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Matat Technologies","product":"TextMe SMS","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-31768","published":"2025-04-03T13:27:13.512Z","updated":"2026-04-28T16:12:12.311Z","title":"WordPress Widget Manager Light plugin <= 1.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OTWthemes","product":"Widget Manager Light","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-31758","published":"2025-04-03T13:27:13.294Z","updated":"2026-04-28T16:12:12.273Z","title":"WordPress Free Woocommerce Product Table View plugin <= 1.78 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BinaryCarpenter","product":"Free Woocommerce Product Table View","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-31746","published":"2025-04-03T13:27:13.078Z","updated":"2026-04-28T16:12:11.354Z","title":"WordPress Clients plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Think201","product":"Clients","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-31739","published":"2025-04-03T13:27:12.872Z","updated":"2026-04-28T16:12:11.309Z","title":"WordPress Minimalistic Event Manager plugin <= 1.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Manuel Schmalstieg","product":"Minimalistic Event Manager","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-31736","published":"2025-04-03T13:27:12.701Z","updated":"2026-04-28T16:12:11.431Z","title":"WordPress Rich Text Editor Plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"richtexteditor","product":"Rich Text Editor","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-31729","published":"2025-04-03T13:27:12.479Z","updated":"2026-04-28T16:12:11.561Z","title":"WordPress WooTumblog plugin <= 2.1.4 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"jeffikus","product":"WooTumblog","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-31626","published":"2025-04-03T13:27:12.212Z","updated":"2026-10-06T15:24:16.053Z","title":"WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Alisaleem252","product":"Support Helpdesk Ticket System Lite","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31622","published":"2025-04-03T13:27:11.999Z","updated":"2026-04-28T16:12:10.457Z","title":"WordPress Advanced Typekit plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Utkarsh Kukreti","product":"Advanced Typekit","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31582","published":"2025-04-03T13:27:11.813Z","updated":"2026-04-28T16:12:09.624Z","title":"WordPress Contact Form vCard Generator plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ashish Ajani","product":"Contact Form vCard Generator","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31581","published":"2025-04-03T13:27:11.440Z","updated":"2026-04-28T16:12:09.540Z","title":"WordPress WP Video Playlist plugin <= 1.1.2 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sandeep Kumar","product":"WP Video Playlist","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-31573","published":"2025-04-03T13:27:11.286Z","updated":"2026-04-28T16:12:09.140Z","title":"WordPress PeproDev CF7 Database plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pepro Dev. Group","product":"PeproDev CF7 Database","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31558","published":"2025-04-03T13:27:11.053Z","updated":"2026-05-12T00:02:16.852Z","title":"WordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Greg","product":"TailPress","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2025-31554","published":"2025-04-03T13:27:10.815Z","updated":"2026-05-12T00:01:57.041Z","title":"WordPress Docxpresso plugin <= 2.6 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":5.9,"vendor":"docxpresso","product":"Docxpresso","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2025-31541","published":"2025-04-03T13:27:10.599Z","updated":"2026-04-28T16:12:08.720Z","title":"WordPress TuriTop Booking System plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TuriTop","product":"TuriTop Booking System","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-31536","published":"2025-04-03T13:27:10.409Z","updated":"2026-04-28T16:12:08.692Z","title":"WordPress CF7 Spreadsheets plugin <= 2.3.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"moshensky","product":"CF7 Spreadsheets","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31468","published":"2025-04-03T13:27:10.201Z","updated":"2026-05-12T00:01:43.741Z","title":"WordPress WP_Identicon plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scottsm","product":"WP_Identicon","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31467","published":"2025-04-03T13:27:10.045Z","updated":"2026-05-12T00:02:10.429Z","title":"WordPress Flickr Photostream plugin <= 3.1.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miro.mannino","product":"Flickr Photostream","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31442","published":"2025-04-03T13:27:09.883Z","updated":"2026-04-28T16:12:07.241Z","title":"WordPress Search engine keywords highlighter plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e1tekoap42","product":"Search engine keywords highlighter","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31436","published":"2025-04-03T13:27:09.662Z","updated":"2026-04-28T16:12:07.212Z","title":"WordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Angelo Mandato","product":"Blubrry PowerPress Podcasting plugin MultiSite add-on","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-31098","published":"2025-04-03T13:27:09.485Z","updated":"2026-08-13T10:14:42.570Z","title":"WordPress DeBounce Email Validator plugin <= 5.7 - Local File Inclusion Vulnerability","severity":"HIGH","score":7.5,"vendor":"debounce","product":"DeBounce Email Validator","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2025-31091","published":"2025-04-03T13:27:09.308Z","updated":"2026-04-28T16:12:05.088Z","title":"WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CreativeMindsSolutions","product":"CM Header and Footer","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-30916","published":"2025-04-03T13:27:09.152Z","updated":"2026-04-28T16:12:00.594Z","title":"WordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"enituretechnology","product":"Residential Address Detection","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-30915","published":"2025-04-03T13:27:09.004Z","updated":"2026-04-28T16:12:00.327Z","title":"WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"enituretechnology","product":"Small Package Quotes – Worldwide Express Edition","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-30908","published":"2025-04-03T13:27:08.814Z","updated":"2026-04-28T16:12:00.376Z","title":"WordPress Web Directory Free plugin <= 1.7.6 - CSRF to Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamalli","product":"Web Directory Free","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-30889","published":"2025-04-03T13:27:08.634Z","updated":"2026-04-28T16:11:59.827Z","title":"WordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PickPlugins","product":"Testimonial Slider","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-30858","published":"2025-04-03T13:27:08.424Z","updated":"2026-04-28T16:11:58.902Z","title":"WordPress Snow Storm plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tribulant Software","product":"Snow Storm","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-30616","published":"2025-04-03T13:27:08.209Z","updated":"2026-04-28T16:11:55.946Z","title":"WordPress Latest Custom Post Type Updates plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Wood","product":"Latest Custom Post Type Updates","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-30611","published":"2025-04-03T13:27:07.873Z","updated":"2026-04-28T16:11:55.710Z","title":"WordPress Wptobe-signinup plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wptobe","product":"Wptobe-signinup","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2025-30596","published":"2025-04-03T13:27:07.666Z","updated":"2026-04-28T16:11:55.006Z","title":"WordPress include-file plugin <= 1 - Arbitrary File Download Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"tstafford","product":"include-file","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2025-31889","published":"2025-04-01T20:58:15.304Z","updated":"2026-04-28T16:12:15.250Z","title":"WordPress Extensions for Elementor plugin <= 2.0.40 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"petesheppard84","product":"Extensions for Elementor","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-31819","published":"2025-04-01T20:58:15.132Z","updated":"2026-05-12T00:00:39.678Z","title":"WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"pixelgrade","product":"Nova Blocks","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-31628","published":"2025-04-01T20:58:14.920Z","updated":"2026-04-28T16:12:10.723Z","title":"WordPress Sliced Invoices plugin <= 3.10.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"SlicedInvoices","product":"Sliced Invoices","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2025-31619","published":"2025-04-01T20:58:14.696Z","updated":"2026-05-12T00:00:26.300Z","title":"WordPress Actionwear products sync plugin <= 2.3.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"marcoingraiti","product":"Actionwear products sync","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-31612","published":"2025-04-01T20:58:14.550Z","updated":"2026-04-28T16:12:10.237Z","title":"WordPress CBX Poll plugin <= 2.0.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sabuj Kundu","product":"CBX Poll","kev":false,"epss":0.0073,"kevAdded":null},{"id":"CVE-2025-31594","published":"2025-04-01T20:58:14.390Z","updated":"2026-04-28T16:12:10.005Z","title":"WordPress Auto scroll for reading plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPglob","product":"Auto scroll for reading","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31580","published":"2025-04-01T20:58:14.203Z","updated":"2026-04-28T16:12:09.593Z","title":"WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Anzar Ahmed","product":"Ni WooCommerce Product Enquiry","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2025-31579","published":"2025-04-01T20:58:14.026Z","updated":"2026-04-28T16:12:09.385Z","title":"WordPress WP AutoKeyword plugin <= 1.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"EXEIdeas International","product":"WP AutoKeyword","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-31578","published":"2025-04-01T20:58:13.818Z","updated":"2026-05-12T00:00:52.510Z","title":"WordPress Fonts Manager | Custom Fonts plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Wisdomlogix Solutions Pvt. Ltd.","product":"Fonts Manager | Custom Fonts","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31571","published":"2025-04-01T20:58:13.606Z","updated":"2026-04-28T16:12:09.163Z","title":"WordPress The Logo Slider plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cynob IT Consultancy","product":"The Logo Slider","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31568","published":"2025-04-01T20:58:13.443Z","updated":"2026-04-28T16:12:09.080Z","title":"WordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wiredmindshelp","product":"LeadLab by wiredminds","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31564","published":"2025-04-01T20:58:13.303Z","updated":"2026-04-28T16:12:09.039Z","title":"WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.2.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"aitool","product":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-31563","published":"2025-04-01T20:58:13.173Z","updated":"2026-05-11T23:59:21.984Z","title":"WordPress AI Search Bar plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Vimal Kava","product":"AI Search Bar","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31561","published":"2025-04-01T20:58:13.000Z","updated":"2026-04-28T16:12:09.085Z","title":"WordPress Ultimate Push Notifications plugin <= 1.2.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CodeSolz","product":"Ultimate Push Notifications","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2025-31560","published":"2025-04-01T20:58:12.843Z","updated":"2026-04-28T16:12:09.084Z","title":"WordPress Salon booking system plugin < 10.15 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2025-31553","published":"2025-04-01T20:58:12.647Z","updated":"2026-04-28T16:12:08.791Z","title":"WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFactory","product":"Advanced WooCommerce Product Sales Reporting","kev":false,"epss":0.00551,"kevAdded":null},{"id":"CVE-2025-31552","published":"2025-04-01T20:58:12.477Z","updated":"2026-04-28T16:12:08.688Z","title":"WordPress RSVPMarker  plugin <= 11.6.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"davidfcarr","product":"RSVPMarker","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-31551","published":"2025-04-01T20:58:12.306Z","updated":"2026-04-28T16:12:08.707Z","title":"WordPress Salesmate Add-On for Gravity Forms plugin <= 2.0.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Salesmate.io","product":"Salesmate Add-On for Gravity Forms","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-31550","published":"2025-04-01T20:58:12.160Z","updated":"2026-04-29T09:51:54.745Z","title":"WordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.8,"vendor":"thom4","product":"WP-LESS","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2025-31548","published":"2025-04-01T20:58:11.990Z","updated":"2026-04-28T16:12:08.729Z","title":"WordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CodeSolz","product":"Ultimate Push Notifications","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31537","published":"2025-04-01T20:58:11.858Z","updated":"2026-04-28T16:12:08.623Z","title":"WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"madfishdigital","product":"Bulk NoIndex & NoFollow Toolkit","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2025-31534","published":"2025-04-01T20:58:11.644Z","updated":"2026-04-28T16:12:08.263Z","title":"WordPress Shopper plugin <= 3.2.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"shopperdotcom","product":"Shopper","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-31531","published":"2025-04-01T20:58:11.354Z","updated":"2026-04-28T16:12:08.264Z","title":"WordPress History Log by click5 plugin <= 1.0.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"click5","product":"History Log by click5","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2025-31525","published":"2025-04-01T20:58:11.191Z","updated":"2026-05-12T00:00:59.480Z","title":"WordPress WP Mobile Bottom Menu plugin <= 1.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Messiah","product":"WP Mobile Bottom Menu","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-31462","published":"2025-04-01T20:58:11.039Z","updated":"2026-04-28T16:12:07.874Z","title":"WordPress CGM Event Calendar plugin <= 0.8.5 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"rzfarrell","product":"CGM Event Calendar","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31461","published":"2025-04-01T20:58:10.861Z","updated":"2026-04-28T16:12:07.825Z","title":"WordPress NanoSupport plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mayeenul Islam","product":"NanoSupport","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31455","published":"2025-04-01T20:58:10.662Z","updated":"2026-04-28T16:12:07.574Z","title":"WordPress Limit Max IPs Per User plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ralxz","product":"Limit Max IPs Per User","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31454","published":"2025-04-01T20:58:10.502Z","updated":"2026-04-28T16:12:07.338Z","title":"WordPress Delete Post Revision plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arefly","product":"Delete Post Revision","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31446","published":"2025-04-01T20:58:10.295Z","updated":"2026-04-28T16:12:07.238Z","title":"WordPress WP Cleaner plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jiangmiao","product":"WP Cleaner","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31445","published":"2025-04-01T20:58:10.085Z","updated":"2026-04-28T16:12:07.162Z","title":"WordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sed Lex","product":"Pages Order","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31441","published":"2025-04-01T20:58:09.953Z","updated":"2026-04-28T16:12:07.213Z","title":"WordPress WordPress Galleria plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"S","product":"WordPress Galleria","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31431","published":"2025-04-01T20:58:09.812Z","updated":"2026-04-28T16:12:06.909Z","title":"WordPress WP Bookmarks plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"conlabz GmbH","product":"WP Bookmarks","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31097","published":"2025-04-01T20:58:09.663Z","updated":"2026-04-28T16:12:05.126Z","title":"WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"Hossein","product":"Material Dashboard","kev":false,"epss":0.00861,"kevAdded":null},{"id":"CVE-2025-31089","published":"2025-04-01T20:58:09.502Z","updated":"2026-05-12T00:00:19.404Z","title":"WordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"Fahad Mahmood","product":"Order Splitter for WooCommerce","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2025-31086","published":"2025-04-01T20:58:09.334Z","updated":"2026-04-28T16:12:05.046Z","title":"WordPress Product Table by WBW plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WBW Plugins","product":"Product Table by WBW","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31085","published":"2025-04-01T20:58:09.158Z","updated":"2026-04-28T16:12:05.103Z","title":"WordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Michel - xiligroup dev","product":"xili-language","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31082","published":"2025-04-01T20:58:08.969Z","updated":"2026-04-28T16:12:04.997Z","title":"WordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"InfornWeb","product":"News & Blog Designer Pack","kev":false,"epss":0.00861,"kevAdded":null},{"id":"CVE-2025-31081","published":"2025-04-01T20:58:08.754Z","updated":"2026-04-28T16:12:04.901Z","title":"WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ShortPixel","product":"Enable Media Replace","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-31080","published":"2025-04-01T20:58:08.596Z","updated":"2026-04-28T16:12:05.042Z","title":"WordPress HTML Forms plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Link Software LLC","product":"HTML Forms","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31078","published":"2025-04-01T20:58:08.419Z","updated":"2026-04-28T16:12:04.854Z","title":"WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"enituretechnology","product":"Small Package Quotes – Worldwide Express Edition","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30913","published":"2025-04-01T20:58:08.241Z","updated":"2026-04-28T16:12:00.287Z","title":"WordPress Access Areas Plugin <= 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"podpirate","product":"Access Areas","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30906","published":"2025-04-01T20:58:08.092Z","updated":"2026-04-28T16:12:00.252Z","title":"WordPress Plugin Oficial – Getnet para WooCommerce plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"lisandragetnet","product":"Plugin Oficial – Getnet para WooCommerce","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30905","published":"2025-04-01T20:58:07.928Z","updated":"2026-04-28T16:12:00.183Z","title":"WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Secure Copy Content Protection and Content Locking","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30892","published":"2025-04-01T20:58:07.779Z","updated":"2026-04-28T16:11:59.686Z","title":"WordPress WpTravelly Plugin <= 1.8.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"WpTravelly","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2025-30853","published":"2025-04-01T20:58:07.634Z","updated":"2026-04-28T16:11:58.853Z","title":"WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ShortPixel","product":"ShortPixel Adaptive Images","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-30852","published":"2025-04-01T20:58:07.479Z","updated":"2026-04-28T16:11:58.856Z","title":"WordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"emotionalonlinestorytelling","product":"Oracle Cards Lite","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30844","published":"2025-04-01T20:58:07.310Z","updated":"2026-04-28T16:11:58.609Z","title":"WordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Watu Quiz","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2025-30841","published":"2025-04-01T20:58:07.179Z","updated":"2026-04-29T09:51:54.941Z","title":"WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"adamskaat","product":"Countdown & Clock","kev":false,"epss":0.0078,"kevAdded":null},{"id":"CVE-2025-30825","published":"2025-04-01T20:58:07.036Z","updated":"2026-04-28T16:11:57.960Z","title":"WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WPClever","product":"WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-30807","published":"2025-04-01T20:58:06.852Z","updated":"2026-04-28T16:11:57.878Z","title":"WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Martin Nguyen","product":"Next-Cart Store to WooCommerce Migration","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2025-30778","published":"2025-04-01T20:58:06.697Z","updated":"2026-04-28T16:11:56.911Z","title":"WordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Vikas Ratudi","product":"VPSUForm","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-30580","published":"2025-04-01T20:58:06.500Z","updated":"2026-04-28T16:11:54.515Z","title":"WordPress DigiWidgets Image Editor plugin <= 1.10 - Remote Code Execution (RCE) Vulnerability","severity":"CRITICAL","score":10,"vendor":"kellydiek","product":"DigiWidgets Image Editor","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2025-30554","published":"2025-04-01T20:58:06.317Z","updated":"2026-04-28T16:11:53.936Z","title":"WordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Abhishek Kumar","product":"Frizzly","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2025-31753","published":"2025-04-01T20:42:09.765Z","updated":"2026-04-28T16:12:12.298Z","title":"WordPress Advanced Speed Increaser Plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Animesh Kumar","product":"Advanced Speed Increaser","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-31910","published":"2025-04-01T14:52:25.743Z","updated":"2026-04-28T16:12:15.996Z","title":"WordPress BookingPress plugin <= 1.1.28 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"reputeinfosystems","product":"BookingPress","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-31908","published":"2025-04-01T14:52:25.168Z","updated":"2026-04-28T16:12:16.149Z","title":"WordPress JSON Structuring Markup plugin <= 0.1 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Sami Ahmed Siddiqui","product":"JSON Structuring Markup","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-31906","published":"2025-04-01T14:52:24.422Z","updated":"2026-04-28T16:12:15.894Z","title":"WordPress WP Profitshare Plugin <= 1.4.9 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"ProfitShare.ro","product":"WP Profitshare","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-31904","published":"2025-04-01T14:52:23.745Z","updated":"2026-04-28T16:12:15.887Z","title":"WordPress Ebook Downloader plugin <= 1.0 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Infoway LLC","product":"Ebook Downloader","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-31897","published":"2025-04-01T14:52:23.212Z","updated":"2026-04-28T16:12:15.665Z","title":"WordPress Arrow Custom Feed for Twitter plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arrow Plugins","product":"Arrow Custom Feed for Twitter","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31895","published":"2025-04-01T14:52:22.671Z","updated":"2026-04-28T16:12:15.342Z","title":"WordPress ABC Notation Plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"paulrosen","product":"ABC Notation","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31894","published":"2025-04-01T14:52:22.139Z","updated":"2026-04-28T16:12:15.264Z","title":"WordPress Ebook Downloader plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Infoway LLC","product":"Ebook Downloader","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31892","published":"2025-04-01T14:52:21.582Z","updated":"2026-04-28T16:12:15.362Z","title":"WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31891","published":"2025-04-01T14:52:21.018Z","updated":"2026-04-28T16:12:15.303Z","title":"WordPress Gosign – Posts Slider Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gosign","product":"Gosign – Posts Slider Block","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31890","published":"2025-04-01T14:52:20.445Z","updated":"2026-04-28T16:12:15.255Z","title":"WordPress Simple Map No Api plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mashi","product":"Simple Map No Api","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31888","published":"2025-04-01T14:52:19.871Z","updated":"2026-04-28T16:12:15.343Z","title":"WordPress WP Multi Store Locator Plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPExperts.io","product":"WP Multistore Locator","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-31887","published":"2025-04-01T14:52:19.326Z","updated":"2026-04-28T16:12:15.347Z","title":"WordPress MyBookProgress plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"zookatron","product":"MyBookProgress by Stormhill Media","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-31886","published":"2025-04-01T14:52:18.807Z","updated":"2026-04-28T16:12:15.252Z","title":"WordPress Social proof testimonials and reviews by Repuso plugin <= 5.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Repuso","product":"Social proof testimonials and reviews by Repuso","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-31885","published":"2025-04-01T14:52:18.288Z","updated":"2026-04-28T16:12:15.279Z","title":"WordPress Hyperlink Group Block plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Daniel Floeter","product":"Hyperlink Group Block","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31884","published":"2025-04-01T14:52:17.756Z","updated":"2026-04-28T16:12:15.261Z","title":"WordPress Norse Rune Oracle Plugin plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP CMS Ninja","product":"Norse Rune Oracle Plugin","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31883","published":"2025-04-01T14:52:17.221Z","updated":"2026-04-28T16:12:15.310Z","title":"WordPress WebinarPress plugin <= 1.33.28 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WPWebinarSystem","product":"WebinarPress","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-31882","published":"2025-04-01T14:52:16.704Z","updated":"2026-04-28T16:12:15.269Z","title":"WordPress Webinar Plugin <= 1.33.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPWebinarSystem","product":"WebinarPress","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-31881","published":"2025-04-01T14:52:16.185Z","updated":"2026-04-28T16:12:15.308Z","title":"WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Stylemix","product":"Pearl","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2025-31880","published":"2025-04-01T14:52:15.664Z","updated":"2026-04-28T16:12:15.166Z","title":"WordPress Pearl plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Stylemix","product":"Pearl","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-31879","published":"2025-04-01T14:52:15.105Z","updated":"2026-04-28T16:12:15.511Z","title":"WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"Barcode Generator for WooCommerce","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-31878","published":"2025-04-01T14:52:14.564Z","updated":"2026-04-28T16:12:15.271Z","title":"WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dmitry V. (CEO of \"UKR Solution\")","product":"UPC/EAN/GTIN Code Generator","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-31877","published":"2025-04-01T14:52:14.025Z","updated":"2026-04-28T16:12:15.327Z","title":"WordPress RestroPress plugin <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-31875","published":"2025-04-01T14:52:13.492Z","updated":"2026-04-28T16:12:14.938Z","title":"WordPress FancyPost plugin <= 6.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pluginic","product":"FancyPost","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31874","published":"2025-04-01T14:52:12.963Z","updated":"2026-04-28T16:12:14.903Z","title":"WordPress WebberZone Snippetz plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ajay","product":"WebberZone Snippetz","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31873","published":"2025-04-01T14:52:12.411Z","updated":"2026-05-11T23:58:51.570Z","title":"WordPress SheetDB plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"sheetdb","product":"SheetDB","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-31872","published":"2025-04-01T14:52:11.863Z","updated":"2026-04-28T16:12:14.859Z","title":"WordPress WP Clone any post type Plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Galaxy Weblinks","product":"WP Clone any post type","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2025-31871","published":"2025-04-01T14:52:11.332Z","updated":"2026-04-28T16:12:14.804Z","title":"WordPress WP Clone any post type Plugin <= 3.6 - Open Redirect vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Galaxy Weblinks","product":"WP Clone any post type","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-31870","published":"2025-04-01T14:52:10.777Z","updated":"2026-04-28T16:12:14.727Z","title":"WordPress WP AutoKeyword plugin <= 1.0 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":5.4,"vendor":"EXEIdeas International","product":"WP AutoKeyword","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-31869","published":"2025-04-01T14:52:10.255Z","updated":"2026-04-28T16:12:14.722Z","title":"WordPress Black Widgets For Elementor plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Modernaweb Studio","product":"Black Widgets For Elementor","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31868","published":"2025-04-01T14:52:09.685Z","updated":"2026-04-28T16:12:14.940Z","title":"WordPress JS Job Manager plugin <= 2.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-31867","published":"2025-04-01T14:52:09.167Z","updated":"2026-04-28T16:12:14.938Z","title":"WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"JoomSky","product":"JS Job Manager","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-31866","published":"2025-04-01T14:52:08.647Z","updated":"2026-04-28T16:12:14.723Z","title":"WordPress ShipDepot for WooCommerce plugin <= 1.2.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ship Depot","product":"ShipDepot for WooCommerce","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-31865","published":"2025-04-01T14:52:08.115Z","updated":"2026-04-28T16:12:14.727Z","title":"WordPress CartBoss plugin <= 4.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CartBoss","product":"CartBoss","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2025-31864","published":"2025-04-01T14:52:07.561Z","updated":"2026-04-28T16:12:14.692Z","title":"WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Out the Box","product":"Beam me up Scotty","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2025-31863","published":"2025-04-01T14:52:07.010Z","updated":"2026-04-28T16:12:14.724Z","title":"WordPress Agency Toolkit plugin <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"inspry","product":"Agency Toolkit","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31862","published":"2025-04-01T14:52:06.479Z","updated":"2026-04-28T16:12:14.929Z","title":"WordPress Job Board Manager Plugin <= 2.1.61 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PickPlugins","product":"Job Board Manager","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-31861","published":"2025-04-01T14:52:05.944Z","updated":"2026-04-28T16:12:14.734Z","title":"WordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPOrbit Support","product":"Perfect Font Awesome Integration","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31860","published":"2025-04-01T14:52:05.352Z","updated":"2026-04-28T16:12:14.938Z","title":"WordPress WP AdCenter plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPeka","product":"WP AdCenter","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31859","published":"2025-04-01T14:52:04.816Z","updated":"2026-04-28T16:12:14.739Z","title":"WordPress Feedbucket – Website Feedback Tool Plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Feedbucket","product":"Feedbucket – Website Feedback Tool","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-31857","published":"2025-04-01T14:52:04.221Z","updated":"2026-04-28T16:12:14.697Z","title":"WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Directorist AddonsKit for Elementor","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31856","published":"2025-04-01T14:52:03.675Z","updated":"2026-04-28T16:12:14.759Z","title":"WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"brainvireinfo","product":"Export All Post Meta","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2025-31855","published":"2025-04-01T14:52:02.903Z","updated":"2026-04-28T16:12:14.888Z","title":"WordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"softnwords","product":"SMM API","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31854","published":"2025-04-01T14:52:02.316Z","updated":"2026-04-28T16:12:14.588Z","title":"WordPress Simple Sticky Add To Cart For WooCommerce plugin <= 1.4.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Sharaz Shahid","product":"Simple Sticky Add To Cart For WooCommerce","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-31853","published":"2025-04-01T14:52:01.722Z","updated":"2026-04-28T16:12:14.320Z","title":"WordPress Smartarget Popup Plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Erez Hadas-Sonnenschein","product":"Smartarget Popup","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-31852","published":"2025-04-01T14:52:01.160Z","updated":"2026-05-11T23:59:30.014Z","title":"WordPress Bulk Product Sync plugin <= 8.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"N-Media","product":"Bulk Product Sync","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-31851","published":"2025-04-01T14:52:00.517Z","updated":"2026-04-28T16:12:14.340Z","title":"WordPress Beds24 Online Booking plugin <= 2.0.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"markkinchin","product":"Beds24 Online Booking","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31850","published":"2025-04-01T14:51:59.841Z","updated":"2026-04-28T16:12:14.264Z","title":"WordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RedefiningTheWeb","product":"PDF Generator Addon for Elementor Page Builder","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31849","published":"2025-04-01T14:51:59.314Z","updated":"2026-04-28T16:12:14.277Z","title":"WordPress Nemesis All-in-One plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fbtemplates","product":"Nemesis All-in-One","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31848","published":"2025-04-01T14:51:58.801Z","updated":"2026-05-11T23:59:52.585Z","title":"WordPress WordPress Adverts Plugin plugin <= 1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFactory","product":"Adverts","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31847","published":"2025-04-01T14:51:58.225Z","updated":"2026-04-28T16:12:14.278Z","title":"WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themelooks","product":"mFolio Lite","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31846","published":"2025-04-01T14:51:57.706Z","updated":"2026-04-28T16:12:14.242Z","title":"WordPress Theater for WordPress plugin <= 0.18.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Jeroen Schmit","product":"Theater for WordPress","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31845","published":"2025-04-01T14:51:57.174Z","updated":"2026-04-28T16:12:14.218Z","title":"WordPress Theme Duplicator Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rohit Choudhary","product":"Theme Duplicator","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31844","published":"2025-04-01T14:51:56.622Z","updated":"2026-05-12T00:01:23.349Z","title":"WordPress Magical Blocks plugin <= 1.0.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Noor Alam","product":"Magical Blocks","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31843","published":"2025-04-01T14:51:55.999Z","updated":"2026-04-28T16:12:14.220Z","title":"WordPress OpenAI Tools for WordPress & WooCommerce plugin <= 2.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wilson","product":"OpenAI Tools for WordPress & WooCommerce","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31842","published":"2025-04-01T14:51:55.498Z","updated":"2026-04-28T16:12:14.207Z","title":"WordPress Viral Loops WP Integration Plugin <= 3.4.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"viralloops","product":"Viral Loops WP Integration","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2025-31840","published":"2025-04-01T14:51:54.988Z","updated":"2026-04-28T16:12:14.277Z","title":"WordPress Simple Fixed Notice Plugin <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"digireturn","product":"Simple Fixed Notice","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31839","published":"2025-04-01T14:51:54.448Z","updated":"2026-05-11T23:58:59.007Z","title":"WordPress  Footer Contacts Bar plugin <= 1.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"digireturn","product":"DN Footer Contacts","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31838","published":"2025-04-01T14:51:53.861Z","updated":"2026-05-11T23:59:15.055Z","title":"WordPress Eventbee RSVP Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eventbee","product":"Eventbee RSVP Widget","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31837","published":"2025-04-01T14:51:53.345Z","updated":"2026-04-28T16:12:14.213Z","title":"WordPress WP Proposals plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP Codeus","product":"WP Proposals","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31836","published":"2025-04-01T14:51:52.810Z","updated":"2026-04-28T16:12:14.219Z","title":"WordPress Review Manager plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"matthewrubin","product":"Review Manager","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31835","published":"2025-04-01T14:51:52.302Z","updated":"2026-04-28T16:12:14.247Z","title":"WordPress WP Plugin Info Card plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brice Capobianco","product":"WP Plugin Info Card","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-31834","published":"2025-04-01T14:51:51.781Z","updated":"2026-04-28T16:12:14.147Z","title":"WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeglow","product":"JobBoard Job listing","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-31833","published":"2025-04-01T14:51:51.275Z","updated":"2026-04-28T16:12:13.986Z","title":"WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"themeglow","product":"JobBoard Job listing","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2025-31832","published":"2025-04-01T14:51:50.752Z","updated":"2026-04-28T16:12:13.927Z","title":"WordPress ACF City Selector plugin <= 1.17.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Beee","product":"ACF City Selector","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2025-31831","published":"2025-04-01T14:51:50.222Z","updated":"2026-04-28T16:12:13.961Z","title":"WordPress AtomChat plugin <= 1.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Team AtomChat","product":"AtomChat","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31830","published":"2025-04-01T14:51:49.704Z","updated":"2026-04-28T16:12:14.011Z","title":"WordPress Printus Plugin <= 1.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Uriahs Victor","product":"Printus","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-31829","published":"2025-04-01T14:51:49.200Z","updated":"2026-04-28T16:12:13.993Z","title":"WordPress ShopCred plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"devscred","product":"ShopCred","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31828","published":"2025-04-01T14:51:48.676Z","updated":"2026-04-28T16:12:13.952Z","title":"WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability","severity":"MEDIUM","score":4.3,"vendor":"alextselegidis","product":"Easy!Appointments","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-31826","published":"2025-04-01T14:51:48.162Z","updated":"2026-04-28T16:12:13.679Z","title":"WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Anzar Ahmed","product":"Ni WooCommerce Cost Of Goods","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2025-31824","published":"2025-04-01T14:51:47.645Z","updated":"2026-04-28T16:12:13.544Z","title":"WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wombat Plugins","product":"WP Optin Wheel","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-31823","published":"2025-04-01T14:51:46.887Z","updated":"2026-05-12T00:01:15.803Z","title":"WordPress WPoperation Elementor Addons plugin 1.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpoperations","product":"WPoperation Elementor Addons","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31822","published":"2025-04-01T14:51:46.314Z","updated":"2026-04-28T16:12:13.697Z","title":"WordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access  Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ashish Ajani","product":"WP Simple HTML Sitemap","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31821","published":"2025-04-01T14:51:45.775Z","updated":"2025-05-10T02:55:22.050Z","title":"WordPress Integration of Zoho CRM and Contact Form 7 plugin <= 1.0.6 - Open Redirection Vulnerability","severity":"MEDIUM","score":4.7,"vendor":"formsintegrations","product":"Integration of Zoho CRM and Contact Form 7","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-31820","published":"2025-04-01T14:51:45.247Z","updated":"2026-04-28T16:12:13.604Z","title":"WordPress Automatic Featured Images from Videos plugin <= 1.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"webdevstudios","product":"Automatic Featured Images from Videos","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2025-31818","published":"2025-04-01T14:51:44.682Z","updated":"2026-04-28T16:12:13.484Z","title":"WordPress ContentBot AI Writer plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ContentBot.ai","product":"ContentBot AI Writer","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-31817","published":"2025-04-01T14:51:44.143Z","updated":"2026-04-28T16:12:13.352Z","title":"WordPress BlockWheels plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPWheels","product":"BlockWheels","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31816","published":"2025-04-01T14:51:43.552Z","updated":"2026-04-28T16:12:13.461Z","title":"WordPress Mobile App Canvas Plugin <= 3.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pietro","product":"Mobile App Canvas","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31815","published":"2025-04-01T14:51:43.013Z","updated":"2026-04-28T16:12:13.353Z","title":"WordPress Design Blocks plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"devscred","product":"Design Blocks","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31814","published":"2025-04-01T14:51:42.462Z","updated":"2026-04-28T16:12:13.471Z","title":"WordPress OwnerRez Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"OwnerRez","product":"OwnerRez API","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31813","published":"2025-04-01T14:51:41.800Z","updated":"2026-04-28T16:12:13.350Z","title":"WordPress WPSHARE247 Elementor Addons plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Website366.com","product":"WPSHARE247 Elementor Addons","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31812","published":"2025-04-01T14:51:41.048Z","updated":"2026-04-28T16:12:13.320Z","title":"WordPress BuddyPress Members Only plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tomas","product":"BuddyPress Members Only","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31811","published":"2025-04-01T14:51:40.437Z","updated":"2026-04-28T16:12:13.240Z","title":"WordPress Planyo online reservation system plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xtreeme","product":"Planyo online reservation system","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31810","published":"2025-04-01T14:51:39.860Z","updated":"2026-04-28T16:12:13.328Z","title":"WordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PickPlugins","product":"Question Answer","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31809","published":"2025-04-01T14:51:39.281Z","updated":"2026-04-28T16:12:13.614Z","title":"WordPress Labinator Content Types Duplicator Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Labinator","product":"Labinator Content Types Duplicator","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31808","published":"2025-04-01T14:51:38.730Z","updated":"2026-04-28T16:12:13.223Z","title":"WordPress SCSS WP Editor plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"IT Path Solutions","product":"SCSS WP Editor","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31807","published":"2025-04-01T14:51:38.153Z","updated":"2026-04-28T16:12:13.172Z","title":"WordPress Product Notices for WooCommerce plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"CloudRedux","product":"Product Notices for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31806","published":"2025-04-01T14:51:37.549Z","updated":"2026-05-11T23:59:59.468Z","title":"WordPress Webling plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"uSystems","product":"Webling","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31805","published":"2025-04-01T14:51:36.930Z","updated":"2026-04-28T16:12:13.178Z","title":"WordPress Gutena Kit plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saad Iqbal","product":"Gutena Kit – Gutenberg Blocks and Templates","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31804","published":"2025-04-01T14:51:36.333Z","updated":"2026-04-28T16:12:13.125Z","title":"WordPress Follow Us Badges plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DraftPress Team","product":"Follow Us Badges","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31803","published":"2025-04-01T14:51:35.752Z","updated":"2026-04-28T16:12:13.065Z","title":"WordPress Turisbook Booking System plugin <= 1.3.8 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Neteuro","product":"Turisbook Booking System","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31802","published":"2025-04-01T14:51:35.057Z","updated":"2026-04-28T16:12:13.293Z","title":"WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Shiptimize","product":"Shiptimize for WooCommerce","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31801","published":"2025-04-01T14:51:34.501Z","updated":"2026-05-12T00:00:12.887Z","title":"WordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Maksym Marko","product":"MX Time Zone Clocks","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31799","published":"2025-04-01T14:51:33.933Z","updated":"2026-04-28T16:12:13.311Z","title":"WordPress Publitio plugin <= 2.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"publitio","product":"Publitio","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31798","published":"2025-04-01T14:51:33.336Z","updated":"2026-04-28T16:12:12.876Z","title":"WordPress Publitio Plugin <= 2.1.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"publitio","product":"Publitio","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31797","published":"2025-04-01T14:51:32.434Z","updated":"2026-04-28T16:12:12.929Z","title":"WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BoldGrid","product":"Sprout Clients","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31796","published":"2025-04-01T14:51:31.846Z","updated":"2026-05-12T00:00:46.069Z","title":"WordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"TheInnovs","product":"ElementsCSS Addons for Elementor","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2025-31793","published":"2025-04-01T14:51:31.310Z","updated":"2026-04-28T16:12:12.919Z","title":"WordPress Piotnet Forms plugin <= 1.0.30 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"piotnetdotcom","product":"Piotnet Forms","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31792","published":"2025-04-01T14:51:30.774Z","updated":"2026-04-28T16:12:12.979Z","title":"WordPress Piotnet Forms plugin <= 1.0.30 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"piotnetdotcom","product":"Piotnet Forms","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31791","published":"2025-04-01T14:51:30.237Z","updated":"2026-04-28T16:12:12.898Z","title":"WordPress Pin Generator Plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Oliver Boyers","product":"Pin Generator","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31790","published":"2025-04-01T14:51:29.670Z","updated":"2026-04-28T16:12:12.773Z","title":"WordPress Posten plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Binsaifullah","product":"Posten","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31788","published":"2025-04-01T14:51:29.126Z","updated":"2026-04-28T16:12:12.745Z","title":"WordPress AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin <= 1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Smackcoders Inc.,","product":"AIO Performance Profiler, Monitor, Optimize, Compress & Debug","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2025-31787","published":"2025-04-01T14:51:28.460Z","updated":"2026-04-28T16:12:12.792Z","title":"WordPress Cue by AudioTheme.com plugin <= 2.4.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AudioTheme","product":"Cue","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-31786","published":"2025-04-01T14:51:27.774Z","updated":"2026-04-28T16:12:12.748Z","title":"WordPress Simple Icons plugin <= 2.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Travis","product":"Simple Icons","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2025-31785","published":"2025-04-01T14:51:27.267Z","updated":"2026-04-28T16:12:12.722Z","title":"WordPress Clearbit Reveal plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Clearbit","product":"Clearbit Reveal","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-31784","published":"2025-04-01T14:51:26.746Z","updated":"2026-05-12T00:01:37.268Z","title":"WordPress Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more Plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Rudy Susanto","product":"Embed Extended","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31783","published":"2025-04-01T14:51:26.241Z","updated":"2026-04-28T16:12:12.808Z","title":"WordPress Leartes TRY Exchange Rates Plugin <= 2.1 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leartes.NET","product":"Leartes TRY Exchange Rates","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31782","published":"2025-04-01T14:51:25.735Z","updated":"2026-04-28T16:12:12.668Z","title":"WordPress mb.YTPlayer plugin <= 3.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pupunzi","product":"mb.YTPlayer","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31781","published":"2025-04-01T14:51:25.219Z","updated":"2026-05-11T23:59:43.986Z","title":"WordPress Gift Cards for WooCommerce plugin <= 1.5.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ahmadshyk","product":"Gift Cards for WooCommerce","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31780","published":"2025-04-01T14:51:24.680Z","updated":"2026-04-28T16:12:12.673Z","title":"WordPress Append Content plugin <= 2.1.1 - CSRF to Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Andy Stratton","product":"Append Content","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2025-31779","published":"2025-04-01T14:51:24.164Z","updated":"2026-04-28T16:12:12.661Z","title":"WordPress Query Wrangler plugin <= 1.5.54 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Jonathan Daggerhart","product":"Query Wrangler","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-31778","published":"2025-04-01T14:51:23.646Z","updated":"2026-04-28T16:12:12.620Z","title":"WordPress Donate Me Plugin <= 1.2.5 - Stored Cross-Site Scripting vulnerability","severity":"MEDIUM","score":6.5,"vendor":"raphaelheide","product":"Donate Me","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31777","published":"2025-04-01T14:51:23.123Z","updated":"2026-04-28T16:12:12.622Z","title":"WordPress Clockinator Lite plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BeastThemes","product":"Clockinator Lite","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31776","published":"2025-04-01T14:51:22.600Z","updated":"2026-04-28T16:12:12.563Z","title":"WordPress Uptime Robot Plugin <= 2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Aphotrax","product":"Uptime Robot Plugin for WordPress","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31775","published":"2025-04-01T14:51:22.084Z","updated":"2026-04-28T16:12:12.629Z","title":"WordPress Google SEO Pressor for Rich snippets Plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Smackcoders Inc.,","product":"Google SEO Pressor Snippet","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31774","published":"2025-04-01T14:51:21.580Z","updated":"2026-04-28T16:12:12.655Z","title":"WordPress plugin Astra Security Suite plugin<= 0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebProtect.ai","product":"Astra Security Suite","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2025-31773","published":"2025-04-01T14:51:21.029Z","updated":"2026-04-28T16:12:12.569Z","title":"WordPress Ship Per Product plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"cedcommerce","product":"Ship Per Product","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-31772","published":"2025-04-01T14:51:20.508Z","updated":"2026-04-28T16:12:12.582Z","title":"WordPress WP Modal Popup with Cookie Integration plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Astoundify","product":"WP Modal Popup with Cookie Integration","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31771","published":"2025-04-01T14:51:19.963Z","updated":"2026-04-28T16:12:12.516Z","title":"WordPress Team Members for Elementor Page Builder plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sultan Nasir Uddin","product":"Team Members for Elementor Page Builder","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31770","published":"2025-04-01T14:51:19.428Z","updated":"2026-04-28T16:12:12.517Z","title":"WordPress  Content Manager Light plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OTWthemes","product":"Content Manager Light","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31769","published":"2025-04-01T14:51:18.860Z","updated":"2026-04-28T16:12:12.457Z","title":"WordPress CLP – Custom Login Page by NiteoThemes plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"NiteoThemes","product":"CLP – Custom Login Page by NiteoThemes","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31767","published":"2025-04-01T14:51:18.309Z","updated":"2026-04-28T16:12:12.375Z","title":"WordPress Post Custom Templates Lite plugin <= 1.14 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"OTWthemes","product":"Post Custom Templates Lite","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31766","published":"2025-04-01T14:51:17.794Z","updated":"2026-04-28T16:12:12.348Z","title":"WordPress PhotoShelter for Photographers Blog Feed plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PhotoShelter","product":"PhotoShelter for Photographers Blog Feed Plugin","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31765","published":"2025-04-01T14:51:17.281Z","updated":"2026-04-28T16:12:12.292Z","title":"WordPress GDPR Cookie Notice plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"themeqx","product":"GDPR Cookie Notice","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31764","published":"2025-04-01T14:51:16.778Z","updated":"2026-04-28T16:12:12.290Z","title":"WordPress Cache control by Cacholong plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Preliot","product":"Cache control by Cacholong","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31763","published":"2025-04-01T14:51:16.279Z","updated":"2026-05-12T00:01:08.852Z","title":"WordPress Cache control by Cacholong Plugin <= 5.4.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Preliot","product":"Cache control by Cacholong","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31762","published":"2025-04-01T14:51:15.765Z","updated":"2026-04-28T16:12:12.286Z","title":"WordPress Sheet2Site plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"andreyazimov","product":"Sheet2Site","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31761","published":"2025-04-01T14:51:15.256Z","updated":"2026-04-28T16:12:12.272Z","title":"WordPress Hypotext plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DEJAN","product":"Hypotext","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31760","published":"2025-04-01T14:51:14.727Z","updated":"2026-04-28T16:12:12.222Z","title":"WordPress SnapWidget Social Photo Feed Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"snapwidget","product":"SnapWidget Social Photo Feed Widget","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31759","published":"2025-04-01T14:51:14.211Z","updated":"2026-04-28T16:12:12.286Z","title":"WordPress Boo Recipes plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BooSpot","product":"Boo Recipes","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31757","published":"2025-04-01T14:51:13.704Z","updated":"2026-04-28T16:12:12.228Z","title":"WordPress Free Woocommerce Product Table View plugin <= 1.78 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"BinaryCarpenter","product":"Free Woocommerce Product Table View","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-31756","published":"2025-04-01T14:51:13.185Z","updated":"2026-04-28T16:12:12.260Z","title":"WordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"tuyennv","product":"TZ PlusGallery","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-31755","published":"2025-04-01T14:51:12.650Z","updated":"2026-04-28T16:12:12.237Z","title":"WordPress pCloud Backup plugin <= 1.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"josselynj","product":"pCloud Backup","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31754","published":"2025-04-01T14:51:12.129Z","updated":"2026-04-28T16:12:12.300Z","title":"WordPress DobsonDev Shortcodes plugin <= 2.1.12 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DobsonDev","product":"DobsonDev Shortcodes","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31752","published":"2025-04-01T14:51:11.583Z","updated":"2026-04-28T16:12:12.287Z","title":"WordPress Bulk Fields Editor plugin <= 1.8.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"termel","product":"Bulk Fields Editor","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31751","published":"2025-04-01T14:51:10.966Z","updated":"2026-04-28T16:12:12.238Z","title":"WordPress Breaking News WP Plugin <= 1.3 - CSRF to Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"doit","product":"Breaking News WP","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-31750","published":"2025-04-01T14:51:10.293Z","updated":"2026-04-28T16:12:11.618Z","title":"WordPress Breaking News WP Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"doit","product":"Breaking News WP","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31749","published":"2025-04-01T14:51:09.768Z","updated":"2026-04-28T16:12:11.619Z","title":"WordPress  HMH Footer Builder For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPelite","product":"HMH Footer Builder For Elementor","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31748","published":"2025-04-01T14:51:09.239Z","updated":"2026-04-28T16:12:11.790Z","title":"WordPress Opal Portfolio Plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpopal","product":"Opal Portfolio","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31747","published":"2025-04-01T14:51:08.737Z","updated":"2026-04-28T16:12:11.608Z","title":"WordPress WP Chrono plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"milan.latinovic","product":"WP Chrono","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31745","published":"2025-04-01T14:51:08.224Z","updated":"2026-04-28T16:12:11.250Z","title":"WordPress Subscription Form for Feedblitz Plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arni Cinco","product":"Subscription Form for Feedblitz","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31744","published":"2025-04-01T14:51:07.706Z","updated":"2026-04-28T16:12:11.244Z","title":"WordPress Lightweight and Responsive Youtube Embed plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpszaki","product":"Lightweight and Responsive Youtube Embed","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31743","published":"2025-04-01T14:51:07.208Z","updated":"2026-04-28T16:12:11.268Z","title":"WordPress Lightweight and Responsive Youtube Embed Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpszaki","product":"Lightweight and Responsive Youtube Embed","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31742","published":"2025-04-01T14:51:06.707Z","updated":"2026-05-11T23:59:36.462Z","title":"WordPress Dima Take Action Plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"PixelDima","product":"Dima Take Action","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-31741","published":"2025-04-01T14:51:06.199Z","updated":"2026-04-28T16:12:11.264Z","title":"WordPress Easy Magazine plugin <= 2.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Filtr8","product":"Easy Magazine","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31740","published":"2025-04-01T14:51:05.676Z","updated":"2026-05-12T00:00:32.742Z","title":"WordPress News, Magazine and Blog Elements Plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"aThemeArt","product":"News, Magazine and Blog Elements","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31738","published":"2025-04-01T14:51:05.140Z","updated":"2026-04-28T16:12:11.290Z","title":"WordPress LeadQuizzes Plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"yazamodeveloper","product":"LeadQuizzes","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31737","published":"2025-04-01T14:51:04.637Z","updated":"2026-04-28T16:12:11.359Z","title":"WordPress Client Showcase plugin <= 1.2.0 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"dxladner","product":"Client Showcase","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31735","published":"2025-04-01T14:51:04.093Z","updated":"2026-04-28T16:12:11.264Z","title":"WordPress Footnotes for WordPress plugin <= 2016.1230 - Cross Site Scripting (XSS) Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"C. Johnson","product":"Footnotes for WordPress","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31734","published":"2025-04-01T14:51:03.501Z","updated":"2026-04-28T16:12:11.268Z","title":"WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Syed Balkhi","product":"Simple Post Expiration","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31733","published":"2025-04-01T14:51:02.929Z","updated":"2026-04-28T16:12:11.273Z","title":"WordPress WP Sitemap Plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Boot Div","product":"WP Sitemap","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31732","published":"2025-04-01T14:51:02.397Z","updated":"2026-05-11T23:59:06.993Z","title":"WordPress GB Gallery Slideshow plugin <= 1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"gb-plugins","product":"GB Gallery Slideshow","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2025-31731","published":"2025-04-01T14:51:01.844Z","updated":"2026-04-28T16:12:11.275Z","title":"WordPress Author Bio Shortcode Plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Philip John","product":"Author Bio Shortcode","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31730","published":"2025-04-01T14:51:01.189Z","updated":"2026-04-28T16:12:11.261Z","title":"WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DigitalCourt","product":"Marketer Addons","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-31408","published":"2025-04-01T13:07:54.459Z","updated":"2026-04-28T16:12:06.042Z","title":"WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Zoho Flow","product":"Zoho Flow","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-31409","published":"2025-04-01T05:32:24.989Z","updated":"2026-04-28T16:12:06.089Z","title":"WordPress Bridge Core plugin < 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NotFound","product":"Bridge Core","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-31024","published":"2025-04-01T05:32:24.749Z","updated":"2026-04-28T16:12:03.902Z","title":"WordPress RJ Quickcharts plugin <= 0.6.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"randyjensen","product":"RJ Quickcharts","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-31001","published":"2025-04-01T05:32:24.584Z","updated":"2026-04-29T09:51:54.810Z","title":"WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"TLA Media","product":"GTM Kit","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2025-30971","published":"2025-04-01T05:32:24.447Z","updated":"2026-04-28T16:12:02.292Z","title":"WordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Xavi Ivars","product":"XV Random Quotes","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-22277","published":"2025-04-01T05:32:24.249Z","updated":"2026-04-28T16:10:57.813Z","title":"WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"appsbd","product":"Vitepos","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2025-31415","published":"2025-04-01T05:31:42.561Z","updated":"2026-04-28T16:12:06.286Z","title":"WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability","severity":"HIGH","score":7.6,"vendor":"YayCommerce","product":"YayExtra","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2025-31095","published":"2025-04-01T05:31:42.244Z","updated":"2026-04-28T16:12:05.083Z","title":"WordPress Material Dashboard plugin <= 1.4.5 - Privilege Escalation Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hossein","product":"Material Dashboard","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2025-31087","published":"2025-04-01T05:31:42.090Z","updated":"2026-04-28T16:12:05.062Z","title":"WordPress Multiple Shipping And Billing Address For Woocommerce plugin <= 1.5 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"silverplugins217","product":"Multiple Shipping And Billing Address For Woocommerce","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2025-31084","published":"2025-04-01T05:31:41.938Z","updated":"2026-05-12T00:01:29.785Z","title":"WordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"sunshinephotocart","product":"Sunshine Photo Cart","kev":false,"epss":0.00731,"kevAdded":null},{"id":"CVE-2025-31074","published":"2025-04-01T05:31:41.729Z","updated":"2026-04-28T16:12:04.822Z","title":"WordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"MDJM","product":"Mobile DJ Manager","kev":false,"epss":0.00689,"kevAdded":null},{"id":"CVE-2025-30926","published":"2025-04-01T05:31:41.359Z","updated":"2026-04-28T16:12:01.064Z","title":"WordPress King Addons for Elementor plugin <= 24.12.58 - Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-30924","published":"2025-04-01T05:31:41.181Z","updated":"2026-04-28T16:12:00.780Z","title":"WordPress Primer MyData for Woocommerce plugin < 4.2.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"primersoftware","product":"Primer MyData for Woocommerce","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30917","published":"2025-04-01T05:31:41.024Z","updated":"2026-04-28T16:12:00.296Z","title":"WordPress SKU Generator for WooCommerce plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Wham","product":"SKU Generator for WooCommerce","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30911","published":"2025-04-01T05:31:40.844Z","updated":"2026-04-28T16:12:00.350Z","title":"WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Rometheme","product":"RTMKit","kev":false,"epss":0.01936,"kevAdded":null},{"id":"CVE-2025-30910","published":"2025-04-01T05:31:40.624Z","updated":"2026-04-28T16:12:00.353Z","title":"WordPress CM Download Manager plugin <= 2.9.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"CreativeMindsSolutions","product":"CM Download Manager","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-30902","published":"2025-04-01T05:31:40.449Z","updated":"2026-04-28T16:11:59.970Z","title":"WordPress AEC Kiosque plugin <= 1.9.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ATL Software SRL","product":"AEC Kiosque","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30901","published":"2025-04-01T05:31:40.254Z","updated":"2026-04-28T16:11:59.989Z","title":"WordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00885,"kevAdded":null},{"id":"CVE-2025-30886","published":"2025-04-01T05:31:40.109Z","updated":"2026-04-28T16:11:59.838Z","title":"WordPress JS Help Desk plugin <= 2.9.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2025-30882","published":"2025-04-01T05:31:39.899Z","updated":"2026-04-28T16:11:59.519Z","title":"WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2025-30880","published":"2025-04-01T05:31:39.694Z","updated":"2026-04-28T16:11:59.619Z","title":"WordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2025-30878","published":"2025-04-01T05:31:39.524Z","updated":"2026-04-28T16:11:59.407Z","title":"WordPress JS Help Desk plugin <= 2.9.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"JoomSky","product":"JS Help Desk","kev":false,"epss":0.00645,"kevAdded":null},{"id":"CVE-2025-30876","published":"2025-04-01T05:31:39.352Z","updated":"2026-04-28T16:11:59.586Z","title":"WordPress Ads by WPQuads plugin <= 2.0.87.1 - SQL Injection Vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ads by WPQuads","product":"Ads by WPQuads","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2025-30870","published":"2025-04-01T05:31:39.039Z","updated":"2026-04-28T16:11:59.308Z","title":"WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"WP Travel Engine","product":"WP Travel Engine","kev":false,"epss":0.00797,"kevAdded":null},{"id":"CVE-2025-30869","published":"2025-04-01T05:31:38.852Z","updated":"2026-04-28T16:11:59.336Z","title":"WordPress Image Wall plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"Parakoos","product":"Image Wall","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30849","published":"2025-04-01T05:31:38.644Z","updated":"2026-04-28T16:11:58.855Z","title":"WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability","severity":"HIGH","score":8.1,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.00827,"kevAdded":null},{"id":"CVE-2025-30848","published":"2025-04-01T05:31:38.484Z","updated":"2026-04-28T16:11:58.878Z","title":"WordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Hostel","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30840","published":"2025-04-01T05:31:38.308Z","updated":"2026-04-28T16:11:58.496Z","title":"WordPress xili-dictionary plugin <= 2.12.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Michel - xiligroup dev","product":"xili-dictionary","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30837","published":"2025-04-01T05:31:38.076Z","updated":"2026-04-28T16:11:58.353Z","title":"WordPress WooCommerce Fattureincloud plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cristiano Zanca","product":"WooCommerce Fattureincloud","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30834","published":"2025-04-01T05:31:37.848Z","updated":"2026-04-28T16:11:58.633Z","title":"WordPress Bit Assist plugin <= 1.5.4 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Bit Apps","product":"Bit Assist","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-30827","published":"2025-04-01T05:31:37.708Z","updated":"2026-04-28T16:11:58.350Z","title":"WordPress WP2LEADS plugin <= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saleswonder Team: Tobias","product":"WP2LEADS","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30808","published":"2025-04-01T05:31:37.509Z","updated":"2026-04-28T16:11:58.128Z","title":"WordPress About Author plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Weblizar - WordPress Themes & Plugin","product":"About Author","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-30802","published":"2025-04-01T05:31:37.340Z","updated":"2026-04-28T16:11:57.683Z","title":"WordPress Our Team Members plugin <= 2.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPBean","product":"Our Team Members","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-30798","published":"2025-04-01T05:31:37.186Z","updated":"2026-04-28T16:11:57.497Z","title":"WordPress Better WishList API plugin <= 1.1.4 - Cross Site Scripting (XSS) Vulnerability","severity":"HIGH","score":7.1,"vendor":"rickonline_nl","product":"Better WishList API","kev":false,"epss":0.00317,"kevAdded":null}]}