{"items":[{"id":"CVE-2026-119498","published":"2026-11-07T11:59:49.573Z","updated":"2026-11-07T12:00:50.066Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121765","published":"2026-11-07T11:59:18.951Z","updated":"2026-11-07T11:59:18.951Z","title":"WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121571","published":"2026-11-07T10:43:00.672Z","updated":"2026-11-07T10:43:10.678Z","title":"WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Autopay dla WooCommerce","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119496","published":"2026-11-07T10:42:25.139Z","updated":"2026-11-07T10:43:24.665Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123470","published":"2026-11-07T10:41:57.797Z","updated":"2026-11-07T10:42:59.418Z","title":"WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119513","published":"2026-11-07T10:40:44.537Z","updated":"2026-11-07T10:41:45.346Z","title":"WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123468","published":"2026-11-07T10:40:25.729Z","updated":"2026-11-07T10:41:27.172Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120857","published":"2026-11-07T10:39:37.731Z","updated":"2026-11-07T10:40:37.937Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123148","published":"2026-11-07T10:38:47.933Z","updated":"2026-11-07T10:39:49.877Z","title":"WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"IvyForms","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120837","published":"2026-11-07T10:38:04.753Z","updated":"2026-11-07T10:39:06.076Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121724","published":"2026-11-07T10:33:47.544Z","updated":"2026-11-07T10:37:10.879Z","title":"WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebberZone","product":"Contextual Related Posts","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120364","published":"2026-11-07T10:32:12.907Z","updated":"2026-11-07T10:33:25.886Z","title":"WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Untapwp","product":"Vidplex","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119523","published":"2026-11-07T10:31:51.308Z","updated":"2026-11-07T10:32:52.460Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119525","published":"2026-11-07T10:26:38.378Z","updated":"2026-11-07T10:26:38.839Z","title":"WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Dropshipping XML for WooCommerce","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120365","published":"2026-11-07T10:26:11.841Z","updated":"2026-11-07T10:27:12.069Z","title":"WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119478","published":"2026-11-07T10:19:33.802Z","updated":"2026-11-07T10:20:34.398Z","title":"WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119508","published":"2026-11-07T10:19:12.514Z","updated":"2026-11-07T10:20:13.058Z","title":"WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119492","published":"2026-11-07T10:17:32.001Z","updated":"2026-11-07T10:18:32.766Z","title":"WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119501","published":"2026-11-07T10:16:34.151Z","updated":"2026-11-07T10:16:34.151Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121783","published":"2026-11-07T10:14:14.440Z","updated":"2026-11-07T10:14:14.917Z","title":"WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119490","published":"2026-11-07T10:13:30.275Z","updated":"2026-11-07T10:13:30.707Z","title":"WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Made with Fuel Ltd.","product":"Better Notifications for WP","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119486","published":"2026-11-07T10:12:15.663Z","updated":"2026-11-07T10:13:17.207Z","title":"WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119500","published":"2026-11-07T10:11:35.425Z","updated":"2026-11-07T10:11:35.846Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120840","published":"2026-11-07T10:11:13.974Z","updated":"2026-11-07T10:12:15.504Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120842","published":"2026-11-07T10:10:23.132Z","updated":"2026-11-07T10:10:23.132Z","title":"WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119520","published":"2026-11-07T10:08:56.559Z","updated":"2026-11-07T10:09:57.697Z","title":"WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119494","published":"2026-11-07T10:08:28.998Z","updated":"2026-11-07T10:09:29.820Z","title":"WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120850","published":"2026-11-07T10:07:25.343Z","updated":"2026-11-07T10:08:25.775Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119493","published":"2026-11-07T10:02:35.608Z","updated":"2026-11-07T10:03:35.865Z","title":"WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119507","published":"2026-11-07T09:32:03.635Z","updated":"2026-11-07T09:33:04.577Z","title":"WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"NotificationX","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119473","published":"2026-11-07T09:30:03.347Z","updated":"2026-11-07T09:31:03.312Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119465","published":"2026-11-07T09:28:22.807Z","updated":"2026-11-07T09:29:23.489Z","title":"WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121762","published":"2026-11-07T09:27:39.697Z","updated":"2026-11-07T09:28:41.532Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123464","published":"2026-11-07T09:15:20.726Z","updated":"2026-11-07T09:15:20.726Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119502","published":"2026-11-07T09:14:43.488Z","updated":"2026-11-07T09:15:45.822Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BdThemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-122668","published":"2026-11-07T09:14:18.820Z","updated":"2026-11-07T09:15:20.413Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120853","published":"2026-11-07T09:13:56.417Z","updated":"2026-11-07T09:13:56.712Z","title":"WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120852","published":"2026-11-07T09:13:00.557Z","updated":"2026-11-07T09:14:03.085Z","title":"WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123469","published":"2026-11-07T09:12:38.521Z","updated":"2026-11-07T09:13:41.132Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119491","published":"2026-11-07T09:12:13.459Z","updated":"2026-11-07T09:13:16.009Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-61990","published":"2026-11-07T09:11:48.682Z","updated":"2026-11-07T09:12:50.744Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119484","published":"2026-11-07T09:11:20.814Z","updated":"2026-11-07T09:12:22.699Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120847","published":"2026-11-07T09:10:16.635Z","updated":"2026-11-07T09:10:16.635Z","title":"WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119511","published":"2026-11-07T09:09:48.677Z","updated":"2026-11-07T09:10:49.894Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121766","published":"2026-11-07T09:09:21.425Z","updated":"2026-11-07T09:09:21.425Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123466","published":"2026-11-07T09:08:23.000Z","updated":"2026-11-07T09:09:22.318Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121768","published":"2026-11-07T09:05:00.105Z","updated":"2026-11-07T09:07:28.271Z","title":"WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Markus Wiesenhofer","product":"Contact Form 7 &#8211; Post Fields","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-52713","published":"2026-11-07T09:03:26.066Z","updated":"2026-11-07T09:04:32.430Z","title":"WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119467","published":"2026-11-07T09:02:27.952Z","updated":"2026-11-07T09:03:29.164Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-66669","published":"2026-11-07T09:01:51.291Z","updated":"2026-11-07T09:02:52.409Z","title":"WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Suplugins","product":"Superb Addons: Blocks, Patterns &amp; Theme Designer","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119510","published":"2026-11-07T09:00:25.855Z","updated":"2026-11-07T09:01:26.614Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121781","published":"2026-11-07T08:56:31.769Z","updated":"2026-11-07T08:56:47.910Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119489","published":"2026-11-07T08:55:48.421Z","updated":"2026-11-07T08:56:06.131Z","title":"WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bootstrapped Ventures","product":"WP Recipe Maker","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120849","published":"2026-11-07T08:53:25.327Z","updated":"2026-11-07T08:53:25.758Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120848","published":"2026-11-07T08:51:59.575Z","updated":"2026-11-07T08:52:59.838Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-124274","published":"2026-11-07T08:50:22.538Z","updated":"2026-11-07T08:50:22.538Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-122675","published":"2026-11-07T08:49:27.020Z","updated":"2026-11-07T08:49:42.713Z","title":"WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wpmet","product":"Wp Social","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121761","published":"2026-11-07T08:49:00.698Z","updated":"2026-11-07T08:49:01.176Z","title":"WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121767","published":"2026-11-07T08:48:16.421Z","updated":"2026-11-07T08:49:16.806Z","title":"WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weDocs","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121778","published":"2026-11-07T08:44:53.759Z","updated":"2026-11-07T08:45:54.122Z","title":"WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Lab","product":"WP-Lister Lite for Amazon","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121779","published":"2026-11-07T08:43:09.390Z","updated":"2026-11-07T08:44:10.531Z","title":"WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Subscription","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-39733","published":"2026-11-07T08:42:42.190Z","updated":"2026-11-07T08:43:43.055Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-27356","published":"2026-11-06T22:31:02.728Z","updated":"2026-11-07T08:42:07.462Z","title":"WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ibericode","product":"MC4WP","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120845","published":"2026-11-06T22:30:37.452Z","updated":"2026-11-06T22:30:37.910Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-123471","published":"2026-11-06T22:30:15.072Z","updated":"2026-11-06T22:31:16.143Z","title":"WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-120851","published":"2026-11-06T22:29:15.977Z","updated":"2026-11-06T22:29:16.435Z","title":"WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119519","published":"2026-11-06T22:28:51.886Z","updated":"2026-11-06T22:29:53.354Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-122670","published":"2026-11-06T22:28:26.764Z","updated":"2026-11-06T22:28:27.136Z","title":"WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-115431","published":"2026-11-06T13:00:09.664Z","updated":"2026-11-06T15:20:56.089Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-115952","published":"2026-11-06T13:00:09.134Z","updated":"2026-11-06T14:59:55.656Z","title":"WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-109883","published":"2026-11-06T12:09:26.993Z","updated":"2026-11-06T15:00:13.234Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-109884","published":"2026-11-06T12:09:26.933Z","updated":"2026-11-06T22:33:32.248Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-119516","published":"2026-11-06T08:00:31.536Z","updated":"2026-11-06T08:00:31.536Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-119472","published":"2026-11-06T08:00:31.526Z","updated":"2026-11-06T15:04:01.911Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-120844","published":"2026-11-06T08:00:31.435Z","updated":"2026-11-06T17:34:39.032Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-39744","published":"2026-11-06T08:00:31.106Z","updated":"2026-11-06T15:04:17.337Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-119488","published":"2026-11-06T08:00:31.083Z","updated":"2026-11-06T15:04:31.805Z","title":"WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-119499","published":"2026-11-06T08:00:30.965Z","updated":"2026-11-06T15:24:52.802Z","title":"WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-119468","published":"2026-11-04T12:08:34.695Z","updated":"2026-11-06T15:07:46.574Z","title":"WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noptin Newsletter Team","product":"Noptin","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-119481","published":"2026-11-04T12:08:34.250Z","updated":"2026-11-04T15:08:50.711Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-65555","published":"2026-11-04T12:08:34.246Z","updated":"2026-11-04T15:08:50.865Z","title":"WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-57666","published":"2026-11-04T08:00:17.428Z","updated":"2026-11-04T15:18:55.611Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-119366","published":"2026-11-04T08:00:17.394Z","updated":"2026-11-04T20:00:58.355Z","title":"WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62007","published":"2026-11-04T08:00:17.118Z","updated":"2026-11-04T15:18:55.748Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-54861","published":"2026-11-04T08:00:17.026Z","updated":"2026-11-04T15:18:55.889Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62126","published":"2026-11-04T08:00:16.984Z","updated":"2026-11-04T15:18:56.023Z","title":"WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-57775","published":"2026-11-04T08:00:16.575Z","updated":"2026-11-04T15:18:56.169Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-57639","published":"2026-11-04T08:00:16.567Z","updated":"2026-11-04T15:18:56.313Z","title":"WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Roland Murg","product":"WP Booking System","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-119477","published":"2026-11-04T08:00:16.109Z","updated":"2026-11-04T15:18:56.445Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-56065","published":"2026-11-04T08:00:16.083Z","updated":"2026-11-04T15:18:56.602Z","title":"WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Doofinder","product":"Doofinder for WooCommerce","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-54851","published":"2026-11-04T07:00:37.741Z","updated":"2026-11-04T15:18:56.736Z","title":"WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Awesomemotive","product":"Contact Form by WPForms","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-62000","published":"2026-11-04T07:00:37.663Z","updated":"2026-11-04T15:18:56.879Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-119509","published":"2026-11-03T17:03:46.228Z","updated":"2026-11-03T22:41:20.019Z","title":"WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eranfl","product":"ClickCease Click Fraud Protection","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-97072","published":"2026-11-03T17:02:23.919Z","updated":"2026-11-03T17:25:22.004Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-114187","published":"2026-11-03T17:01:22.719Z","updated":"2026-11-04T21:26:00.747Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-103077","published":"2026-11-03T17:00:11.724Z","updated":"2026-11-03T22:41:26.022Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-114185","published":"2026-11-03T16:59:35.394Z","updated":"2026-11-03T17:26:18.705Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-119485","published":"2026-11-03T16:57:33.723Z","updated":"2026-11-03T16:58:34.370Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-39777","published":"2026-11-03T16:55:05.128Z","updated":"2026-11-07T03:18:41.059Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-119487","published":"2026-11-03T16:52:54.932Z","updated":"2026-11-03T17:26:46.976Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-120843","published":"2026-11-03T16:51:22.083Z","updated":"2026-11-06T15:04:47.314Z","title":"WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Barn2 Plugins","product":"Posts Table with Search & Sort","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-114183","published":"2026-11-03T16:49:43.622Z","updated":"2026-11-07T03:17:31.396Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-116859","published":"2026-11-03T16:48:24.138Z","updated":"2026-11-03T22:41:32.139Z","title":"WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-116858","published":"2026-11-03T16:45:49.000Z","updated":"2026-11-04T21:26:55.574Z","title":"WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-39743","published":"2026-11-03T16:44:44.480Z","updated":"2026-11-04T21:27:55.181Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-120846","published":"2026-11-03T16:44:19.563Z","updated":"2026-11-07T03:16:56.112Z","title":"WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-119521","published":"2026-11-03T16:43:38.652Z","updated":"2026-11-06T15:05:02.807Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-119495","published":"2026-11-03T16:43:08.775Z","updated":"2026-11-03T17:19:37.063Z","title":"WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Better Search","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-66570","published":"2026-11-01T16:00:09.605Z","updated":"2026-11-01T17:37:10.026Z","title":"WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nickboss","product":"WordPress File Upload","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-119480","published":"2026-11-01T16:00:09.213Z","updated":"2026-11-01T17:37:19.222Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-62048","published":"2026-11-01T16:00:09.158Z","updated":"2026-11-01T17:37:28.623Z","title":"WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00342,"kevAdded":null}]}