{"items":[{"id":"CVE-2026-123472","published":"2026-11-07T17:26:44.830Z","updated":"2026-11-07T18:05:57.603Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119522","published":"2026-11-07T17:26:14.308Z","updated":"2026-11-07T18:19:02.043Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123461","published":"2026-11-07T17:24:12.806Z","updated":"2026-11-07T18:19:19.847Z","title":"WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120836","published":"2026-11-07T17:23:37.515Z","updated":"2026-11-07T18:21:27.916Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124258","published":"2026-11-07T17:22:23.738Z","updated":"2026-11-07T18:26:28.583Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123860","published":"2026-11-07T12:47:17.885Z","updated":"2026-11-07T12:48:18.246Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123861","published":"2026-11-07T12:43:53.043Z","updated":"2026-11-07T18:26:28.745Z","title":"WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CrocoBlock","product":"JetFormBuilder – Hierarchical Select","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120839","published":"2026-11-07T12:43:21.399Z","updated":"2026-11-07T18:26:28.923Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120841","published":"2026-11-07T12:42:33.813Z","updated":"2026-11-07T18:26:29.092Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121777","published":"2026-11-07T12:41:23.603Z","updated":"2026-11-07T12:42:24.109Z","title":"WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cool Plugins","product":"Cool Formkit Lite","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123467","published":"2026-11-07T12:40:37.332Z","updated":"2026-11-07T18:26:29.227Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122659","published":"2026-11-07T12:40:06.898Z","updated":"2026-11-07T18:26:29.365Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121579","published":"2026-11-07T12:39:43.632Z","updated":"2026-11-07T18:05:57.745Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121575","published":"2026-11-07T12:39:13.305Z","updated":"2026-11-07T18:26:29.496Z","title":"WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122660","published":"2026-11-07T12:38:48.962Z","updated":"2026-11-07T18:26:29.625Z","title":"WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123483","published":"2026-11-07T12:37:39.979Z","updated":"2026-11-07T12:38:02.079Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123183","published":"2026-11-07T12:36:14.140Z","updated":"2026-11-07T12:37:14.784Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123474","published":"2026-11-07T12:35:49.136Z","updated":"2026-11-07T18:26:29.756Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121775","published":"2026-11-07T12:34:57.797Z","updated":"2026-11-07T18:26:29.889Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123462","published":"2026-11-07T12:34:29.645Z","updated":"2026-11-07T18:26:30.034Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122669","published":"2026-11-07T12:33:16.603Z","updated":"2026-11-07T18:05:57.879Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122663","published":"2026-11-07T12:32:48.988Z","updated":"2026-11-07T18:26:30.226Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121784","published":"2026-11-07T12:32:21.394Z","updated":"2026-11-07T18:05:58.012Z","title":"WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpBookingly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123477","published":"2026-11-07T12:31:41.803Z","updated":"2026-11-07T18:05:58.153Z","title":"WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119498","published":"2026-11-07T11:59:49.573Z","updated":"2026-11-07T18:26:30.510Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121765","published":"2026-11-07T11:59:18.951Z","updated":"2026-11-07T18:05:58.746Z","title":"WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121571","published":"2026-11-07T10:43:00.672Z","updated":"2026-11-07T18:26:31.299Z","title":"WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Autopay dla WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119496","published":"2026-11-07T10:42:25.139Z","updated":"2026-11-07T10:43:24.665Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123470","published":"2026-11-07T10:41:57.797Z","updated":"2026-11-07T10:42:59.418Z","title":"WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119513","published":"2026-11-07T10:40:44.537Z","updated":"2026-11-07T18:26:31.428Z","title":"WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123468","published":"2026-11-07T10:40:25.729Z","updated":"2026-11-07T18:26:31.557Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120857","published":"2026-11-07T10:39:37.731Z","updated":"2026-11-07T10:40:37.937Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123148","published":"2026-11-07T10:38:47.933Z","updated":"2026-11-07T18:26:31.691Z","title":"WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"IvyForms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120837","published":"2026-11-07T10:38:04.753Z","updated":"2026-11-07T18:26:31.838Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121724","published":"2026-11-07T10:33:47.544Z","updated":"2026-11-07T18:26:31.985Z","title":"WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebberZone","product":"Contextual Related Posts","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120364","published":"2026-11-07T10:32:12.907Z","updated":"2026-11-07T18:06:02.383Z","title":"WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Untapwp","product":"Vidplex","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119523","published":"2026-11-07T10:31:51.308Z","updated":"2026-11-07T18:26:32.121Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119525","published":"2026-11-07T10:26:38.378Z","updated":"2026-11-07T18:26:32.255Z","title":"WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Dropshipping XML for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120365","published":"2026-11-07T10:26:11.841Z","updated":"2026-11-07T18:06:02.538Z","title":"WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119478","published":"2026-11-07T10:19:33.802Z","updated":"2026-11-07T18:26:32.388Z","title":"WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119508","published":"2026-11-07T10:19:12.514Z","updated":"2026-11-07T18:26:32.553Z","title":"WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119492","published":"2026-11-07T10:17:32.001Z","updated":"2026-11-07T18:26:32.711Z","title":"WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119501","published":"2026-11-07T10:16:34.151Z","updated":"2026-11-07T18:06:02.691Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121783","published":"2026-11-07T10:14:14.440Z","updated":"2026-11-07T18:26:32.883Z","title":"WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119490","published":"2026-11-07T10:13:30.275Z","updated":"2026-11-07T10:13:30.707Z","title":"WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Made with Fuel Ltd.","product":"Better Notifications for WP","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119486","published":"2026-11-07T10:12:15.663Z","updated":"2026-11-07T18:36:38.624Z","title":"WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119500","published":"2026-11-07T10:11:35.425Z","updated":"2026-11-07T18:06:02.853Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120840","published":"2026-11-07T10:11:13.974Z","updated":"2026-11-07T18:36:38.765Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120842","published":"2026-11-07T10:10:23.132Z","updated":"2026-11-07T18:36:38.917Z","title":"WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119520","published":"2026-11-07T10:08:56.559Z","updated":"2026-11-07T18:06:03.012Z","title":"WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119494","published":"2026-11-07T10:08:28.998Z","updated":"2026-11-07T10:09:29.820Z","title":"WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120850","published":"2026-11-07T10:07:25.343Z","updated":"2026-11-07T18:06:03.316Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119493","published":"2026-11-07T10:02:35.608Z","updated":"2026-11-07T18:06:03.489Z","title":"WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119507","published":"2026-11-07T09:32:03.635Z","updated":"2026-11-07T09:33:04.577Z","title":"WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"NotificationX","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119473","published":"2026-11-07T09:30:03.347Z","updated":"2026-11-07T09:31:03.312Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119465","published":"2026-11-07T09:28:22.807Z","updated":"2026-11-07T18:36:39.059Z","title":"WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121762","published":"2026-11-07T09:27:39.697Z","updated":"2026-11-07T18:36:40.531Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123464","published":"2026-11-07T09:15:20.726Z","updated":"2026-11-07T18:06:04.148Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119502","published":"2026-11-07T09:14:43.488Z","updated":"2026-11-07T18:36:40.665Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BdThemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122668","published":"2026-11-07T09:14:18.820Z","updated":"2026-11-07T18:36:40.811Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120853","published":"2026-11-07T09:13:56.417Z","updated":"2026-11-07T18:36:40.944Z","title":"WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120852","published":"2026-11-07T09:13:00.557Z","updated":"2026-11-07T09:14:03.085Z","title":"WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123469","published":"2026-11-07T09:12:38.521Z","updated":"2026-11-07T09:13:41.132Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119491","published":"2026-11-07T09:12:13.459Z","updated":"2026-11-07T18:36:41.078Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61990","published":"2026-11-07T09:11:48.682Z","updated":"2026-11-07T09:12:50.744Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119484","published":"2026-11-07T09:11:20.814Z","updated":"2026-11-07T18:36:41.217Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.00121,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120847","published":"2026-11-07T09:10:16.635Z","updated":"2026-11-07T18:36:41.351Z","title":"WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119511","published":"2026-11-07T09:09:48.677Z","updated":"2026-11-07T18:36:41.487Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121766","published":"2026-11-07T09:09:21.425Z","updated":"2026-11-07T18:36:41.620Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123466","published":"2026-11-07T09:08:23.000Z","updated":"2026-11-07T18:36:41.763Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121768","published":"2026-11-07T09:05:00.105Z","updated":"2026-11-07T18:06:04.309Z","title":"WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Markus Wiesenhofer","product":"Contact Form 7 &#8211; Post Fields","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52713","published":"2026-11-07T09:03:26.066Z","updated":"2026-11-07T18:36:41.908Z","title":"WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119467","published":"2026-11-07T09:02:27.952Z","updated":"2026-11-07T18:36:42.044Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66669","published":"2026-11-07T09:01:51.291Z","updated":"2026-11-07T18:36:42.203Z","title":"WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Suplugins","product":"Superb Addons: Blocks, Patterns &amp; Theme Designer","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119510","published":"2026-11-07T09:00:25.855Z","updated":"2026-11-07T18:06:04.464Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121781","published":"2026-11-07T08:56:31.769Z","updated":"2026-11-07T18:36:42.341Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119489","published":"2026-11-07T08:55:48.421Z","updated":"2026-11-07T18:06:04.624Z","title":"WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bootstrapped Ventures","product":"WP Recipe Maker","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120849","published":"2026-11-07T08:53:25.327Z","updated":"2026-11-07T08:53:25.758Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120848","published":"2026-11-07T08:51:59.575Z","updated":"2026-11-07T18:06:04.788Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124274","published":"2026-11-07T08:50:22.538Z","updated":"2026-11-07T18:36:42.483Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122675","published":"2026-11-07T08:49:27.020Z","updated":"2026-11-07T18:36:42.623Z","title":"WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wpmet","product":"Wp Social","kev":false,"epss":0.00091,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121761","published":"2026-11-07T08:49:00.698Z","updated":"2026-11-07T08:49:01.176Z","title":"WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121767","published":"2026-11-07T08:48:16.421Z","updated":"2026-11-07T08:49:16.806Z","title":"WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weDocs","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121778","published":"2026-11-07T08:44:53.759Z","updated":"2026-11-07T18:36:42.759Z","title":"WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Lab","product":"WP-Lister Lite for Amazon","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121779","published":"2026-11-07T08:43:09.390Z","updated":"2026-11-07T18:36:42.901Z","title":"WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Subscription","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39733","published":"2026-11-07T08:42:42.190Z","updated":"2026-11-07T08:43:43.055Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27356","published":"2026-11-06T22:31:02.728Z","updated":"2026-11-07T08:42:07.462Z","title":"WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ibericode","product":"MC4WP","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120845","published":"2026-11-06T22:30:37.452Z","updated":"2026-11-07T18:06:10.465Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123471","published":"2026-11-06T22:30:15.072Z","updated":"2026-11-06T22:31:16.143Z","title":"WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120851","published":"2026-11-06T22:29:15.977Z","updated":"2026-11-07T18:36:43.319Z","title":"WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119519","published":"2026-11-06T22:28:51.886Z","updated":"2026-11-07T18:36:43.449Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122670","published":"2026-11-06T22:28:26.764Z","updated":"2026-11-07T18:36:43.583Z","title":"WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115431","published":"2026-11-06T13:00:09.664Z","updated":"2026-11-06T15:20:56.089Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115952","published":"2026-11-06T13:00:09.134Z","updated":"2026-11-06T14:59:55.656Z","title":"WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109883","published":"2026-11-06T12:09:26.993Z","updated":"2026-11-06T15:00:13.234Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109884","published":"2026-11-06T12:09:26.933Z","updated":"2026-11-06T22:33:32.248Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119516","published":"2026-11-06T08:00:31.536Z","updated":"2026-11-07T18:36:44.024Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00386,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119472","published":"2026-11-06T08:00:31.526Z","updated":"2026-11-06T15:04:01.911Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00161,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120844","published":"2026-11-06T08:00:31.435Z","updated":"2026-11-06T17:34:39.032Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00331,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39744","published":"2026-11-06T08:00:31.106Z","updated":"2026-11-06T15:04:17.337Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119488","published":"2026-11-06T08:00:31.083Z","updated":"2026-11-06T15:04:31.805Z","title":"WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119499","published":"2026-11-06T08:00:30.965Z","updated":"2026-11-06T15:24:52.802Z","title":"WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119468","published":"2026-11-04T12:08:34.695Z","updated":"2026-11-06T15:07:46.574Z","title":"WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noptin Newsletter Team","product":"Noptin","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119481","published":"2026-11-04T12:08:34.250Z","updated":"2026-11-04T15:08:50.711Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.0042,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65555","published":"2026-11-04T12:08:34.246Z","updated":"2026-11-04T15:08:50.865Z","title":"WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.0042,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57666","published":"2026-11-04T08:00:17.428Z","updated":"2026-11-04T15:18:55.611Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119366","published":"2026-11-04T08:00:17.394Z","updated":"2026-11-04T20:00:58.355Z","title":"WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62007","published":"2026-11-04T08:00:17.118Z","updated":"2026-11-04T15:18:55.748Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54861","published":"2026-11-04T08:00:17.026Z","updated":"2026-11-04T15:18:55.889Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62126","published":"2026-11-04T08:00:16.984Z","updated":"2026-11-04T15:18:56.023Z","title":"WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":0.00263,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57775","published":"2026-11-04T08:00:16.575Z","updated":"2026-11-04T15:18:56.169Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57639","published":"2026-11-04T08:00:16.567Z","updated":"2026-11-04T15:18:56.313Z","title":"WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Roland Murg","product":"WP Booking System","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119477","published":"2026-11-04T08:00:16.109Z","updated":"2026-11-04T15:18:56.445Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-56065","published":"2026-11-04T08:00:16.083Z","updated":"2026-11-04T15:18:56.602Z","title":"WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Doofinder","product":"Doofinder for WooCommerce","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54851","published":"2026-11-04T07:00:37.741Z","updated":"2026-11-04T15:18:56.736Z","title":"WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Awesomemotive","product":"Contact Form by WPForms","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62000","published":"2026-11-04T07:00:37.663Z","updated":"2026-11-04T15:18:56.879Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119509","published":"2026-11-03T17:03:46.228Z","updated":"2026-11-03T22:41:20.019Z","title":"WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eranfl","product":"ClickCease Click Fraud Protection","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97072","published":"2026-11-03T17:02:23.919Z","updated":"2026-11-03T17:25:22.004Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114187","published":"2026-11-03T17:01:22.719Z","updated":"2026-11-04T21:26:00.747Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103077","published":"2026-11-03T17:00:11.724Z","updated":"2026-11-03T22:41:26.022Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114185","published":"2026-11-03T16:59:35.394Z","updated":"2026-11-03T17:26:18.705Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119485","published":"2026-11-03T16:57:33.723Z","updated":"2026-11-03T16:58:34.370Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39777","published":"2026-11-03T16:55:05.128Z","updated":"2026-11-07T03:18:41.059Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119487","published":"2026-11-03T16:52:54.932Z","updated":"2026-11-03T17:26:46.976Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120843","published":"2026-11-03T16:51:22.083Z","updated":"2026-11-06T15:04:47.314Z","title":"WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Barn2 Plugins","product":"Posts Table with Search & Sort","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114183","published":"2026-11-03T16:49:43.622Z","updated":"2026-11-07T03:17:31.396Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116859","published":"2026-11-03T16:48:24.138Z","updated":"2026-11-03T22:41:32.139Z","title":"WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116858","published":"2026-11-03T16:45:49.000Z","updated":"2026-11-04T21:26:55.574Z","title":"WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39743","published":"2026-11-03T16:44:44.480Z","updated":"2026-11-04T21:27:55.181Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120846","published":"2026-11-03T16:44:19.563Z","updated":"2026-11-07T03:16:56.112Z","title":"WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119521","published":"2026-11-03T16:43:38.652Z","updated":"2026-11-06T15:05:02.807Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119495","published":"2026-11-03T16:43:08.775Z","updated":"2026-11-03T17:19:37.063Z","title":"WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Better Search","kev":false,"epss":0.00598,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66570","published":"2026-11-01T16:00:09.605Z","updated":"2026-11-01T17:37:10.026Z","title":"WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nickboss","product":"WordPress File Upload","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119480","published":"2026-11-01T16:00:09.213Z","updated":"2026-11-01T17:37:19.222Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62048","published":"2026-11-01T16:00:09.158Z","updated":"2026-11-01T17:37:28.623Z","title":"WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00342,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118090","published":"2026-10-30T18:30:57.420Z","updated":"2026-10-30T18:50:06.371Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00446,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118089","published":"2026-10-30T18:30:56.607Z","updated":"2026-10-30T18:50:06.521Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.0039,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118086","published":"2026-10-30T18:30:54.718Z","updated":"2026-10-30T22:15:49.368Z","title":"WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.0036,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116862","published":"2026-10-30T18:30:53.968Z","updated":"2026-10-30T18:50:06.680Z","title":"WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Acato","product":"WP REST Cache","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116861","published":"2026-10-30T18:30:53.202Z","updated":"2026-10-30T18:50:06.822Z","title":"WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"wpdesk","product":"Flexible Chat","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116854","published":"2026-10-30T18:30:52.464Z","updated":"2026-10-30T18:50:06.975Z","title":"WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116853","published":"2026-10-30T18:30:51.710Z","updated":"2026-10-30T18:50:07.134Z","title":"WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116852","published":"2026-10-30T18:30:50.961Z","updated":"2026-10-30T22:15:55.746Z","title":"WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Marketing Fire","product":"Widget Options","kev":false,"epss":0.00595,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116851","published":"2026-10-30T18:30:50.217Z","updated":"2026-10-30T18:50:07.289Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116847","published":"2026-10-30T18:30:49.476Z","updated":"2026-10-30T18:50:07.433Z","title":"WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116410","published":"2026-10-30T18:30:48.730Z","updated":"2026-10-30T18:50:07.593Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116405","published":"2026-10-30T18:30:47.976Z","updated":"2026-10-30T18:50:07.747Z","title":"WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116401","published":"2026-10-30T18:30:47.215Z","updated":"2026-10-30T22:16:02.694Z","title":"WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116386","published":"2026-10-30T18:30:46.458Z","updated":"2026-10-30T18:50:07.905Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00349,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115947","published":"2026-10-30T18:30:45.703Z","updated":"2026-10-30T18:50:08.056Z","title":"WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115604","published":"2026-10-30T18:30:44.953Z","updated":"2026-10-30T18:50:08.230Z","title":"WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114711","published":"2026-10-30T18:30:44.199Z","updated":"2026-10-30T18:50:08.382Z","title":"WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107868","published":"2026-10-30T18:30:43.460Z","updated":"2026-10-30T22:16:09.766Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITHEMES","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105077","published":"2026-10-30T18:30:42.711Z","updated":"2026-10-30T19:00:18.568Z","title":"WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94175","published":"2026-10-30T18:30:41.949Z","updated":"2026-10-30T19:00:18.724Z","title":"WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"All In One Login","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90888","published":"2026-10-30T18:30:41.184Z","updated":"2026-10-30T19:00:18.867Z","title":"WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"leadsnap","product":"LeadSnap","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78527","published":"2026-10-30T18:30:40.428Z","updated":"2026-10-30T22:16:24.495Z","title":"WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Testimonial Slider","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73186","published":"2026-10-30T18:30:39.660Z","updated":"2026-10-30T19:00:19.002Z","title":"WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ShortPixel","product":"Enable Media Replace","kev":false,"epss":0.00391,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54855","published":"2026-10-30T18:30:38.911Z","updated":"2026-10-30T19:00:19.152Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54854","published":"2026-10-30T18:30:38.149Z","updated":"2026-10-30T19:00:19.289Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54850","published":"2026-10-30T18:30:37.392Z","updated":"2026-10-30T19:00:19.472Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00363,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48201","published":"2026-10-30T18:30:36.622Z","updated":"2026-10-30T22:16:45.956Z","title":"WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Raul P.","product":"Fast Velocity Minify","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39786","published":"2026-10-30T18:30:35.811Z","updated":"2026-10-30T19:00:19.629Z","title":"WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bookingalgorithms","product":"BA Book Everything","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39738","published":"2026-10-30T18:30:34.923Z","updated":"2026-11-01T10:33:20.156Z","title":"WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39734","published":"2026-10-30T18:30:34.168Z","updated":"2026-10-30T19:00:19.915Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39732","published":"2026-10-30T18:30:33.419Z","updated":"2026-10-30T19:00:20.047Z","title":"WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ivijan-Stefan Stipic","product":"Transliterator","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28160","published":"2026-10-30T18:30:32.657Z","updated":"2026-11-02T06:29:27.699Z","title":"WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27061","published":"2026-10-30T18:30:31.909Z","updated":"2026-10-30T19:00:20.210Z","title":"WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119526","published":"2026-10-30T18:30:31.153Z","updated":"2026-10-30T19:00:20.359Z","title":"WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Royal Event","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62056","published":"2026-10-30T18:14:58.428Z","updated":"2026-10-30T18:33:56.893Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62023","published":"2026-10-30T18:14:07.501Z","updated":"2026-10-30T18:49:58.188Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62019","published":"2026-10-30T18:13:23.687Z","updated":"2026-10-30T18:49:58.331Z","title":"WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104674","published":"2026-10-30T18:12:56.057Z","updated":"2026-10-30T18:49:58.474Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62047","published":"2026-10-30T18:12:37.091Z","updated":"2026-10-30T18:49:58.628Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39739","published":"2026-10-30T18:11:41.349Z","updated":"2026-10-30T18:34:07.113Z","title":"WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Ultimate Addons for Elementor - Lite","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52710","published":"2026-10-30T18:09:43.100Z","updated":"2026-10-30T19:00:20.558Z","title":"WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ithemelandco","product":"GIFTiT &#8211; Free Gifts for WooCommerce","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62057","published":"2026-10-30T18:08:54.944Z","updated":"2026-10-30T19:00:20.717Z","title":"WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fahim Reza","product":"Divi Contact Form 7","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62121","published":"2026-10-30T18:06:19.970Z","updated":"2026-10-30T18:49:58.770Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62122","published":"2026-10-30T18:05:54.717Z","updated":"2026-10-30T18:49:58.921Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119466","published":"2026-10-30T16:16:28.198Z","updated":"2026-10-30T16:39:18.607Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65566","published":"2026-10-30T16:15:59.202Z","updated":"2026-10-30T17:18:21.422Z","title":"WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62055","published":"2026-10-30T16:11:26.969Z","updated":"2026-10-30T17:18:21.560Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119365","published":"2026-10-30T16:11:00.627Z","updated":"2026-10-30T17:18:21.690Z","title":"WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Media Player Addons for Elementor – Media Player widget for WP","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119367","published":"2026-10-30T16:10:10.603Z","updated":"2026-10-30T17:18:21.825Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00231,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62141","published":"2026-10-30T15:29:24.363Z","updated":"2026-10-30T17:18:22.239Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119369","published":"2026-10-30T15:10:13.570Z","updated":"2026-10-30T15:43:43.340Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119479","published":"2026-10-30T15:09:48.592Z","updated":"2026-10-30T17:18:22.511Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116407","published":"2026-10-30T15:08:52.909Z","updated":"2026-10-30T15:50:49.510Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119368","published":"2026-10-30T15:02:22.664Z","updated":"2026-10-30T17:18:22.640Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00314,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119482","published":"2026-10-30T15:01:55.085Z","updated":"2026-10-30T17:18:22.784Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116860","published":"2026-10-30T14:42:18.051Z","updated":"2026-10-30T15:07:31.474Z","title":"WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119370","published":"2026-10-30T14:41:30.900Z","updated":"2026-10-30T15:07:31.625Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65444","published":"2026-10-30T14:40:48.198Z","updated":"2026-10-30T15:07:31.758Z","title":"WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Creative Themes","product":"Blocksy Companion","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118084","published":"2026-10-29T15:24:41.085Z","updated":"2026-10-30T18:39:14.169Z","title":"WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118083","published":"2026-10-29T15:24:40.327Z","updated":"2026-10-30T18:49:59.436Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118082","published":"2026-10-29T15:24:39.565Z","updated":"2026-10-30T18:49:59.606Z","title":"WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.0036,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118081","published":"2026-10-29T15:24:38.804Z","updated":"2026-10-29T19:43:59.116Z","title":"WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"10Web Social Photo Feed","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118080","published":"2026-10-29T15:24:38.055Z","updated":"2026-10-29T17:15:13.611Z","title":"WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Social Snap","product":"Social Snap","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118079","published":"2026-10-29T15:24:37.276Z","updated":"2026-11-03T16:48:08.846Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118078","published":"2026-10-29T15:24:36.520Z","updated":"2026-10-30T18:49:59.967Z","title":"WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PixelYourSite","product":"Product Catalog Feed by PixelYourSite","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118077","published":"2026-10-29T15:24:35.763Z","updated":"2026-10-30T18:50:00.172Z","title":"WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Fast Themes","product":"Sastra Essential Addons for Elementor","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118076","published":"2026-10-29T15:24:35.032Z","updated":"2026-10-29T19:44:58.856Z","title":"WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Frisbii","product":"Frisbii Pay","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118075","published":"2026-10-29T15:24:34.274Z","updated":"2026-10-29T17:15:20.028Z","title":"WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"dbarrere","product":"WP Media folders","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118074","published":"2026-10-29T15:24:33.509Z","updated":"2026-10-30T18:50:00.340Z","title":"WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Daman Jeet","product":"Finale Lite","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118073","published":"2026-10-29T15:24:32.755Z","updated":"2026-10-30T18:50:00.514Z","title":"WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00391,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116869","published":"2026-10-29T15:24:32.010Z","updated":"2026-10-30T18:50:00.662Z","title":"WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"myPOS Payments","product":"myPOS Checkout","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116868","published":"2026-10-29T15:24:31.253Z","updated":"2026-10-29T19:45:42.553Z","title":"WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyDev","product":"BuddyPress Xprofile Custom Field Types","kev":false,"epss":0.00446,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116867","published":"2026-10-29T15:24:30.502Z","updated":"2026-10-29T17:15:40.473Z","title":"WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"sosidee","product":"Dynamic QR Code &#8211; generator","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116866","published":"2026-10-29T15:24:29.747Z","updated":"2026-10-30T18:50:00.815Z","title":"WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Dotstore","product":"Extra Fees Plugin for WooCommerce","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116865","published":"2026-10-29T15:24:29.022Z","updated":"2026-10-30T18:50:00.961Z","title":"WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Gesundheit Bewegt GmbH","product":"Zippy","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116864","published":"2026-10-29T15:24:28.267Z","updated":"2026-10-30T18:50:01.124Z","title":"WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Arni Cinco","product":"WPCargo Track & Trace","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108494","published":"2026-10-29T15:24:27.520Z","updated":"2026-10-29T19:46:58.960Z","title":"WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Chained Quiz","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62131","published":"2026-10-29T15:24:26.750Z","updated":"2026-10-30T18:50:01.303Z","title":"WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Zoho Flow","product":"Zoho Flow","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62018","published":"2026-10-29T15:24:26.009Z","updated":"2026-10-29T19:48:00.882Z","title":"WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gunslinger","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62017","published":"2026-10-29T15:24:25.273Z","updated":"2026-10-29T17:16:01.751Z","title":"WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Good Homes","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62016","published":"2026-10-29T15:24:24.535Z","updated":"2026-10-30T18:50:01.447Z","title":"WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamic","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62015","published":"2026-10-29T15:24:23.807Z","updated":"2026-10-30T18:50:01.608Z","title":"WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamezone","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62014","published":"2026-10-29T15:24:23.059Z","updated":"2026-10-30T18:50:01.772Z","title":"WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"EmojiNation","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62013","published":"2026-10-29T15:24:22.290Z","updated":"2026-10-29T19:49:22.240Z","title":"WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Edge Decor","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62012","published":"2026-10-29T15:24:21.539Z","updated":"2026-10-29T17:16:19.063Z","title":"WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Coinpress","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62011","published":"2026-10-29T15:24:20.782Z","updated":"2026-10-30T18:50:01.917Z","title":"WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Bonbon","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62010","published":"2026-10-29T15:24:20.043Z","updated":"2026-10-30T18:50:02.069Z","title":"WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Avventure","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62009","published":"2026-10-29T15:24:19.287Z","updated":"2026-10-30T18:50:02.217Z","title":"WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Filmax","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62008","published":"2026-10-29T15:24:18.536Z","updated":"2026-10-29T19:43:02.462Z","title":"WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Orpheus","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62006","published":"2026-10-29T15:24:17.789Z","updated":"2026-10-29T17:16:25.167Z","title":"WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Nuts","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62005","published":"2026-10-29T15:24:17.046Z","updated":"2026-10-30T18:50:02.379Z","title":"WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Muzicon","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62004","published":"2026-10-29T15:24:16.292Z","updated":"2026-10-30T18:50:02.531Z","title":"WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Motorix","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62003","published":"2026-10-29T15:24:15.533Z","updated":"2026-10-30T18:50:02.679Z","title":"WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Mission","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62002","published":"2026-10-29T15:24:14.783Z","updated":"2026-10-29T19:42:29.362Z","title":"WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Meals & Wheels","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62001","published":"2026-10-29T15:24:14.045Z","updated":"2026-10-29T17:16:36.644Z","title":"WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Marcell","kev":false,"epss":0.00476,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61998","published":"2026-10-29T15:24:13.299Z","updated":"2026-10-30T18:50:02.827Z","title":"WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Le Truffe","kev":false,"epss":0.00476,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61997","published":"2026-10-29T15:24:12.567Z","updated":"2026-10-30T18:50:03.004Z","title":"WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Legal Stone","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61996","published":"2026-10-29T15:24:11.830Z","updated":"2026-10-30T18:39:14.014Z","title":"WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"favethemes","product":"MLS On The Fly","kev":false,"epss":0.00381,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61995","published":"2026-10-29T15:24:10.950Z","updated":"2026-10-29T19:41:43.590Z","title":"WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"emarket-design","product":"YouTube Showcase","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61993","published":"2026-10-29T15:24:10.200Z","updated":"2026-10-29T17:16:44.466Z","title":"WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"blockonomics","product":"Blockonomics","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61992","published":"2026-10-29T15:24:09.438Z","updated":"2026-10-30T18:50:03.183Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Von Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00386,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61991","published":"2026-10-29T15:24:08.677Z","updated":"2026-10-30T18:50:03.334Z","title":"WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Ajax Load More","product":"AjaxLoadMore Cache","kev":false,"epss":0.00748,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61989","published":"2026-10-29T15:24:07.932Z","updated":"2026-10-30T18:50:03.505Z","title":"WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Merv Barrett","product":"Easy Property Listings","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61988","published":"2026-10-29T15:24:07.189Z","updated":"2026-10-29T19:41:03.059Z","title":"WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"morehawes","product":"Auction Nudge – Your eBay on Your Site","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54866","published":"2026-10-29T15:24:06.443Z","updated":"2026-10-29T17:16:52.192Z","title":"WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Razorpay","product":"Razorpay Payment Button Elementor Plugin","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54865","published":"2026-10-29T15:24:05.681Z","updated":"2026-10-30T18:39:13.879Z","title":"WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Podamibe Nepal","product":"Podamibe Custom User Gravatar","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54864","published":"2026-10-29T15:24:04.940Z","updated":"2026-10-30T18:50:03.679Z","title":"WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"nicashmu","product":"Post Video Players","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54860","published":"2026-10-29T15:24:04.196Z","updated":"2026-10-30T18:50:03.835Z","title":"WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Ozisti","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54859","published":"2026-10-29T15:24:03.450Z","updated":"2026-10-29T19:40:30.116Z","title":"WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Preservation","kev":false,"epss":0.00526,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54858","published":"2026-10-29T15:24:02.681Z","updated":"2026-10-29T17:16:59.146Z","title":"WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Printy","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54857","published":"2026-10-29T15:24:01.923Z","updated":"2026-10-30T18:50:04.264Z","title":"WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Quirky","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54856","published":"2026-10-29T15:24:01.171Z","updated":"2026-10-30T18:50:04.441Z","title":"WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"RexCoin","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42701","published":"2026-10-29T15:24:00.414Z","updated":"2026-10-30T18:50:04.609Z","title":"WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YayCommerce","product":"YayMail","kev":false,"epss":0.0037,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42692","published":"2026-10-29T15:23:59.420Z","updated":"2026-10-29T19:39:42.399Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42690","published":"2026-10-29T15:23:58.663Z","updated":"2026-10-29T17:17:08.164Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27394","published":"2026-10-29T15:23:57.862Z","updated":"2026-10-30T18:50:04.772Z","title":"WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jyothis Joy","product":"Eventer","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118085","published":"2026-10-29T15:23:57.104Z","updated":"2026-10-30T18:50:05.160Z","title":"WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Global Payments","product":"GlobalPayments WooCommerce","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42694","published":"2026-10-29T15:05:18.749Z","updated":"2026-10-30T18:50:05.330Z","title":"WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48200","published":"2026-10-29T15:04:50.615Z","updated":"2026-10-29T17:18:26.068Z","title":"WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Barn2 Plugins","product":"Document Library Lite","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116848","published":"2026-10-29T15:04:29.001Z","updated":"2026-10-30T18:39:13.456Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH Innovations","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109891","published":"2026-10-29T15:04:03.409Z","updated":"2026-10-30T18:50:05.523Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25448","published":"2026-10-29T14:55:02.968Z","updated":"2026-10-29T19:34:34.063Z","title":"WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42691","published":"2026-10-29T14:40:48.838Z","updated":"2026-10-30T19:00:20.857Z","title":"WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00189,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54852","published":"2026-10-29T14:40:27.236Z","updated":"2026-10-30T19:00:20.999Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97073","published":"2026-10-29T14:39:40.470Z","updated":"2026-10-29T17:18:39.592Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118097","published":"2026-10-29T14:39:07.281Z","updated":"2026-10-29T19:34:06.345Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27062","published":"2026-10-29T14:38:48.633Z","updated":"2026-10-30T19:00:21.175Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00098,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54853","published":"2026-10-29T14:32:35.962Z","updated":"2026-10-29T17:19:05.990Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114706","published":"2026-10-29T14:32:29.513Z","updated":"2026-10-30T18:39:13.589Z","title":"WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27063","published":"2026-10-29T14:32:08.078Z","updated":"2026-10-30T18:50:05.686Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115601","published":"2026-10-29T14:31:58.839Z","updated":"2026-10-30T18:50:05.850Z","title":"WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Custom Price for WooCommerce","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115605","published":"2026-10-29T14:29:40.076Z","updated":"2026-10-29T16:49:18.631Z","title":"WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118095","published":"2026-10-29T14:29:27.704Z","updated":"2026-10-29T16:49:18.797Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54871","published":"2026-10-29T14:29:24.576Z","updated":"2026-10-29T16:49:18.942Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25450","published":"2026-10-29T14:29:14.280Z","updated":"2026-10-29T16:49:19.089Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116850","published":"2026-10-29T14:29:07.948Z","updated":"2026-10-29T16:49:19.233Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114181","published":"2026-10-29T14:28:58.705Z","updated":"2026-10-29T16:49:19.379Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118088","published":"2026-10-29T14:26:27.526Z","updated":"2026-10-29T16:49:19.530Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116849","published":"2026-10-29T14:26:08.716Z","updated":"2026-10-29T16:49:19.673Z","title":"WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110881","published":"2026-10-29T14:25:46.727Z","updated":"2026-10-29T16:49:19.816Z","title":"WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116856","published":"2026-10-29T14:24:43.173Z","updated":"2026-10-29T16:49:19.958Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39737","published":"2026-10-29T14:24:19.832Z","updated":"2026-10-29T17:19:30.379Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118091","published":"2026-10-29T14:23:51.139Z","updated":"2026-10-30T18:50:06.004Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116387","published":"2026-10-29T14:22:37.807Z","updated":"2026-10-30T18:50:06.170Z","title":"WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39742","published":"2026-10-29T14:20:45.598Z","updated":"2026-10-29T14:37:20.747Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115610","published":"2026-10-29T14:20:16.168Z","updated":"2026-10-30T18:39:13.737Z","title":"WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00139,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118092","published":"2026-10-29T14:17:28.380Z","updated":"2026-10-29T17:19:46.176Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116406","published":"2026-10-29T14:16:17.757Z","updated":"2026-10-29T16:49:20.101Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52708","published":"2026-10-29T14:15:19.164Z","updated":"2026-10-29T16:49:20.247Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116846","published":"2026-10-29T14:14:41.416Z","updated":"2026-10-29T16:49:20.397Z","title":"WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00302,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48884","published":"2026-10-29T14:13:18.988Z","updated":"2026-10-29T16:49:20.542Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00284,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39736","published":"2026-10-29T14:08:21.817Z","updated":"2026-10-29T16:49:21.267Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00305,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116402","published":"2026-10-29T14:05:58.547Z","updated":"2026-10-29T16:49:21.421Z","title":"WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48202","published":"2026-10-29T13:58:06.273Z","updated":"2026-10-29T16:49:21.568Z","title":"WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brave","product":"Brave","kev":false,"epss":0.00286,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39782","published":"2026-10-29T13:56:43.214Z","updated":"2026-10-29T16:49:21.714Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25467","published":"2026-10-29T13:55:28.476Z","updated":"2026-10-29T16:49:21.855Z","title":"WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116399","published":"2026-10-29T13:54:04.259Z","updated":"2026-10-29T16:49:21.999Z","title":"WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116857","published":"2026-10-29T13:53:39.647Z","updated":"2026-10-29T16:49:22.150Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54862","published":"2026-10-29T13:09:14.823Z","updated":"2026-10-29T13:47:35.097Z","title":"WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Codection","product":"Import and export users and customers","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42707","published":"2026-10-29T13:07:48.740Z","updated":"2026-10-29T13:47:35.256Z","title":"WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress Claim Listings","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48195","published":"2026-10-29T13:07:16.802Z","updated":"2026-10-29T13:47:35.412Z","title":"WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39741","published":"2026-10-29T13:06:11.953Z","updated":"2026-10-29T13:47:35.579Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48196","published":"2026-10-29T13:04:39.022Z","updated":"2026-10-29T13:47:35.754Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-22386","published":"2026-10-29T13:04:17.195Z","updated":"2026-10-29T13:47:35.898Z","title":"WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52709","published":"2026-10-29T13:03:56.761Z","updated":"2026-10-29T13:47:36.058Z","title":"WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-24533","published":"2026-10-29T13:02:13.252Z","updated":"2026-10-29T13:47:36.226Z","title":"WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42703","published":"2026-10-29T13:01:49.395Z","updated":"2026-10-29T13:47:36.384Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118087","published":"2026-10-29T13:01:05.153Z","updated":"2026-10-29T13:47:36.553Z","title":"WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118094","published":"2026-10-29T12:59:46.185Z","updated":"2026-10-29T13:47:36.720Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39735","published":"2026-10-29T12:58:57.438Z","updated":"2026-10-29T13:47:36.877Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-56056","published":"2026-10-29T12:58:32.218Z","updated":"2026-10-29T13:47:37.027Z","title":"WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"The Post Grid","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118093","published":"2026-10-29T12:58:10.017Z","updated":"2026-10-29T13:47:37.178Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"Product Feed Manager","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27401","published":"2026-10-29T11:28:05.240Z","updated":"2026-10-29T12:36:50.510Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115611","published":"2026-10-29T11:00:26.280Z","updated":"2026-10-29T12:36:51.406Z","title":"WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"TableOn","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115964","published":"2026-10-29T11:00:25.837Z","updated":"2026-10-29T12:36:51.554Z","title":"WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115962","published":"2026-10-29T11:00:25.822Z","updated":"2026-10-29T12:36:51.694Z","title":"WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115592","published":"2026-10-29T11:00:25.353Z","updated":"2026-10-29T12:36:51.841Z","title":"WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OceanWP","product":"OceanWP","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116409","published":"2026-10-29T11:00:25.348Z","updated":"2026-11-05T11:20:55.752Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112827","published":"2026-10-29T11:00:24.746Z","updated":"2026-10-29T12:36:52.128Z","title":"WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"HANDMADE – Dropshipping for Etsy and WooCommerce","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114193","published":"2026-10-29T11:00:24.744Z","updated":"2026-10-29T12:36:52.272Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115599","published":"2026-10-29T11:00:24.169Z","updated":"2026-10-29T12:36:52.417Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115965","published":"2026-10-29T11:00:24.136Z","updated":"2026-10-29T12:36:52.568Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115967","published":"2026-10-29T11:00:23.638Z","updated":"2026-10-29T12:36:52.709Z","title":"WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00354,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115963","published":"2026-10-29T11:00:23.604Z","updated":"2026-10-29T12:36:52.863Z","title":"WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115603","published":"2026-10-28T14:02:57.872Z","updated":"2026-10-29T13:47:37.343Z","title":"WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Advanced Ads GmbH","product":"Advanced Ads – Tracking","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115968","published":"2026-10-28T14:02:57.496Z","updated":"2026-10-28T16:07:03.811Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116390","published":"2026-10-28T14:02:57.098Z","updated":"2026-10-29T13:47:37.495Z","title":"WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"stepasyuk","product":"Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116389","published":"2026-10-28T14:02:56.685Z","updated":"2026-10-29T13:47:37.643Z","title":"WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"crossi72","product":"Phoenix Media Rename","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115590","published":"2026-10-28T14:02:56.306Z","updated":"2026-10-29T13:47:37.789Z","title":"WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116391","published":"2026-10-28T13:00:28.765Z","updated":"2026-10-29T13:47:37.936Z","title":"WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Logo Slider","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116392","published":"2026-10-28T13:00:28.367Z","updated":"2026-10-29T13:47:38.092Z","title":"WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116393","published":"2026-10-28T13:00:28.337Z","updated":"2026-10-28T16:07:23.809Z","title":"WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"iHomefinder, Inc.","product":"Optima Express","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116404","published":"2026-10-28T13:00:27.971Z","updated":"2026-10-29T13:47:38.245Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111850","published":"2026-10-28T13:00:27.940Z","updated":"2026-10-29T13:47:38.415Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115612","published":"2026-10-28T13:00:14.372Z","updated":"2026-10-28T16:07:30.579Z","title":"WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115591","published":"2026-10-28T13:00:13.962Z","updated":"2026-10-29T13:47:38.566Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115593","published":"2026-10-28T13:00:13.871Z","updated":"2026-10-29T13:47:38.730Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115596","published":"2026-10-28T13:00:13.283Z","updated":"2026-10-28T16:07:36.842Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111411","published":"2026-10-28T13:00:13.279Z","updated":"2026-11-05T17:19:11.678Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00342,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115607","published":"2026-10-28T13:00:12.493Z","updated":"2026-10-29T13:47:38.888Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115957","published":"2026-10-28T13:00:12.485Z","updated":"2026-10-30T20:05:31.800Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115606","published":"2026-10-28T13:00:11.719Z","updated":"2026-10-29T13:47:39.191Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115609","published":"2026-10-28T13:00:11.577Z","updated":"2026-10-29T13:47:39.348Z","title":"WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"GetPaid","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116855","published":"2026-10-28T11:17:47.505Z","updated":"2026-10-29T13:47:39.509Z","title":"WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116863","published":"2026-10-27T15:56:41.312Z","updated":"2026-10-29T13:47:39.657Z","title":"WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116408","published":"2026-10-26T17:29:38.120Z","updated":"2026-10-26T17:57:32.081Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111404","published":"2026-10-26T17:28:57.422Z","updated":"2026-10-26T17:57:32.283Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112839","published":"2026-10-26T17:28:17.277Z","updated":"2026-10-26T17:57:32.460Z","title":"WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"Customer Coupons for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115966","published":"2026-10-26T17:27:49.307Z","updated":"2026-10-26T17:57:32.653Z","title":"WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Typing Text – Give your texts many typing effects","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116400","published":"2026-10-26T17:27:17.642Z","updated":"2026-10-26T17:57:32.849Z","title":"WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116398","published":"2026-10-26T17:26:48.798Z","updated":"2026-10-26T17:57:33.053Z","title":"WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Content Slider Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116395","published":"2026-10-26T16:46:39.501Z","updated":"2026-10-26T17:37:09.389Z","title":"WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115598","published":"2026-10-26T16:45:11.621Z","updated":"2026-10-26T17:37:09.543Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114710","published":"2026-10-26T16:43:59.208Z","updated":"2026-10-26T17:37:09.711Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115597","published":"2026-10-26T16:43:22.281Z","updated":"2026-10-26T17:37:09.885Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116388","published":"2026-10-26T16:42:54.795Z","updated":"2026-10-26T17:37:10.026Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116396","published":"2026-10-26T16:39:18.840Z","updated":"2026-10-26T17:37:10.212Z","title":"WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116403","published":"2026-10-26T16:37:59.242Z","updated":"2026-10-26T17:37:10.367Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116394","published":"2026-10-26T16:00:08.893Z","updated":"2026-10-26T17:37:11.529Z","title":"WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114708","published":"2026-10-26T10:36:32.680Z","updated":"2026-10-26T12:54:32.687Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115595","published":"2026-10-26T10:36:08.187Z","updated":"2026-10-26T12:54:32.838Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115959","published":"2026-10-26T10:35:45.823Z","updated":"2026-10-26T12:54:32.987Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115960","published":"2026-10-26T10:35:23.855Z","updated":"2026-10-26T12:54:33.130Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115955","published":"2026-10-26T10:35:04.514Z","updated":"2026-10-26T12:54:33.290Z","title":"WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Advanced Post Block - Post Grid for WordPress block editor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115956","published":"2026-10-26T10:34:34.613Z","updated":"2026-10-26T12:54:33.447Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115961","published":"2026-10-26T10:34:10.476Z","updated":"2026-10-26T12:54:33.589Z","title":"WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114707","published":"2026-10-26T10:28:54.378Z","updated":"2026-10-26T12:54:33.861Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115594","published":"2026-10-26T10:28:26.944Z","updated":"2026-10-26T12:54:34.035Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115608","published":"2026-10-26T10:28:00.697Z","updated":"2026-10-26T12:54:34.228Z","title":"WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115953","published":"2026-10-26T10:27:38.261Z","updated":"2026-10-26T12:54:34.394Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115954","published":"2026-10-26T10:27:16.990Z","updated":"2026-10-26T12:54:34.575Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115950","published":"2026-10-26T10:26:54.044Z","updated":"2026-10-26T12:54:34.713Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115951","published":"2026-10-26T10:26:34.727Z","updated":"2026-10-26T12:54:34.854Z","title":"WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kevin Weber","product":"Lazy Load for Videos","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115948","published":"2026-10-26T10:08:37.779Z","updated":"2026-10-26T12:54:35.005Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114709","published":"2026-10-26T10:08:01.188Z","updated":"2026-10-26T10:23:40.064Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115949","published":"2026-10-26T10:07:24.926Z","updated":"2026-10-26T10:23:40.211Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115614","published":"2026-10-26T10:05:22.425Z","updated":"2026-10-26T10:23:40.370Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97255","published":"2026-10-26T10:03:47.707Z","updated":"2026-10-26T10:23:40.524Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97254","published":"2026-10-26T10:02:36.972Z","updated":"2026-10-26T10:23:40.688Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97295","published":"2026-10-26T10:01:28.037Z","updated":"2026-10-26T10:23:40.842Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00124,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112865","published":"2026-10-26T10:01:03.255Z","updated":"2026-10-26T10:23:41.001Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110377","published":"2026-10-26T09:59:47.003Z","updated":"2026-10-26T10:23:41.157Z","title":"WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Bopo – WooCommerce Product Bundle Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115602","published":"2026-10-26T09:59:24.845Z","updated":"2026-10-26T10:23:41.317Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115613","published":"2026-10-26T09:54:36.992Z","updated":"2026-10-26T10:13:37.674Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115958","published":"2026-10-26T09:54:20.583Z","updated":"2026-10-26T10:13:37.956Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110376","published":"2026-10-26T08:47:06.966Z","updated":"2026-10-26T10:13:38.243Z","title":"WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"DEPART","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111841","published":"2026-10-26T08:46:47.663Z","updated":"2026-10-26T10:13:38.533Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112828","published":"2026-10-26T08:45:37.443Z","updated":"2026-10-26T10:13:38.809Z","title":"WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114191","published":"2026-10-24T14:00:09.573Z","updated":"2026-10-24T14:46:58.028Z","title":"WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Knit Pay","product":"UPI QR Code Payment Gateway for WooCommerce","kev":false,"epss":0.00336,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114704","published":"2026-10-24T14:00:09.045Z","updated":"2026-10-24T14:46:58.175Z","title":"WordPress Relevanssi  plugin <= 4.28.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Christoph Vielgrader","product":"Relevanssi","kev":false,"epss":0.00413,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114192","published":"2026-10-24T14:00:09.029Z","updated":"2026-10-24T14:46:58.324Z","title":"WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114705","published":"2026-10-24T10:00:11.514Z","updated":"2026-10-24T14:46:58.465Z","title":"WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"quadlayers","product":"WP Social Feed Gallery","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114194","published":"2026-10-24T09:08:50.102Z","updated":"2026-10-24T14:46:56.574Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114196","published":"2026-10-24T08:00:13.761Z","updated":"2026-10-24T14:46:58.606Z","title":"WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"paytiumsupport","product":"Paytium","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114695","published":"2026-10-24T08:00:13.590Z","updated":"2026-10-24T14:46:56.713Z","title":"WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114694","published":"2026-10-24T08:00:13.325Z","updated":"2026-10-24T14:46:56.850Z","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114693","published":"2026-10-24T08:00:12.874Z","updated":"2026-10-27T15:06:40.501Z","title":"WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugins360 Labs","product":"All-in-One Video Gallery","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110892","published":"2026-10-24T08:00:12.427Z","updated":"2026-10-24T14:46:58.746Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00296,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114697","published":"2026-10-24T08:00:12.424Z","updated":"2026-10-24T14:46:57.138Z","title":"WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114178","published":"2026-10-24T08:00:11.922Z","updated":"2026-10-24T14:46:57.285Z","title":"WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bold Grid","product":"W3 Total Cache","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114190","published":"2026-10-24T08:00:11.901Z","updated":"2026-10-24T14:46:58.879Z","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","kev":false,"epss":0.00306,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112866","published":"2026-10-24T08:00:11.483Z","updated":"2026-10-24T14:46:59.015Z","title":"WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFactory","product":"Product Filter by WBW","kev":false,"epss":0.01164,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94075","published":"2026-10-24T08:00:11.463Z","updated":"2026-10-24T14:46:59.162Z","title":"WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112869","published":"2026-10-24T08:00:10.988Z","updated":"2026-10-24T14:46:57.432Z","title":"WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noah Hearle","product":"We’re Open!","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111402","published":"2026-10-24T08:00:10.963Z","updated":"2026-10-24T14:46:59.295Z","title":"WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00349,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112844","published":"2026-10-24T08:00:10.546Z","updated":"2026-10-24T14:46:57.569Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114179","published":"2026-10-24T08:00:10.535Z","updated":"2026-10-24T14:46:57.707Z","title":"WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112848","published":"2026-10-23T13:00:20.030Z","updated":"2026-10-24T14:46:59.432Z","title":"WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112849","published":"2026-10-23T13:00:19.660Z","updated":"2026-10-23T14:58:45.182Z","title":"WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112850","published":"2026-10-23T13:00:19.609Z","updated":"2026-10-24T14:46:59.580Z","title":"WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Your Dress","kev":false,"epss":0.00337,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112854","published":"2026-10-23T13:00:19.251Z","updated":"2026-10-24T14:46:59.714Z","title":"WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Holistic Center","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112847","published":"2026-10-23T13:00:19.203Z","updated":"2026-10-24T14:46:59.854Z","title":"WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ZenSoul","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112846","published":"2026-10-23T13:00:18.841Z","updated":"2026-10-24T14:47:00.039Z","title":"WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Save Life","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112851","published":"2026-10-23T13:00:18.778Z","updated":"2026-10-24T14:47:00.303Z","title":"WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"HotLock","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112852","published":"2026-10-23T13:00:18.393Z","updated":"2026-10-24T14:47:00.462Z","title":"WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX Group","product":"Helion","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112853","published":"2026-10-23T13:00:18.338Z","updated":"2026-10-23T14:59:06.317Z","title":"WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Hallelujah","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112856","published":"2026-10-23T13:00:17.961Z","updated":"2026-10-24T14:47:00.597Z","title":"WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Vagabonds","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112857","published":"2026-10-23T13:00:17.920Z","updated":"2026-10-23T14:59:12.653Z","title":"WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Reprizo","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112858","published":"2026-10-23T13:00:17.505Z","updated":"2026-10-24T14:47:00.738Z","title":"WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Rhodos","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112859","published":"2026-10-23T13:00:17.469Z","updated":"2026-10-24T14:47:00.875Z","title":"WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Little Birdies","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112855","published":"2026-10-23T13:00:16.938Z","updated":"2026-10-24T14:47:01.013Z","title":"WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Redy","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112863","published":"2026-10-23T13:00:16.927Z","updated":"2026-10-24T14:46:57.865Z","title":"WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hogash","product":"KALLYAS","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112860","published":"2026-10-23T08:00:11.265Z","updated":"2026-10-23T10:56:06.122Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112862","published":"2026-10-23T08:00:11.165Z","updated":"2026-10-23T10:56:06.266Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112835","published":"2026-10-23T08:00:10.892Z","updated":"2026-10-23T10:56:06.431Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112837","published":"2026-10-23T08:00:10.809Z","updated":"2026-10-23T10:56:06.582Z","title":"WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00305,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112359","published":"2026-10-23T08:00:10.686Z","updated":"2026-10-23T10:56:06.737Z","title":"WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Amauri.IO","product":"WPMobile.App","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112838","published":"2026-10-23T08:00:10.440Z","updated":"2026-10-23T10:56:06.894Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112821","published":"2026-10-23T08:00:10.353Z","updated":"2026-10-23T10:56:07.050Z","title":"WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Knit Pay","product":"Knit Pay","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112825","published":"2026-10-23T08:00:10.214Z","updated":"2026-10-23T10:56:07.212Z","title":"WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Car Rental Manager","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112832","published":"2026-10-22T11:00:11.107Z","updated":"2026-10-22T13:37:46.390Z","title":"WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.0044,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112842","published":"2026-10-22T11:00:10.742Z","updated":"2026-10-22T13:37:46.527Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112822","published":"2026-10-22T11:00:10.699Z","updated":"2026-10-22T13:37:46.663Z","title":"WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112313","published":"2026-10-22T10:00:12.776Z","updated":"2026-11-03T15:22:36.298Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112820","published":"2026-10-22T10:00:12.735Z","updated":"2026-10-22T10:56:12.421Z","title":"WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Academist Core","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114703","published":"2026-10-22T08:59:26.154Z","updated":"2026-10-22T10:56:12.576Z","title":"WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hupe13","product":"Extensions for Leaflet Map","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114702","published":"2026-10-22T08:58:42.642Z","updated":"2026-10-22T10:56:12.729Z","title":"WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"ND Shortcodes For Visual Composer","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114701","published":"2026-10-22T08:55:52.176Z","updated":"2026-10-22T10:56:12.880Z","title":"WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xootix","product":"Waitlist Woocommerce ( Back in stock notifier )","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114700","published":"2026-10-22T08:54:35.279Z","updated":"2026-10-22T10:56:13.056Z","title":"WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gloriafood","product":"Restaurant Menu – Food Ordering System – Table Reservation","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114699","published":"2026-10-22T08:53:03.761Z","updated":"2026-10-22T10:56:13.209Z","title":"WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"yoomoney","product":"ЮKassa для WooCommerce","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114195","published":"2026-10-22T08:48:20.446Z","updated":"2026-10-22T10:56:13.370Z","title":"WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"ShopMagic","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112218","published":"2026-10-22T08:47:02.409Z","updated":"2026-10-22T10:56:13.526Z","title":"WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114696","published":"2026-10-22T08:46:29.875Z","updated":"2026-10-29T18:51:12.133Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111842","published":"2026-10-22T08:46:02.025Z","updated":"2026-10-22T10:56:13.877Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112311","published":"2026-10-22T08:00:50.094Z","updated":"2026-10-22T10:56:14.032Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00345,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111851","published":"2026-10-22T08:00:50.041Z","updated":"2026-10-22T10:56:14.204Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.6,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00275,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112312","published":"2026-10-22T08:00:50.028Z","updated":"2026-10-30T14:37:49.722Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00336,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111830","published":"2026-10-22T08:00:49.652Z","updated":"2026-10-22T10:56:14.523Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112241","published":"2026-10-22T08:00:49.628Z","updated":"2026-10-22T10:56:14.683Z","title":"WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112242","published":"2026-10-22T08:00:49.604Z","updated":"2026-10-25T22:47:02.391Z","title":"WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112845","published":"2026-10-22T07:33:45.372Z","updated":"2026-10-22T10:56:14.997Z","title":"WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jory Hogeveen","product":"Off-Canvas Sidebars & Menus (Slidebars)","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110893","published":"2026-10-22T07:33:26.080Z","updated":"2026-10-22T10:56:15.240Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110894","published":"2026-10-22T07:32:51.134Z","updated":"2026-10-22T10:56:15.454Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114698","published":"2026-10-22T07:31:39.662Z","updated":"2026-10-22T10:56:15.614Z","title":"WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00241,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112327","published":"2026-10-22T07:01:09.933Z","updated":"2026-10-22T10:56:15.759Z","title":"WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112379","published":"2026-10-22T07:01:09.851Z","updated":"2026-10-22T10:56:15.899Z","title":"WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Codepeople","product":"Contact Form Email","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114182","published":"2026-10-22T06:53:38.179Z","updated":"2026-10-22T10:56:16.049Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112843","published":"2026-10-22T06:53:13.511Z","updated":"2026-10-22T10:56:16.221Z","title":"WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112826","published":"2026-10-22T06:52:48.653Z","updated":"2026-10-22T10:56:16.397Z","title":"WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eLightUp","product":"Falcon – WordPress Optimizations & Tweaks","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114180","published":"2026-10-22T06:51:28.157Z","updated":"2026-10-22T10:56:16.552Z","title":"WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111847","published":"2026-10-22T06:50:48.346Z","updated":"2026-10-22T10:56:16.712Z","title":"WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Kings Plugins","product":"MarketKing","kev":false,"epss":0.00193,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114177","published":"2026-10-22T06:50:11.735Z","updated":"2026-10-22T10:56:16.853Z","title":"WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00181,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114175","published":"2026-10-22T06:48:49.336Z","updated":"2026-10-22T10:56:16.997Z","title":"WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112867","published":"2026-10-22T06:46:23.617Z","updated":"2026-10-22T10:56:17.135Z","title":"WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"H5P","product":"H5P","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114184","published":"2026-10-22T06:45:47.353Z","updated":"2026-10-22T10:56:17.294Z","title":"WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111401","published":"2026-10-21T18:02:35.731Z","updated":"2026-10-22T10:56:17.445Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112868","published":"2026-10-21T18:01:00.900Z","updated":"2026-10-22T10:56:17.592Z","title":"WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"H5P","product":"H5P","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114176","published":"2026-10-21T18:00:12.725Z","updated":"2026-10-22T10:56:17.723Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111832","published":"2026-10-21T14:00:13.392Z","updated":"2026-10-21T17:19:12.429Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111834","published":"2026-10-21T14:00:13.142Z","updated":"2026-10-21T17:19:12.599Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111835","published":"2026-10-21T14:00:13.041Z","updated":"2026-10-21T15:47:50.932Z","title":"WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bjorntech","product":"BjornTech Swish for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111848","published":"2026-10-21T14:00:12.950Z","updated":"2026-10-21T15:47:58.712Z","title":"WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112221","published":"2026-10-21T14:00:12.692Z","updated":"2026-10-21T17:19:12.758Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111833","published":"2026-10-21T14:00:12.587Z","updated":"2026-10-21T17:19:12.931Z","title":"WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Bold Grid","product":"weForms","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111837","published":"2026-10-21T14:00:12.511Z","updated":"2026-10-21T17:19:13.111Z","title":"WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111838","published":"2026-10-21T14:00:12.248Z","updated":"2026-10-21T17:19:13.275Z","title":"WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"ThemeHunk Customizer","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111840","published":"2026-10-21T14:00:12.136Z","updated":"2026-10-21T17:19:13.467Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111852","published":"2026-10-21T14:00:12.051Z","updated":"2026-10-21T17:19:13.637Z","title":"WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111849","published":"2026-10-21T13:00:12.562Z","updated":"2026-10-21T13:13:28.148Z","title":"WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110369","published":"2026-10-21T09:10:25.410Z","updated":"2026-10-21T10:35:06.745Z","title":"WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"WordPress Team Members – GS Plugins","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110370","published":"2026-10-21T09:10:25.368Z","updated":"2026-10-21T10:35:06.886Z","title":"WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Pins for Pinterest","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110884","published":"2026-10-21T09:10:25.275Z","updated":"2026-10-21T10:35:07.177Z","title":"WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"geekontheroad","product":"Live Summary for Gravity Forms","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110899","published":"2026-10-21T08:00:20.542Z","updated":"2026-10-30T20:01:11.038Z","title":"WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107435","published":"2026-10-21T08:00:15.941Z","updated":"2026-10-21T10:35:07.464Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112861","published":"2026-10-20T17:47:26.055Z","updated":"2026-10-21T10:35:07.995Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112823","published":"2026-10-20T15:14:13.192Z","updated":"2026-10-21T10:35:08.137Z","title":"WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112824","published":"2026-10-20T15:13:47.804Z","updated":"2026-10-20T16:16:17.587Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111843","published":"2026-10-20T15:12:05.376Z","updated":"2026-10-21T10:35:08.438Z","title":"WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112829","published":"2026-10-20T15:11:43.228Z","updated":"2026-10-21T10:35:08.582Z","title":"WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112840","published":"2026-10-20T15:10:54.998Z","updated":"2026-10-21T10:35:08.866Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112836","published":"2026-10-20T15:10:13.770Z","updated":"2026-10-20T16:44:17.508Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109700","published":"2026-10-20T15:06:51.007Z","updated":"2026-10-20T17:21:58.344Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.00315,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112834","published":"2026-10-20T14:53:47.737Z","updated":"2026-10-21T10:28:09.573Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112833","published":"2026-10-20T14:53:14.184Z","updated":"2026-10-20T15:14:09.857Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111844","published":"2026-10-20T09:47:10.054Z","updated":"2026-10-20T16:07:12.280Z","title":"WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brizy","product":"Brizy","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111828","published":"2026-10-19T13:29:02.276Z","updated":"2026-10-19T18:13:06.617Z","title":"WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112222","published":"2026-10-19T13:28:19.208Z","updated":"2026-10-19T14:59:04.484Z","title":"WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Surfer","product":"Surfer","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111829","published":"2026-10-19T13:27:57.467Z","updated":"2026-10-19T18:14:19.288Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110902","published":"2026-10-19T13:27:05.415Z","updated":"2026-10-19T14:26:14.786Z","title":"WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111845","published":"2026-10-19T12:38:16.661Z","updated":"2026-10-19T16:45:42.720Z","title":"WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Bundles","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111831","published":"2026-10-19T12:24:22.785Z","updated":"2026-10-19T14:28:05.700Z","title":"WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110363","published":"2026-10-19T12:21:58.494Z","updated":"2026-10-19T18:15:27.691Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111836","published":"2026-10-19T12:21:27.605Z","updated":"2026-10-19T18:19:12.683Z","title":"WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentCommunity","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111414","published":"2026-10-19T12:20:08.655Z","updated":"2026-10-19T18:23:08.474Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111410","published":"2026-10-19T12:16:12.230Z","updated":"2026-10-19T14:28:31.696Z","title":"WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"E2Pdf.com","product":"e2pdf","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111839","published":"2026-10-19T12:13:50.340Z","updated":"2026-10-19T18:25:34.806Z","title":"WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112199","published":"2026-10-19T12:06:43.446Z","updated":"2026-10-19T18:26:29.775Z","title":"WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110887","published":"2026-10-19T09:09:19.849Z","updated":"2026-10-19T16:51:04.682Z","title":"WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111398","published":"2026-10-19T09:09:19.440Z","updated":"2026-10-19T17:17:11.133Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00327,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110898","published":"2026-10-19T09:09:19.416Z","updated":"2026-10-19T16:50:35.254Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.4,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111407","published":"2026-10-19T09:09:19.001Z","updated":"2026-10-19T12:49:03.673Z","title":"WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111408","published":"2026-10-19T09:09:18.970Z","updated":"2026-10-19T17:17:55.950Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110379","published":"2026-10-19T09:09:18.538Z","updated":"2026-10-19T12:49:30.765Z","title":"WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111406","published":"2026-10-19T09:09:18.419Z","updated":"2026-10-19T16:54:29.679Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110895","published":"2026-10-18T11:00:30.914Z","updated":"2026-10-18T11:42:55.685Z","title":"WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"DevItems","product":"Support Genix","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107436","published":"2026-10-18T11:00:30.528Z","updated":"2026-10-19T18:44:42.166Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110373","published":"2026-10-18T11:00:30.495Z","updated":"2026-10-19T18:56:33.875Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110880","published":"2026-10-18T11:00:30.027Z","updated":"2026-10-19T18:57:25.484Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110886","published":"2026-10-18T11:00:30.021Z","updated":"2026-10-19T15:53:23.555Z","title":"WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109895","published":"2026-10-18T11:00:29.573Z","updated":"2026-10-18T11:42:55.835Z","title":"WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109894","published":"2026-10-18T11:00:29.562Z","updated":"2026-10-19T15:51:39.092Z","title":"WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110883","published":"2026-10-18T11:00:29.126Z","updated":"2026-10-19T19:00:19.026Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":0.00301,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110383","published":"2026-10-18T11:00:29.114Z","updated":"2026-10-18T11:42:55.982Z","title":"WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"WP E-Signature","product":"Electronic Signature Add-on for Fluent Forms","kev":false,"epss":0.00295,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110897","published":"2026-10-18T11:00:28.706Z","updated":"2026-10-19T15:48:00.679Z","title":"WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IdeaBox Creations","product":"PowerPack Lite for Beaver Builder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110372","published":"2026-10-18T11:00:28.694Z","updated":"2026-10-19T19:01:11.342Z","title":"WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.01365,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110382","published":"2026-10-18T11:00:28.191Z","updated":"2026-10-19T15:45:31.217Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108485","published":"2026-10-18T11:00:28.148Z","updated":"2026-10-19T15:42:56.281Z","title":"WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"eStore","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110885","published":"2026-10-18T11:00:22.694Z","updated":"2026-10-19T19:03:21.300Z","title":"WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00333,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110365","published":"2026-10-18T11:00:22.685Z","updated":"2026-10-19T19:03:53.371Z","title":"WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPExperts","product":"Advanced File Manager","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110882","published":"2026-10-17T19:00:11.325Z","updated":"2026-10-18T11:22:45.458Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109701","published":"2026-10-17T17:00:45.175Z","updated":"2026-10-18T11:22:45.594Z","title":"WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PAYCOMET","product":"PAYCOMET for WooCommerce","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110889","published":"2026-10-17T11:00:12.190Z","updated":"2026-10-18T11:22:45.735Z","title":"WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Gantry","product":"Gantry 5 Framework","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110384","published":"2026-10-17T07:00:31.036Z","updated":"2026-10-18T11:22:46.019Z","title":"WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Fancy Comments WordPress","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111413","published":"2026-10-16T13:02:14.161Z","updated":"2026-10-16T13:32:40.971Z","title":"WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"aThemeArt","product":"aThemeArt Theme Helper","kev":false,"epss":0.00133,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110896","published":"2026-10-16T12:57:24.956Z","updated":"2026-10-16T14:01:22.556Z","title":"WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111400","published":"2026-10-16T12:55:17.830Z","updated":"2026-10-16T15:04:12.871Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111396","published":"2026-10-16T12:54:50.256Z","updated":"2026-10-16T13:44:30.141Z","title":"WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111409","published":"2026-10-16T12:52:57.180Z","updated":"2026-10-19T08:14:29.318Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110903","published":"2026-10-16T12:51:28.928Z","updated":"2026-10-16T14:39:00.735Z","title":"WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110900","published":"2026-10-16T12:51:01.259Z","updated":"2026-10-16T14:59:30.776Z","title":"WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110901","published":"2026-10-16T12:50:03.734Z","updated":"2026-10-16T14:59:30.929Z","title":"WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPMU DEV","product":"SmartCrawl","kev":false,"epss":0.0015,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110380","published":"2026-10-16T12:31:15.231Z","updated":"2026-10-16T14:59:31.070Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111405","published":"2026-10-16T12:30:54.361Z","updated":"2026-10-16T13:46:12.255Z","title":"WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111399","published":"2026-10-16T12:30:32.747Z","updated":"2026-10-16T14:59:31.212Z","title":"WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111397","published":"2026-10-16T12:29:35.561Z","updated":"2026-10-16T14:02:23.262Z","title":"WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94169","published":"2026-10-16T07:00:38.023Z","updated":"2026-10-16T18:38:00.753Z","title":"WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Theme-one","product":"The Grid","kev":false,"epss":0.04422,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94388","published":"2026-10-16T07:00:37.973Z","updated":"2026-10-16T15:09:36.628Z","title":"WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"halfdata","product":"Green Popups","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97296","published":"2026-10-16T07:00:37.595Z","updated":"2026-10-16T15:09:37.442Z","title":"WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Rocketgenius, Inc","product":"Gravity Forms","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96339","published":"2026-10-16T07:00:37.525Z","updated":"2026-10-16T10:36:08.361Z","title":"WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Houzez.co","product":"Houzez","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110366","published":"2026-10-16T06:54:11.866Z","updated":"2026-10-16T15:09:37.698Z","title":"WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110361","published":"2026-10-15T18:21:40.608Z","updated":"2026-10-15T20:17:18.211Z","title":"WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ClikIT","product":"Infinite Uploads","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110362","published":"2026-10-15T18:21:16.105Z","updated":"2026-10-16T15:09:41.704Z","title":"WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Planet studio","product":"PlanetStudio Payment Gateway","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109893","published":"2026-10-15T18:18:56.045Z","updated":"2026-10-16T17:12:08.141Z","title":"WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110374","published":"2026-10-15T18:18:13.194Z","updated":"2026-10-15T18:32:12.140Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108499","published":"2026-10-15T18:17:52.974Z","updated":"2026-10-15T20:19:57.344Z","title":"WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Knowledge Base","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110364","published":"2026-10-15T18:16:51.303Z","updated":"2026-10-15T20:39:16.095Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110375","published":"2026-10-15T18:16:25.737Z","updated":"2026-10-16T17:12:23.090Z","title":"WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109689","published":"2026-10-15T18:14:39.051Z","updated":"2026-10-15T18:33:26.965Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110360","published":"2026-10-15T18:12:23.561Z","updated":"2026-10-16T15:09:42.011Z","title":"WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109897","published":"2026-10-15T18:11:34.153Z","updated":"2026-10-15T19:59:26.898Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00209,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110378","published":"2026-10-15T18:07:26.117Z","updated":"2026-10-19T09:50:41.518Z","title":"WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP E-Signature","product":"Ninja Forms Signature Contract Add-On","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96449","published":"2026-10-15T18:06:37.312Z","updated":"2026-10-16T15:09:42.195Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"WP EasyPay","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106604","published":"2026-10-15T18:01:28.361Z","updated":"2026-10-16T14:39:06.911Z","title":"WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Compare","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103083","published":"2026-10-15T18:00:35.463Z","updated":"2026-10-15T19:59:10.889Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108175","published":"2026-10-15T17:48:26.005Z","updated":"2026-10-15T18:01:15.407Z","title":"WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110381","published":"2026-10-15T17:48:07.069Z","updated":"2026-10-16T17:12:29.676Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103350","published":"2026-10-15T17:47:33.578Z","updated":"2026-10-15T18:24:28.555Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110888","published":"2026-10-15T17:46:50.254Z","updated":"2026-10-16T17:12:38.772Z","title":"WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110891","published":"2026-10-15T17:46:27.380Z","updated":"2026-10-16T15:09:42.376Z","title":"WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WordLift Srl","product":"WordLift","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110890","published":"2026-10-15T17:45:58.863Z","updated":"2026-10-15T18:24:23.069Z","title":"WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110367","published":"2026-10-15T17:45:13.071Z","updated":"2026-10-15T18:24:51.313Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110371","published":"2026-10-15T17:43:50.465Z","updated":"2026-10-15T17:59:43.855Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105065","published":"2026-10-15T17:00:15.222Z","updated":"2026-10-16T14:39:07.063Z","title":"WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme.com","product":"XStore","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109686","published":"2026-10-15T13:00:24.207Z","updated":"2026-10-15T15:16:30.523Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109685","published":"2026-10-15T13:00:23.963Z","updated":"2026-10-16T14:39:07.227Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109892","published":"2026-10-15T13:00:23.774Z","updated":"2026-10-15T13:18:44.529Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102389","published":"2026-10-15T13:00:23.730Z","updated":"2026-10-15T16:41:33.903Z","title":"WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Broken Link Checker","kev":false,"epss":0.0021,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105882","published":"2026-10-15T13:00:23.484Z","updated":"2026-10-15T15:03:59.807Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109688","published":"2026-10-15T13:00:23.246Z","updated":"2026-10-15T14:36:49.884Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107416","published":"2026-10-15T13:00:23.199Z","updated":"2026-10-15T13:19:10.932Z","title":"WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109702","published":"2026-10-15T13:00:23.016Z","updated":"2026-10-15T15:04:14.692Z","title":"WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maxfoundry","product":"Social Share Buttons","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109698","published":"2026-10-15T12:09:05.215Z","updated":"2026-10-15T13:09:25.240Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109692","published":"2026-10-15T12:09:05.084Z","updated":"2026-10-15T13:14:03.798Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109693","published":"2026-10-15T12:09:04.952Z","updated":"2026-10-16T15:09:42.546Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109695","published":"2026-10-15T11:00:13.931Z","updated":"2026-10-15T15:04:25.338Z","title":"WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPManageNinja","product":"FluentCart","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109694","published":"2026-10-15T11:00:13.754Z","updated":"2026-10-15T14:37:51.972Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108491","published":"2026-10-15T11:00:13.399Z","updated":"2026-10-15T13:15:53.077Z","title":"WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108497","published":"2026-10-15T11:00:13.368Z","updated":"2026-10-16T15:09:42.704Z","title":"WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108498","published":"2026-10-15T11:00:13.206Z","updated":"2026-10-15T13:14:06.252Z","title":"WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bannersky","product":"BSK PDF Manager","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108480","published":"2026-10-14T18:09:35.829Z","updated":"2026-10-15T16:43:45.485Z","title":"WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Skydropx","product":"Skydropx","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108484","published":"2026-10-14T18:09:35.659Z","updated":"2026-10-15T16:43:45.622Z","title":"WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Best Payments Plugin for WP","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108483","published":"2026-10-14T18:09:35.358Z","updated":"2026-10-16T18:42:02.176Z","title":"WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hippooo","product":"Hippoo Mobile App for WooCommerce","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105066","published":"2026-10-14T18:09:35.203Z","updated":"2026-10-14T19:36:41.666Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SimplyRETS","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108151","published":"2026-10-14T18:09:34.882Z","updated":"2026-10-15T16:43:45.890Z","title":"WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103081","published":"2026-10-14T18:09:34.742Z","updated":"2026-10-15T16:43:46.026Z","title":"WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107870","published":"2026-10-14T14:00:14.386Z","updated":"2026-10-15T16:43:47.159Z","title":"WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107417","published":"2026-10-14T13:00:15.564Z","updated":"2026-10-15T16:43:47.561Z","title":"WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Muralidharan Ramasamy","product":"Push Notification for Post and BuddyPress","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107426","published":"2026-10-14T13:00:15.455Z","updated":"2026-10-14T17:35:50.918Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00258,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108291","published":"2026-10-14T12:08:28.433Z","updated":"2026-10-15T16:43:47.695Z","title":"WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"itthinx","product":"Affiliates","kev":false,"epss":0.00444,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107425","published":"2026-10-14T12:08:28.323Z","updated":"2026-10-15T16:43:47.872Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00262,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107867","published":"2026-10-14T12:08:28.020Z","updated":"2026-10-15T16:43:48.028Z","title":"WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetProductTables","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107421","published":"2026-10-14T12:08:27.906Z","updated":"2026-10-15T16:43:48.193Z","title":"WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107424","published":"2026-10-14T12:08:27.612Z","updated":"2026-10-14T14:01:21.121Z","title":"WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"M A Vinoth Kumar","product":"Frontend Dashboard","kev":false,"epss":0.0038,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107422","published":"2026-10-14T12:08:27.530Z","updated":"2026-10-15T15:08:38.427Z","title":"WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"axew3.com","product":"WP w3all phpBB","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105874","published":"2026-10-14T12:08:27.142Z","updated":"2026-10-15T16:43:48.332Z","title":"WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106599","published":"2026-10-14T12:08:27.048Z","updated":"2026-10-14T17:32:25.261Z","title":"WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97278","published":"2026-10-14T12:08:26.651Z","updated":"2026-10-14T14:00:58.678Z","title":"WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107433","published":"2026-10-14T12:08:26.612Z","updated":"2026-10-14T17:29:24.440Z","title":"WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"WP OAuth Server","kev":false,"epss":0.00269,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105067","published":"2026-10-14T11:00:11.690Z","updated":"2026-10-15T15:08:44.603Z","title":"WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Webnus","product":"Modern Events Calendar Lite","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103358","published":"2026-10-14T11:00:11.345Z","updated":"2026-10-15T16:43:48.459Z","title":"WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Email Template Customizer for WooCommerce","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107431","published":"2026-10-14T11:00:11.329Z","updated":"2026-10-14T14:07:43.610Z","title":"WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107428","published":"2026-10-14T08:00:25.216Z","updated":"2026-10-14T11:29:08.950Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110227","published":"2026-10-14T07:11:41.657Z","updated":"2026-10-15T16:43:49.599Z","title":"WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"10up","product":"Restricted Site Access","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109901","published":"2026-10-14T07:11:16.010Z","updated":"2026-10-14T15:56:23.123Z","title":"WordPress CP Multi View Event Calendar  plugin <= 1.4.41 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Codepeople","product":"CP Multi View Event Calendar","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109898","published":"2026-10-13T16:23:02.114Z","updated":"2026-10-15T16:43:51.594Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109896","published":"2026-10-13T16:22:06.720Z","updated":"2026-10-15T16:43:51.727Z","title":"WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Download Monitor integration for WooCommerce","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109890","published":"2026-10-13T16:21:41.444Z","updated":"2026-10-14T15:25:49.121Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109699","published":"2026-10-13T08:53:05.371Z","updated":"2026-10-13T12:07:52.426Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00165,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108487","published":"2026-10-13T08:51:33.492Z","updated":"2026-10-13T12:07:52.552Z","title":"WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hossni Mubarak","product":"Books Gallery","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106598","published":"2026-10-13T08:49:45.050Z","updated":"2026-10-13T12:07:52.660Z","title":"WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109687","published":"2026-10-13T08:49:07.664Z","updated":"2026-10-13T12:07:52.773Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105881","published":"2026-10-13T08:45:21.284Z","updated":"2026-10-13T12:07:52.911Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108179","published":"2026-10-13T08:44:24.127Z","updated":"2026-10-13T12:07:53.047Z","title":"WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PluginUs.Net","product":"WOLF","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108489","published":"2026-10-13T08:43:51.589Z","updated":"2026-10-13T12:07:53.195Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.002,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103076","published":"2026-10-13T08:43:07.734Z","updated":"2026-10-13T12:07:53.347Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00101,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108174","published":"2026-10-13T08:42:35.004Z","updated":"2026-10-13T12:07:53.461Z","title":"WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106597","published":"2026-10-13T08:42:04.867Z","updated":"2026-10-13T12:07:53.621Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109697","published":"2026-10-13T08:41:17.199Z","updated":"2026-10-30T20:04:49.375Z","title":"WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109691","published":"2026-10-13T08:39:18.284Z","updated":"2026-10-13T12:07:53.947Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108488","published":"2026-10-13T08:38:44.619Z","updated":"2026-10-13T12:07:54.071Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109696","published":"2026-10-13T08:36:20.364Z","updated":"2026-10-13T12:07:54.186Z","title":"WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":0.00144,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108490","published":"2026-10-13T08:35:52.144Z","updated":"2026-10-13T12:07:54.303Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109684","published":"2026-10-13T08:34:34.941Z","updated":"2026-10-13T12:07:54.433Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108496","published":"2026-10-13T08:33:20.679Z","updated":"2026-10-21T10:21:15.616Z","title":"WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108493","published":"2026-10-13T08:32:30.517Z","updated":"2026-10-13T12:07:54.689Z","title":"WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Karolína Vyskočilová","product":"Pay for Payment for WooCommerce","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108495","published":"2026-10-13T08:30:25.869Z","updated":"2026-10-13T12:07:54.820Z","title":"WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108492","published":"2026-10-13T08:29:26.631Z","updated":"2026-10-19T08:14:59.464Z","title":"WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fullworks Plugins","product":"Quick Paypal Payments","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109703","published":"2026-10-13T07:32:54.095Z","updated":"2026-10-13T12:07:55.100Z","title":"WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGraphQL","product":"WPGraphQL","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54867","published":"2026-10-13T05:51:18.751Z","updated":"2026-10-13T12:07:55.225Z","title":"WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Griden","product":"Responsive Slider","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54868","published":"2026-10-13T05:50:34.068Z","updated":"2026-10-13T12:07:55.346Z","title":"WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Simpler SEO","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54869","published":"2026-10-13T05:49:47.849Z","updated":"2026-10-13T12:07:55.494Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54870","published":"2026-10-13T05:48:07.438Z","updated":"2026-10-13T12:07:55.615Z","title":"WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpweaver","product":"Weaver Xtreme Theme Support","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61994","published":"2026-10-12T17:51:32.988Z","updated":"2026-10-12T22:53:59.531Z","title":"WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RocketGeek","product":"WP-Members","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42689","published":"2026-10-12T17:47:51.774Z","updated":"2026-10-12T22:53:59.670Z","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00151,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108479","published":"2026-10-12T17:34:29.483Z","updated":"2026-10-12T22:53:59.811Z","title":"WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00128,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108481","published":"2026-10-12T17:33:28.910Z","updated":"2026-10-12T22:53:59.945Z","title":"WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.4,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00116,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103080","published":"2026-10-12T17:32:51.719Z","updated":"2026-10-12T22:54:00.096Z","title":"WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108482","published":"2026-10-12T17:14:08.317Z","updated":"2026-10-12T22:54:00.236Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107862","published":"2026-10-12T17:13:40.320Z","updated":"2026-10-12T22:54:00.380Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108486","published":"2026-10-12T17:13:17.372Z","updated":"2026-10-12T22:54:00.527Z","title":"WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107418","published":"2026-10-12T17:12:33.445Z","updated":"2026-10-12T22:54:00.660Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108478","published":"2026-10-12T17:11:55.879Z","updated":"2026-10-12T22:54:00.791Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108475","published":"2026-10-12T17:09:53.457Z","updated":"2026-10-12T22:54:00.913Z","title":"WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108476","published":"2026-10-12T17:09:22.796Z","updated":"2026-10-12T22:54:01.038Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108477","published":"2026-10-12T16:32:19.815Z","updated":"2026-10-12T22:54:01.160Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107864","published":"2026-10-12T09:05:53.751Z","updated":"2026-10-12T11:40:33.566Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107865","published":"2026-10-12T09:03:11.930Z","updated":"2026-10-12T11:40:33.699Z","title":"WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetMenu","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107866","published":"2026-10-12T09:00:06.057Z","updated":"2026-10-12T11:40:33.826Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107423","published":"2026-10-12T08:26:10.250Z","updated":"2026-10-12T11:40:33.963Z","title":"WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107869","published":"2026-10-12T08:25:47.632Z","updated":"2026-10-12T11:40:34.088Z","title":"WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Flexible Subscriptions","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107863","published":"2026-10-12T08:24:45.942Z","updated":"2026-10-19T07:34:27.782Z","title":"WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Codection","product":"Products Restricted Users for WooCommerce","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108168","published":"2026-10-12T08:22:50.917Z","updated":"2026-10-12T11:40:34.371Z","title":"WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DLX Plugins","product":"Custom Query Blocks","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2023-25996","published":"2026-10-12T08:15:39.939Z","updated":"2026-10-12T11:40:34.485Z","title":"WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pluggabl LLC.","product":"Booster Elite for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107432","published":"2026-10-12T07:47:11.169Z","updated":"2026-10-12T11:40:34.601Z","title":"WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103356","published":"2026-10-12T07:45:51.286Z","updated":"2026-10-12T11:40:34.720Z","title":"WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VillaTheme","product":"TMDS","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107430","published":"2026-10-12T07:45:32.370Z","updated":"2026-10-12T11:40:34.840Z","title":"WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VideoWhisper.com","product":"VideoWhisper Site Manager for ChatGPT, Claude, Codex","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107429","published":"2026-10-12T07:44:56.102Z","updated":"2026-10-12T11:40:34.968Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107427","published":"2026-10-12T07:44:34.562Z","updated":"2026-10-12T11:40:35.088Z","title":"WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106605","published":"2026-10-12T07:44:09.895Z","updated":"2026-10-12T11:40:35.215Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103685","published":"2026-10-10T19:55:52.636Z","updated":"2026-10-11T12:13:33.093Z","title":"WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27350","published":"2026-10-10T19:44:36.929Z","updated":"2026-10-11T11:42:57.301Z","title":"WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Builderius.io","product":"Builderius","kev":false,"epss":0.00155,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66480","published":"2026-10-10T19:42:40.322Z","updated":"2026-10-11T11:40:27.998Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57742","published":"2026-10-10T19:40:34.607Z","updated":"2026-10-11T11:42:54.152Z","title":"WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX Group","product":"Kids Planet","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107434","published":"2026-10-10T19:36:24.555Z","updated":"2026-10-11T12:13:33.222Z","title":"WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.4,"vendor":"videowhisper","product":"MicroPayments","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107420","published":"2026-10-10T19:36:23.815Z","updated":"2026-10-11T12:13:33.358Z","title":"WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Narinder Singh","product":"Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway","kev":false,"epss":0.00124,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81797","published":"2026-10-10T19:36:20.181Z","updated":"2026-10-11T11:47:06.948Z","title":"WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78535","published":"2026-10-10T19:36:19.431Z","updated":"2026-10-11T11:53:08.903Z","title":"WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Photolia","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78534","published":"2026-10-10T19:36:18.684Z","updated":"2026-10-11T11:42:57.594Z","title":"WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Keen IT Solutions","product":"Educavo","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78533","published":"2026-10-10T19:36:17.936Z","updated":"2026-10-11T11:53:09.041Z","title":"WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Qwery","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78532","published":"2026-10-10T19:36:17.241Z","updated":"2026-10-11T11:42:57.727Z","title":"WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"LMS","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78531","published":"2026-10-10T19:36:16.484Z","updated":"2026-10-11T11:53:09.192Z","title":"WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Jacqueline","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78530","published":"2026-10-10T19:36:15.786Z","updated":"2026-10-11T12:13:33.478Z","title":"WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Chimpstudio","product":"FoodBakery","kev":false,"epss":0.00393,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78529","published":"2026-10-10T19:36:15.048Z","updated":"2026-10-11T11:53:09.311Z","title":"WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Alliance","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66569","published":"2026-10-10T19:36:14.295Z","updated":"2026-10-11T11:53:09.437Z","title":"WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Kicker","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66568","published":"2026-10-10T19:36:13.592Z","updated":"2026-10-11T11:53:09.567Z","title":"WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Original","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66567","published":"2026-10-10T19:36:12.850Z","updated":"2026-10-11T11:53:09.687Z","title":"WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Anesta","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66566","published":"2026-10-10T19:36:12.066Z","updated":"2026-10-11T11:53:06.480Z","title":"WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Ambient","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66565","published":"2026-10-10T19:36:11.322Z","updated":"2026-10-11T11:53:09.804Z","title":"WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"FC United","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66564","published":"2026-10-10T19:36:10.604Z","updated":"2026-10-11T11:53:09.938Z","title":"WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ShiftCV","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66563","published":"2026-10-10T19:36:09.853Z","updated":"2026-10-11T11:53:10.057Z","title":"WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Windsor","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66483","published":"2026-10-10T19:36:09.122Z","updated":"2026-10-11T11:53:10.197Z","title":"WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66482","published":"2026-10-10T19:36:08.416Z","updated":"2026-10-11T11:53:10.333Z","title":"WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Drone Media","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66481","published":"2026-10-10T19:36:07.665Z","updated":"2026-10-11T12:13:33.600Z","title":"WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Presto Player","product":"Presto Player Pro","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65459","published":"2026-10-10T19:36:06.909Z","updated":"2026-10-11T12:13:33.722Z","title":"WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62130","published":"2026-10-10T19:36:06.188Z","updated":"2026-10-11T12:13:33.844Z","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Amir Helzer","product":"WooCommerce Multilingual & Multicurrency","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62129","published":"2026-10-10T19:36:05.441Z","updated":"2026-10-11T12:13:33.961Z","title":"WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62125","published":"2026-10-10T19:36:04.679Z","updated":"2026-10-11T11:53:10.453Z","title":"WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Asia Garden","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62124","published":"2026-10-10T19:36:03.928Z","updated":"2026-10-11T11:53:10.566Z","title":"WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"N7 | Golf Club Sports & Events","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62123","published":"2026-10-10T19:36:03.180Z","updated":"2026-10-11T11:53:10.683Z","title":"WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Invetex","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62120","published":"2026-10-10T19:36:02.422Z","updated":"2026-10-11T11:53:10.812Z","title":"WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Law Office","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62118","published":"2026-10-10T19:36:01.668Z","updated":"2026-10-11T12:13:34.084Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62117","published":"2026-10-10T19:36:00.956Z","updated":"2026-10-11T12:03:19.855Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62116","published":"2026-10-10T19:35:59.761Z","updated":"2026-10-11T11:42:57.844Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62115","published":"2026-10-10T19:35:58.997Z","updated":"2026-10-11T11:53:06.600Z","title":"WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62100","published":"2026-10-10T19:35:58.260Z","updated":"2026-10-11T11:42:57.978Z","title":"WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62099","published":"2026-10-10T19:35:57.377Z","updated":"2026-10-11T11:53:06.723Z","title":"WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62098","published":"2026-10-10T19:35:56.621Z","updated":"2026-10-11T12:13:34.271Z","title":"WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00199,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62096","published":"2026-10-10T19:35:55.878Z","updated":"2026-10-11T11:53:06.836Z","title":"WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62095","published":"2026-10-10T19:35:55.124Z","updated":"2026-10-11T11:42:58.099Z","title":"WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62094","published":"2026-10-10T19:35:54.377Z","updated":"2026-10-11T11:53:06.957Z","title":"WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62093","published":"2026-10-10T19:35:53.628Z","updated":"2026-10-11T11:42:58.242Z","title":"WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62092","published":"2026-10-10T19:35:52.885Z","updated":"2026-10-11T11:53:07.072Z","title":"WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62091","published":"2026-10-10T19:35:52.151Z","updated":"2026-10-11T11:42:58.368Z","title":"WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62090","published":"2026-10-10T19:35:51.406Z","updated":"2026-10-11T11:53:10.946Z","title":"WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"WineShop","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62087","published":"2026-10-10T19:35:50.660Z","updated":"2026-10-11T11:53:11.062Z","title":"WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Equadio","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62086","published":"2026-10-10T19:35:49.927Z","updated":"2026-10-11T11:53:11.187Z","title":"WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Juno","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62082","published":"2026-10-10T19:35:49.222Z","updated":"2026-10-11T11:42:58.500Z","title":"WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"An-Themes","product":"Pin WP","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62077","published":"2026-10-10T19:35:48.485Z","updated":"2026-10-11T11:53:11.303Z","title":"WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Avala","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62076","published":"2026-10-10T19:35:47.777Z","updated":"2026-10-11T11:53:11.425Z","title":"WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"The4","product":"Kalles","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62075","published":"2026-10-10T19:35:47.010Z","updated":"2026-10-11T11:53:07.199Z","title":"WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mymoun","product":"Backhoe","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62074","published":"2026-10-10T19:35:46.304Z","updated":"2026-10-11T11:53:07.312Z","title":"WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Ozeum","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62070","published":"2026-10-10T19:35:45.567Z","updated":"2026-10-11T11:53:07.428Z","title":"WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CKThemes","product":"Flipmart","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62069","published":"2026-10-10T19:35:44.815Z","updated":"2026-10-11T11:53:07.538Z","title":"WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Fabius","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62068","published":"2026-10-10T19:35:44.070Z","updated":"2026-10-11T11:53:07.654Z","title":"WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Teoro","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62067","published":"2026-10-10T19:35:43.329Z","updated":"2026-10-11T11:53:07.770Z","title":"WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Kaven","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62066","published":"2026-10-10T19:35:42.575Z","updated":"2026-10-11T11:53:07.887Z","title":"WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Volos","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62065","published":"2026-10-10T19:35:41.822Z","updated":"2026-10-11T11:53:08.012Z","title":"WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Cardea","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62064","published":"2026-10-10T19:35:41.077Z","updated":"2026-10-11T11:42:58.736Z","title":"WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ambed","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62054","published":"2026-10-10T19:35:40.282Z","updated":"2026-10-11T11:53:11.542Z","title":"WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Yacht Rental","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62053","published":"2026-10-10T19:35:39.525Z","updated":"2026-10-11T11:53:11.661Z","title":"WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Wine House","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62052","published":"2026-10-10T19:35:38.667Z","updated":"2026-10-11T11:53:11.771Z","title":"WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Tipsy","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62051","published":"2026-10-10T19:35:37.951Z","updated":"2026-10-11T11:53:11.895Z","title":"WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Stargaze","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62050","published":"2026-10-10T19:35:37.198Z","updated":"2026-10-11T11:53:12.013Z","title":"WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Splendour","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62043","published":"2026-10-10T19:35:36.442Z","updated":"2026-10-11T12:03:21.565Z","title":"WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"sevenspark","product":"Contact Form 7 – Dynamic Text Extension","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62038","published":"2026-10-10T19:35:35.694Z","updated":"2026-10-11T12:13:34.392Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62037","published":"2026-10-10T19:35:34.938Z","updated":"2026-10-11T11:42:58.866Z","title":"WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Document Embedder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62035","published":"2026-10-10T19:35:34.192Z","updated":"2026-10-11T12:13:34.513Z","title":"WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"upcasted","product":"AWS S3 for WordPress Plugin – Upcasted","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62034","published":"2026-10-10T19:35:33.484Z","updated":"2026-10-11T11:42:59.001Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62033","published":"2026-10-10T19:35:32.726Z","updated":"2026-10-11T12:13:34.635Z","title":"WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00297,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62032","published":"2026-10-10T19:35:31.972Z","updated":"2026-11-07T07:22:25.682Z","title":"WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62031","published":"2026-10-10T19:35:31.204Z","updated":"2026-10-11T12:03:19.985Z","title":"WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62030","published":"2026-10-10T19:35:30.447Z","updated":"2026-10-11T11:42:57.453Z","title":"WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62027","published":"2026-10-10T19:35:29.582Z","updated":"2026-10-11T11:42:59.155Z","title":"WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Team Section Block","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62025","published":"2026-10-10T19:35:28.815Z","updated":"2026-10-11T12:13:34.756Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62024","published":"2026-10-10T19:35:28.051Z","updated":"2026-10-11T12:13:34.867Z","title":"WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"CodeBard","product":"CodeBard Help Desk","kev":false,"epss":0.00434,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62022","published":"2026-10-10T19:35:27.261Z","updated":"2026-10-11T12:13:34.985Z","title":"WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Select-Themes","product":"Tonda Membership","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62021","published":"2026-10-10T19:35:26.468Z","updated":"2026-10-11T12:13:35.107Z","title":"WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Angio","kev":false,"epss":0.00468,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62020","published":"2026-10-10T19:35:25.680Z","updated":"2026-10-11T11:53:08.144Z","title":"WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TouchUp","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48194","published":"2026-10-10T19:35:24.166Z","updated":"2026-10-11T11:53:08.274Z","title":"WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"DukaMarket","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48193","published":"2026-10-10T19:35:23.448Z","updated":"2026-10-11T11:53:08.402Z","title":"WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Uminex","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-45440","published":"2026-10-10T19:35:22.690Z","updated":"2026-10-11T12:03:20.105Z","title":"WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Smackcoders Inc.","product":"WP Ultimate CSV Importer","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42777","published":"2026-10-10T19:35:21.931Z","updated":"2026-10-11T11:53:08.533Z","title":"WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Aalto","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42724","published":"2026-10-10T19:35:21.169Z","updated":"2026-10-11T11:53:08.651Z","title":"WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42723","published":"2026-10-10T19:35:20.422Z","updated":"2026-10-11T11:53:12.158Z","title":"WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42722","published":"2026-10-10T19:35:19.708Z","updated":"2026-10-11T12:03:20.221Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42719","published":"2026-10-10T19:35:18.996Z","updated":"2026-10-11T12:13:35.224Z","title":"WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.0051,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42718","published":"2026-10-10T19:35:18.277Z","updated":"2026-10-11T11:53:12.284Z","title":"WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42717","published":"2026-10-10T19:35:17.515Z","updated":"2026-10-11T12:03:20.341Z","title":"WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42716","published":"2026-10-10T19:35:16.768Z","updated":"2026-10-11T11:53:12.414Z","title":"WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"payever","product":"Payever - WooCommerce Gateway","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42715","published":"2026-10-10T19:35:16.054Z","updated":"2026-10-11T11:42:59.293Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42712","published":"2026-10-10T19:35:15.340Z","updated":"2026-10-11T12:03:20.465Z","title":"WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"QODE","product":"Qode Tours","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42711","published":"2026-10-10T19:35:14.606Z","updated":"2026-10-11T11:42:59.426Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42709","published":"2026-10-10T19:35:13.809Z","updated":"2026-10-11T11:42:59.539Z","title":"WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Food Menu – Restaurant Menu & Online Ordering for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42706","published":"2026-10-10T19:35:13.010Z","updated":"2026-10-11T12:13:35.348Z","title":"WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"DK","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42705","published":"2026-10-10T19:35:12.244Z","updated":"2026-10-11T12:13:35.480Z","title":"WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"Grand News","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42704","published":"2026-10-10T19:35:11.485Z","updated":"2026-10-11T11:53:08.769Z","title":"WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Kids Care","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42702","published":"2026-10-10T19:35:10.741Z","updated":"2026-10-13T16:32:55.073Z","title":"WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42699","published":"2026-10-10T19:35:10.023Z","updated":"2026-10-11T11:42:59.770Z","title":"WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"FV Player 8","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42697","published":"2026-10-10T19:35:09.276Z","updated":"2026-10-13T06:13:04.166Z","title":"WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Inisev","product":"Social Share Icons & Social Share Buttons","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42696","published":"2026-10-10T19:35:08.522Z","updated":"2026-10-13T06:13:18.105Z","title":"WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42693","published":"2026-10-10T19:35:07.750Z","updated":"2026-10-29T12:08:20.728Z","title":"WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42633","published":"2026-10-10T19:35:07.003Z","updated":"2026-10-11T12:03:20.589Z","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Marcus","product":"Events Manager","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42632","published":"2026-10-10T19:35:06.270Z","updated":"2026-10-11T11:43:00.299Z","title":"WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Real Estate","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42631","published":"2026-10-10T19:35:05.518Z","updated":"2026-10-11T11:43:00.412Z","title":"WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Music","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42630","published":"2026-10-10T19:35:04.739Z","updated":"2026-10-11T12:03:21.321Z","title":"WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Plura","product":"Web Plura Backup &amp; Restore Manager","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42419","published":"2026-10-10T19:35:03.982Z","updated":"2026-10-11T12:03:21.445Z","title":"WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SwishFolio","product":"Swish Migrate and Backup","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40808","published":"2026-10-10T19:35:03.250Z","updated":"2026-10-11T12:13:35.708Z","title":"WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Automattic","product":"Jetpack VideoPress","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40805","published":"2026-10-10T19:35:02.525Z","updated":"2026-10-11T12:13:35.834Z","title":"WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PeepSo","product":"PeepSo","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40803","published":"2026-10-10T19:35:01.775Z","updated":"2026-10-11T11:43:00.531Z","title":"WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jotform","product":"Jotform &#8211; AI Chatbot","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40802","published":"2026-10-10T19:35:01.019Z","updated":"2026-11-06T07:17:26.310Z","title":"WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"pubjet","product":"Pubjet | پاب‌جت","kev":false,"epss":0.00292,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40801","published":"2026-10-10T19:35:00.257Z","updated":"2026-10-11T12:13:36.097Z","title":"WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Wordable","product":"Wordable","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40800","published":"2026-10-10T19:34:59.496Z","updated":"2026-10-11T12:03:20.711Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40777","published":"2026-10-10T19:34:58.723Z","updated":"2026-10-11T12:13:36.220Z","title":"WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Rashid","product":"WPSection","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39802","published":"2026-10-10T19:34:57.947Z","updated":"2026-10-11T12:13:36.342Z","title":"WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.1,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00448,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39801","published":"2026-10-10T19:34:57.214Z","updated":"2026-10-11T12:13:36.457Z","title":"WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39800","published":"2026-10-10T19:34:56.435Z","updated":"2026-10-11T11:43:00.654Z","title":"WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Anton Bond","product":"Additional Order Filters for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39799","published":"2026-10-10T19:34:55.718Z","updated":"2026-10-11T11:43:00.768Z","title":"WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Joomunited","product":"WP File Download","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94590","published":"2026-10-10T18:45:45.857Z","updated":"2026-10-11T12:13:36.569Z","title":"WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodePeople2","product":"Sell Downloads","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57806","published":"2026-10-10T18:44:38.221Z","updated":"2026-10-11T11:42:54.287Z","title":"WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"drfuri","product":"Martfury - WooCommerce Marketplace WordPress Theme","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106610","published":"2026-10-10T18:09:06.421Z","updated":"2026-10-11T12:13:36.684Z","title":"WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00399,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96341","published":"2026-10-10T18:09:06.215Z","updated":"2026-10-11T12:13:42.585Z","title":"WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.2,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00269,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105892","published":"2026-10-10T18:09:05.758Z","updated":"2026-10-11T12:13:42.710Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.0041,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105889","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:03:20.837Z","title":"WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104398","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:13:42.842Z","title":"WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"VillaTheme","product":"AFFI – Affiliate Marketing for WooCommerce","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103071","published":"2026-10-10T17:00:10.567Z","updated":"2026-10-11T12:13:36.805Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103357","published":"2026-10-10T17:00:10.501Z","updated":"2026-10-11T12:13:36.927Z","title":"WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.9,"vendor":"VillaTheme","product":"GIFT4U","kev":false,"epss":0.00262,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106608","published":"2026-10-10T17:00:10.174Z","updated":"2026-10-11T12:13:37.058Z","title":"WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106609","published":"2026-10-10T17:00:10.072Z","updated":"2026-10-11T12:13:37.201Z","title":"WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Impian","product":"Bayarcash WooCommerce","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94160","published":"2026-10-10T17:00:09.779Z","updated":"2026-10-11T11:42:54.432Z","title":"WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themeStek","product":"ThemeStek Extras for LabtechCO Theme","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62044","published":"2026-10-10T17:00:09.638Z","updated":"2026-10-11T12:13:37.319Z","title":"WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"Super Video Player","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66435","published":"2026-10-10T14:00:13.260Z","updated":"2026-10-11T12:13:37.438Z","title":"WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Devin Walker","product":"WP Rollback","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97264","published":"2026-10-10T14:00:13.151Z","updated":"2026-10-11T11:42:54.561Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97263","published":"2026-10-10T14:00:12.696Z","updated":"2026-10-11T11:42:54.692Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94676","published":"2026-10-10T14:00:12.587Z","updated":"2026-10-11T12:13:37.549Z","title":"WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Tainacan Community","product":"Tainacan","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105885","published":"2026-10-10T14:00:10.868Z","updated":"2026-10-11T12:13:38.290Z","title":"WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102388","published":"2026-10-10T14:00:10.087Z","updated":"2026-10-11T11:42:54.822Z","title":"WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93951","published":"2026-10-10T08:00:09.334Z","updated":"2026-10-11T11:42:54.945Z","title":"WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Zeinet","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62045","published":"2026-10-10T07:00:39.141Z","updated":"2026-10-11T12:13:38.417Z","title":"WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Booklovers","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62046","published":"2026-10-10T07:00:38.957Z","updated":"2026-10-11T12:13:38.529Z","title":"WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Gutentype","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93945","published":"2026-10-10T07:00:38.671Z","updated":"2026-10-11T12:13:42.978Z","title":"WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Balance","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93944","published":"2026-10-10T07:00:38.483Z","updated":"2026-10-11T12:13:43.101Z","title":"WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Camelia","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93943","published":"2026-10-10T07:00:38.253Z","updated":"2026-10-11T12:13:38.647Z","title":"WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Convex","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93942","published":"2026-10-10T07:00:38.027Z","updated":"2026-10-11T12:13:38.769Z","title":"WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Dwell","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93941","published":"2026-10-10T07:00:37.796Z","updated":"2026-10-11T12:13:38.936Z","title":"WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Edema","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93940","published":"2026-10-10T07:00:37.570Z","updated":"2026-10-11T12:13:39.061Z","title":"WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Greeny","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93938","published":"2026-10-10T07:00:37.342Z","updated":"2026-10-11T12:13:39.189Z","title":"WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hogwords","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93937","published":"2026-10-10T07:00:37.101Z","updated":"2026-10-11T12:13:39.314Z","title":"WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hygia","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93936","published":"2026-10-10T07:00:36.862Z","updated":"2026-10-11T12:13:39.432Z","title":"WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"IPharm","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93935","published":"2026-10-10T07:00:36.635Z","updated":"2026-10-11T12:13:39.559Z","title":"WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Let's Play","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93934","published":"2026-10-10T07:00:36.397Z","updated":"2026-10-11T12:13:39.683Z","title":"WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Partiso","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93933","published":"2026-10-10T07:00:35.938Z","updated":"2026-10-11T12:13:39.804Z","title":"WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Rosalinda","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93932","published":"2026-10-10T07:00:35.688Z","updated":"2026-10-11T12:13:39.922Z","title":"WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smart Casa","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93931","published":"2026-10-10T07:00:35.434Z","updated":"2026-10-11T12:13:40.048Z","title":"WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smash","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93930","published":"2026-10-10T07:00:35.196Z","updated":"2026-10-11T12:13:40.173Z","title":"WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Tantra","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93929","published":"2026-10-10T07:00:34.898Z","updated":"2026-10-11T12:13:40.386Z","title":"WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Travesia","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93927","published":"2026-10-10T07:00:34.675Z","updated":"2026-10-11T12:13:40.518Z","title":"WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Veto","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93950","published":"2026-10-10T07:00:34.389Z","updated":"2026-10-11T12:13:40.643Z","title":"WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93949","published":"2026-10-10T07:00:34.180Z","updated":"2026-10-11T12:13:40.757Z","title":"WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Omegathemes","product":"Grocery Shopping Store","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106606","published":"2026-10-10T07:00:33.921Z","updated":"2026-10-11T12:13:40.905Z","title":"WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YITH","product":"YITH WooCommerce Affiliates","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42695","published":"2026-10-09T16:51:45.133Z","updated":"2026-10-11T11:42:55.084Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94067","published":"2026-10-09T14:00:10.842Z","updated":"2026-10-09T20:00:14.448Z","title":"WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"The Voux","kev":false,"epss":0.00327,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94066","published":"2026-10-09T14:00:10.562Z","updated":"2026-10-09T17:30:30.300Z","title":"WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SpabRice","product":"Pond","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94063","published":"2026-10-09T14:00:10.469Z","updated":"2026-10-09T15:09:20.784Z","title":"WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94065","published":"2026-10-09T14:00:10.127Z","updated":"2026-10-11T12:13:41.024Z","title":"WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"ColorFolio","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94064","published":"2026-10-09T14:00:10.022Z","updated":"2026-10-11T12:13:41.160Z","title":"WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"Neo | Barber Shop WordPress Theme","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62026","published":"2026-10-09T13:15:27.207Z","updated":"2026-10-09T19:55:18.178Z","title":"WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MIGHTYminnow","product":"Dashboard Notes","kev":false,"epss":0.00089,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94062","published":"2026-10-09T13:00:16.921Z","updated":"2026-10-09T17:43:13.501Z","title":"WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.00334,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94061","published":"2026-10-09T13:00:16.730Z","updated":"2026-10-11T11:42:55.234Z","title":"WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"Whistle - Sports Club","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94060","published":"2026-10-09T13:00:16.560Z","updated":"2026-10-11T11:42:55.373Z","title":"WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Voldor","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94059","published":"2026-10-09T13:00:16.346Z","updated":"2026-10-09T15:09:41.245Z","title":"WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ogency","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94058","published":"2026-10-09T13:00:16.159Z","updated":"2026-10-09T19:56:25.807Z","title":"WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Treck","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62028","published":"2026-10-09T12:14:54.653Z","updated":"2026-10-11T12:13:41.276Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105883","published":"2026-10-09T12:08:39.172Z","updated":"2026-10-09T19:59:10.283Z","title":"WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Th Shop Mania","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106601","published":"2026-10-09T12:08:38.787Z","updated":"2026-10-09T15:09:49.660Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106602","published":"2026-10-09T12:08:38.768Z","updated":"2026-10-11T12:13:41.420Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104392","published":"2026-10-09T12:08:37.866Z","updated":"2026-10-09T20:01:16.901Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105870","published":"2026-10-09T12:08:37.726Z","updated":"2026-10-11T11:42:55.514Z","title":"WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Delight Star Inc.","product":"WP Associate Post R2","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105872","published":"2026-10-09T12:08:37.425Z","updated":"2026-10-11T12:13:41.572Z","title":"WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"mklacroix","product":"Product Configurator for WooCommerce","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105877","published":"2026-10-09T12:08:37.272Z","updated":"2026-10-09T17:33:02.391Z","title":"WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105318","published":"2026-10-09T12:08:37.036Z","updated":"2026-10-13T06:22:16.869Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Datasolution","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62029","published":"2026-10-09T12:04:39.782Z","updated":"2026-10-09T17:34:23.625Z","title":"WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62036","published":"2026-10-09T11:49:30.979Z","updated":"2026-10-11T11:40:37.609Z","title":"WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AREOI","product":"All Bootstrap Blocks","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39779","published":"2026-10-09T11:44:42.274Z","updated":"2026-10-09T15:10:10.428Z","title":"WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Asgaros","product":"Asgaros Forum","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62039","published":"2026-10-09T11:44:04.748Z","updated":"2026-10-11T11:42:55.643Z","title":"WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62040","published":"2026-10-09T11:42:11.802Z","updated":"2026-10-14T12:23:44.503Z","title":"WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DEV Institute","product":"Restrict User Access – Membership Plugin with Force","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62041","published":"2026-10-09T11:40:25.660Z","updated":"2026-11-05T07:54:34.890Z","title":"WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ashok Dudhat","product":"WP Event Manager","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62042","published":"2026-10-09T11:32:27.683Z","updated":"2026-10-09T19:57:53.346Z","title":"WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"unFocus Projects","product":"Scripts n Styles","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107419","published":"2026-10-09T11:17:43.577Z","updated":"2026-10-11T12:13:41.693Z","title":"WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Cool Plugins","product":"AI Translation for Polylang","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93947","published":"2026-10-09T10:00:36.351Z","updated":"2026-10-09T15:10:20.858Z","title":"WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shinetheme","product":"Traveler","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94158","published":"2026-10-09T10:00:36.253Z","updated":"2026-10-11T11:42:55.888Z","title":"WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bkninja","product":"Gloria Admin Panel","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94503","published":"2026-10-09T10:00:35.938Z","updated":"2026-10-12T06:17:40.182Z","title":"WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"PX-lab","product":"Zombify","kev":false,"epss":0.0035,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94161","published":"2026-10-09T10:00:35.885Z","updated":"2026-10-09T17:38:14.641Z","title":"WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94159","published":"2026-10-09T10:00:35.516Z","updated":"2026-10-11T11:42:56.008Z","title":"WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94167","published":"2026-10-09T10:00:35.453Z","updated":"2026-10-09T15:10:28.354Z","title":"WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Extend Themes","product":"Kubio AI Page Builder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96334","published":"2026-10-09T10:00:35.107Z","updated":"2026-10-11T12:13:41.820Z","title":"WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.6,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00149,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94170","published":"2026-10-09T10:00:35.060Z","updated":"2026-10-11T11:42:56.139Z","title":"WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Sassy Social Share","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94664","published":"2026-10-09T10:00:34.694Z","updated":"2026-10-09T20:05:07.048Z","title":"WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"add-ons.org","product":"PDF for Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96607","published":"2026-10-09T10:00:34.684Z","updated":"2026-10-09T17:39:12.169Z","title":"WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94666","published":"2026-10-09T10:00:34.337Z","updated":"2026-10-11T12:13:41.956Z","title":"WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"ZealousWeb","product":"Generate PDF using Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96332","published":"2026-10-09T10:00:34.303Z","updated":"2026-10-09T20:06:18.069Z","title":"WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"yalla ya!","product":"Simple Payment","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95589","published":"2026-10-09T10:00:33.945Z","updated":"2026-10-09T20:10:23.743Z","title":"WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Deposits and Partial Payments for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94668","published":"2026-10-09T10:00:33.924Z","updated":"2026-10-09T17:40:22.596Z","title":"WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94667","published":"2026-10-09T10:00:33.558Z","updated":"2026-10-11T11:42:56.267Z","title":"WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94665","published":"2026-10-09T10:00:33.513Z","updated":"2026-10-09T15:10:39.045Z","title":"WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94663","published":"2026-10-09T10:00:33.105Z","updated":"2026-10-09T17:41:11.576Z","title":"WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94661","published":"2026-10-09T10:00:33.072Z","updated":"2026-10-11T11:42:56.385Z","title":"WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94641","published":"2026-10-09T10:00:32.734Z","updated":"2026-10-11T11:42:56.522Z","title":"WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94632","published":"2026-10-09T10:00:32.671Z","updated":"2026-10-09T15:10:48.031Z","title":"WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"BlockStrap Page Builder - Bootstrap Blocks","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96809","published":"2026-10-09T10:00:32.302Z","updated":"2026-10-11T12:03:20.949Z","title":"WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"MultiNet Interactive AB","product":"EduAdmin Booking","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94415","published":"2026-10-09T10:00:32.301Z","updated":"2026-10-11T11:42:56.644Z","title":"WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Muffingroup","product":"Betheme","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94166","published":"2026-10-09T10:00:22.170Z","updated":"2026-10-09T20:11:22.652Z","title":"WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96761","published":"2026-10-09T10:00:22.064Z","updated":"2026-10-09T15:10:57.640Z","title":"WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96671","published":"2026-10-09T10:00:21.368Z","updated":"2026-10-09T20:12:12.139Z","title":"WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96331","published":"2026-10-09T10:00:21.324Z","updated":"2026-10-20T17:58:59.053Z","title":"WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpdreams","product":"Ajax Search Pro","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96330","published":"2026-10-09T10:00:20.965Z","updated":"2026-10-11T12:03:21.072Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96329","published":"2026-10-09T10:00:20.895Z","updated":"2026-10-11T12:03:21.202Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96328","published":"2026-10-09T10:00:20.599Z","updated":"2026-10-09T15:11:09.645Z","title":"WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"jegtheme","product":"JNews - Pay Writer","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95609","published":"2026-10-09T10:00:20.474Z","updated":"2026-10-11T11:42:56.776Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95599","published":"2026-10-09T10:00:20.145Z","updated":"2026-10-09T20:13:14.977Z","title":"WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95598","published":"2026-10-09T10:00:20.071Z","updated":"2026-10-09T17:43:35.650Z","title":"WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Search in Place","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95597","published":"2026-10-09T10:00:19.713Z","updated":"2026-10-11T12:13:42.073Z","title":"WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codemstory","product":"워드프레스 결제 심플페이","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95596","published":"2026-10-09T10:00:19.652Z","updated":"2026-10-11T11:42:56.912Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95591","published":"2026-10-09T10:00:19.352Z","updated":"2026-10-09T15:11:17.737Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94568","published":"2026-10-09T10:00:19.289Z","updated":"2026-10-09T20:18:08.028Z","title":"WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95607","published":"2026-10-09T10:00:18.459Z","updated":"2026-10-09T15:11:27.797Z","title":"WordPress WPLMS  theme <= 4.973 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96327","published":"2026-10-09T10:00:18.114Z","updated":"2026-10-09T20:19:06.443Z","title":"WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95608","published":"2026-10-09T10:00:18.049Z","updated":"2026-10-11T11:42:57.048Z","title":"WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"HUSKY","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95610","published":"2026-10-09T10:00:17.308Z","updated":"2026-10-27T13:20:09.827Z","title":"WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96461","published":"2026-10-09T10:00:17.179Z","updated":"2026-10-09T20:20:07.252Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96337","published":"2026-10-09T10:00:16.886Z","updated":"2026-10-09T17:44:38.003Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96518","published":"2026-10-09T10:00:16.773Z","updated":"2026-10-09T15:11:34.573Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96333","published":"2026-10-09T10:00:16.516Z","updated":"2026-10-09T15:11:44.568Z","title":"WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96553","published":"2026-10-09T10:00:16.406Z","updated":"2026-10-11T11:42:57.165Z","title":"WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Damian Góra","product":"FiboSearch","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96539","published":"2026-10-09T10:00:16.120Z","updated":"2026-10-11T12:13:42.212Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96336","published":"2026-10-09T10:00:15.190Z","updated":"2026-10-11T12:13:42.343Z","title":"WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62049","published":"2026-10-09T09:15:43.867Z","updated":"2026-10-09T20:21:08.550Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97075","published":"2026-10-09T08:00:19.896Z","updated":"2026-10-09T18:02:29.120Z","title":"WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00159,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97076","published":"2026-10-09T07:00:48.876Z","updated":"2026-10-11T12:13:42.465Z","title":"WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false}]}