{"items":[{"id":"CVE-2026-123472","published":"2026-11-07T17:26:44.830Z","updated":"2026-11-07T18:05:57.603Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119522","published":"2026-11-07T17:26:14.308Z","updated":"2026-11-07T18:19:02.043Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123461","published":"2026-11-07T17:24:12.806Z","updated":"2026-11-07T18:19:19.847Z","title":"WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120836","published":"2026-11-07T17:23:37.515Z","updated":"2026-11-07T18:21:27.916Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124258","published":"2026-11-07T17:22:23.738Z","updated":"2026-11-07T18:26:28.583Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123860","published":"2026-11-07T12:47:17.885Z","updated":"2026-11-07T12:48:18.246Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123861","published":"2026-11-07T12:43:53.043Z","updated":"2026-11-07T18:26:28.745Z","title":"WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CrocoBlock","product":"JetFormBuilder – Hierarchical Select","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120839","published":"2026-11-07T12:43:21.399Z","updated":"2026-11-07T18:26:28.923Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120841","published":"2026-11-07T12:42:33.813Z","updated":"2026-11-07T18:26:29.092Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121777","published":"2026-11-07T12:41:23.603Z","updated":"2026-11-07T12:42:24.109Z","title":"WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cool Plugins","product":"Cool Formkit Lite","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123467","published":"2026-11-07T12:40:37.332Z","updated":"2026-11-07T18:26:29.227Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122659","published":"2026-11-07T12:40:06.898Z","updated":"2026-11-07T18:26:29.365Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121579","published":"2026-11-07T12:39:43.632Z","updated":"2026-11-07T18:05:57.745Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121575","published":"2026-11-07T12:39:13.305Z","updated":"2026-11-07T18:26:29.496Z","title":"WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122660","published":"2026-11-07T12:38:48.962Z","updated":"2026-11-07T18:26:29.625Z","title":"WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123483","published":"2026-11-07T12:37:39.979Z","updated":"2026-11-07T12:38:02.079Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123183","published":"2026-11-07T12:36:14.140Z","updated":"2026-11-07T12:37:14.784Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123474","published":"2026-11-07T12:35:49.136Z","updated":"2026-11-07T18:26:29.756Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121775","published":"2026-11-07T12:34:57.797Z","updated":"2026-11-07T18:26:29.889Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123462","published":"2026-11-07T12:34:29.645Z","updated":"2026-11-07T18:26:30.034Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122669","published":"2026-11-07T12:33:16.603Z","updated":"2026-11-07T18:05:57.879Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122663","published":"2026-11-07T12:32:48.988Z","updated":"2026-11-07T18:26:30.226Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121784","published":"2026-11-07T12:32:21.394Z","updated":"2026-11-07T18:05:58.012Z","title":"WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpBookingly","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123477","published":"2026-11-07T12:31:41.803Z","updated":"2026-11-07T18:05:58.153Z","title":"WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119498","published":"2026-11-07T11:59:49.573Z","updated":"2026-11-07T18:26:30.510Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121765","published":"2026-11-07T11:59:18.951Z","updated":"2026-11-07T18:05:58.746Z","title":"WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121571","published":"2026-11-07T10:43:00.672Z","updated":"2026-11-07T18:26:31.299Z","title":"WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Autopay dla WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119496","published":"2026-11-07T10:42:25.139Z","updated":"2026-11-07T10:43:24.665Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123470","published":"2026-11-07T10:41:57.797Z","updated":"2026-11-07T10:42:59.418Z","title":"WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119513","published":"2026-11-07T10:40:44.537Z","updated":"2026-11-07T18:26:31.428Z","title":"WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123468","published":"2026-11-07T10:40:25.729Z","updated":"2026-11-07T18:26:31.557Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120857","published":"2026-11-07T10:39:37.731Z","updated":"2026-11-07T10:40:37.937Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123148","published":"2026-11-07T10:38:47.933Z","updated":"2026-11-07T18:26:31.691Z","title":"WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"IvyForms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120837","published":"2026-11-07T10:38:04.753Z","updated":"2026-11-07T18:26:31.838Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121724","published":"2026-11-07T10:33:47.544Z","updated":"2026-11-07T18:26:31.985Z","title":"WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebberZone","product":"Contextual Related Posts","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120364","published":"2026-11-07T10:32:12.907Z","updated":"2026-11-07T18:06:02.383Z","title":"WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Untapwp","product":"Vidplex","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119523","published":"2026-11-07T10:31:51.308Z","updated":"2026-11-07T18:26:32.121Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119525","published":"2026-11-07T10:26:38.378Z","updated":"2026-11-07T18:26:32.255Z","title":"WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Dropshipping XML for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120365","published":"2026-11-07T10:26:11.841Z","updated":"2026-11-07T18:06:02.538Z","title":"WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119478","published":"2026-11-07T10:19:33.802Z","updated":"2026-11-07T18:26:32.388Z","title":"WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119508","published":"2026-11-07T10:19:12.514Z","updated":"2026-11-07T18:26:32.553Z","title":"WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119492","published":"2026-11-07T10:17:32.001Z","updated":"2026-11-07T18:26:32.711Z","title":"WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119501","published":"2026-11-07T10:16:34.151Z","updated":"2026-11-07T18:06:02.691Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121783","published":"2026-11-07T10:14:14.440Z","updated":"2026-11-07T18:26:32.883Z","title":"WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119490","published":"2026-11-07T10:13:30.275Z","updated":"2026-11-07T10:13:30.707Z","title":"WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Made with Fuel Ltd.","product":"Better Notifications for WP","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119486","published":"2026-11-07T10:12:15.663Z","updated":"2026-11-07T18:36:38.624Z","title":"WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119500","published":"2026-11-07T10:11:35.425Z","updated":"2026-11-07T18:06:02.853Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120840","published":"2026-11-07T10:11:13.974Z","updated":"2026-11-07T18:36:38.765Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120842","published":"2026-11-07T10:10:23.132Z","updated":"2026-11-07T18:36:38.917Z","title":"WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119520","published":"2026-11-07T10:08:56.559Z","updated":"2026-11-07T18:06:03.012Z","title":"WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119494","published":"2026-11-07T10:08:28.998Z","updated":"2026-11-07T10:09:29.820Z","title":"WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120850","published":"2026-11-07T10:07:25.343Z","updated":"2026-11-07T18:06:03.316Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119493","published":"2026-11-07T10:02:35.608Z","updated":"2026-11-07T18:06:03.489Z","title":"WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119507","published":"2026-11-07T09:32:03.635Z","updated":"2026-11-07T09:33:04.577Z","title":"WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"NotificationX","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119473","published":"2026-11-07T09:30:03.347Z","updated":"2026-11-07T09:31:03.312Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119465","published":"2026-11-07T09:28:22.807Z","updated":"2026-11-07T18:36:39.059Z","title":"WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121762","published":"2026-11-07T09:27:39.697Z","updated":"2026-11-07T18:36:40.531Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123464","published":"2026-11-07T09:15:20.726Z","updated":"2026-11-07T18:06:04.148Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119502","published":"2026-11-07T09:14:43.488Z","updated":"2026-11-07T18:36:40.665Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BdThemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122668","published":"2026-11-07T09:14:18.820Z","updated":"2026-11-07T18:36:40.811Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120853","published":"2026-11-07T09:13:56.417Z","updated":"2026-11-07T18:36:40.944Z","title":"WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120852","published":"2026-11-07T09:13:00.557Z","updated":"2026-11-07T09:14:03.085Z","title":"WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123469","published":"2026-11-07T09:12:38.521Z","updated":"2026-11-07T09:13:41.132Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119491","published":"2026-11-07T09:12:13.459Z","updated":"2026-11-07T18:36:41.078Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61990","published":"2026-11-07T09:11:48.682Z","updated":"2026-11-07T09:12:50.744Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119484","published":"2026-11-07T09:11:20.814Z","updated":"2026-11-07T18:36:41.217Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.00121,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120847","published":"2026-11-07T09:10:16.635Z","updated":"2026-11-07T18:36:41.351Z","title":"WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119511","published":"2026-11-07T09:09:48.677Z","updated":"2026-11-07T18:36:41.487Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121766","published":"2026-11-07T09:09:21.425Z","updated":"2026-11-07T18:36:41.620Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123466","published":"2026-11-07T09:08:23.000Z","updated":"2026-11-07T18:36:41.763Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121768","published":"2026-11-07T09:05:00.105Z","updated":"2026-11-07T18:06:04.309Z","title":"WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Markus Wiesenhofer","product":"Contact Form 7 &#8211; Post Fields","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52713","published":"2026-11-07T09:03:26.066Z","updated":"2026-11-07T18:36:41.908Z","title":"WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119467","published":"2026-11-07T09:02:27.952Z","updated":"2026-11-07T18:36:42.044Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66669","published":"2026-11-07T09:01:51.291Z","updated":"2026-11-07T18:36:42.203Z","title":"WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Suplugins","product":"Superb Addons: Blocks, Patterns &amp; Theme Designer","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119510","published":"2026-11-07T09:00:25.855Z","updated":"2026-11-07T18:06:04.464Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121781","published":"2026-11-07T08:56:31.769Z","updated":"2026-11-07T18:36:42.341Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119489","published":"2026-11-07T08:55:48.421Z","updated":"2026-11-07T18:06:04.624Z","title":"WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bootstrapped Ventures","product":"WP Recipe Maker","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120849","published":"2026-11-07T08:53:25.327Z","updated":"2026-11-07T08:53:25.758Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120848","published":"2026-11-07T08:51:59.575Z","updated":"2026-11-07T18:06:04.788Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124274","published":"2026-11-07T08:50:22.538Z","updated":"2026-11-07T18:36:42.483Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122675","published":"2026-11-07T08:49:27.020Z","updated":"2026-11-07T18:36:42.623Z","title":"WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wpmet","product":"Wp Social","kev":false,"epss":0.00091,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121761","published":"2026-11-07T08:49:00.698Z","updated":"2026-11-07T08:49:01.176Z","title":"WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121767","published":"2026-11-07T08:48:16.421Z","updated":"2026-11-07T08:49:16.806Z","title":"WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weDocs","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121778","published":"2026-11-07T08:44:53.759Z","updated":"2026-11-07T18:36:42.759Z","title":"WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Lab","product":"WP-Lister Lite for Amazon","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121779","published":"2026-11-07T08:43:09.390Z","updated":"2026-11-07T18:36:42.901Z","title":"WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Subscription","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39733","published":"2026-11-07T08:42:42.190Z","updated":"2026-11-07T08:43:43.055Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27356","published":"2026-11-06T22:31:02.728Z","updated":"2026-11-07T08:42:07.462Z","title":"WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ibericode","product":"MC4WP","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120845","published":"2026-11-06T22:30:37.452Z","updated":"2026-11-07T18:06:10.465Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123471","published":"2026-11-06T22:30:15.072Z","updated":"2026-11-06T22:31:16.143Z","title":"WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120851","published":"2026-11-06T22:29:15.977Z","updated":"2026-11-07T18:36:43.319Z","title":"WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119519","published":"2026-11-06T22:28:51.886Z","updated":"2026-11-07T18:36:43.449Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122670","published":"2026-11-06T22:28:26.764Z","updated":"2026-11-07T18:36:43.583Z","title":"WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115431","published":"2026-11-06T13:00:09.664Z","updated":"2026-11-06T15:20:56.089Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115952","published":"2026-11-06T13:00:09.134Z","updated":"2026-11-06T14:59:55.656Z","title":"WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109883","published":"2026-11-06T12:09:26.993Z","updated":"2026-11-06T15:00:13.234Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109884","published":"2026-11-06T12:09:26.933Z","updated":"2026-11-06T22:33:32.248Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119516","published":"2026-11-06T08:00:31.536Z","updated":"2026-11-07T18:36:44.024Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00386,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119472","published":"2026-11-06T08:00:31.526Z","updated":"2026-11-06T15:04:01.911Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00161,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120844","published":"2026-11-06T08:00:31.435Z","updated":"2026-11-06T17:34:39.032Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00331,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39744","published":"2026-11-06T08:00:31.106Z","updated":"2026-11-06T15:04:17.337Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119488","published":"2026-11-06T08:00:31.083Z","updated":"2026-11-06T15:04:31.805Z","title":"WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119499","published":"2026-11-06T08:00:30.965Z","updated":"2026-11-06T15:24:52.802Z","title":"WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119468","published":"2026-11-04T12:08:34.695Z","updated":"2026-11-06T15:07:46.574Z","title":"WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noptin Newsletter Team","product":"Noptin","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119481","published":"2026-11-04T12:08:34.250Z","updated":"2026-11-04T15:08:50.711Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.0042,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65555","published":"2026-11-04T12:08:34.246Z","updated":"2026-11-04T15:08:50.865Z","title":"WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Uncanny Owl","product":"Uncanny Toolkit for LearnDash","kev":false,"epss":0.0042,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57666","published":"2026-11-04T08:00:17.428Z","updated":"2026-11-04T15:18:55.611Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119366","published":"2026-11-04T08:00:17.394Z","updated":"2026-11-04T20:00:58.355Z","title":"WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AdvancedCoding","product":"wpDiscuz","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62007","published":"2026-11-04T08:00:17.118Z","updated":"2026-11-04T15:18:55.748Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54861","published":"2026-11-04T08:00:17.026Z","updated":"2026-11-04T15:18:55.889Z","title":"WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62126","published":"2026-11-04T08:00:16.984Z","updated":"2026-11-04T15:18:56.023Z","title":"WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":0.00263,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57775","published":"2026-11-04T08:00:16.575Z","updated":"2026-11-04T15:18:56.169Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57639","published":"2026-11-04T08:00:16.567Z","updated":"2026-11-04T15:18:56.313Z","title":"WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Roland Murg","product":"WP Booking System","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119477","published":"2026-11-04T08:00:16.109Z","updated":"2026-11-04T15:18:56.445Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-56065","published":"2026-11-04T08:00:16.083Z","updated":"2026-11-04T15:18:56.602Z","title":"WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Doofinder","product":"Doofinder for WooCommerce","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54851","published":"2026-11-04T07:00:37.741Z","updated":"2026-11-04T15:18:56.736Z","title":"WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Awesomemotive","product":"Contact Form by WPForms","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62000","published":"2026-11-04T07:00:37.663Z","updated":"2026-11-04T15:18:56.879Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119509","published":"2026-11-03T17:03:46.228Z","updated":"2026-11-03T22:41:20.019Z","title":"WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eranfl","product":"ClickCease Click Fraud Protection","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97072","published":"2026-11-03T17:02:23.919Z","updated":"2026-11-03T17:25:22.004Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114187","published":"2026-11-03T17:01:22.719Z","updated":"2026-11-04T21:26:00.747Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103077","published":"2026-11-03T17:00:11.724Z","updated":"2026-11-03T22:41:26.022Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114185","published":"2026-11-03T16:59:35.394Z","updated":"2026-11-03T17:26:18.705Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119485","published":"2026-11-03T16:57:33.723Z","updated":"2026-11-03T16:58:34.370Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39777","published":"2026-11-03T16:55:05.128Z","updated":"2026-11-07T03:18:41.059Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119487","published":"2026-11-03T16:52:54.932Z","updated":"2026-11-03T17:26:46.976Z","title":"WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120843","published":"2026-11-03T16:51:22.083Z","updated":"2026-11-06T15:04:47.314Z","title":"WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Barn2 Plugins","product":"Posts Table with Search & Sort","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114183","published":"2026-11-03T16:49:43.622Z","updated":"2026-11-07T03:17:31.396Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116859","published":"2026-11-03T16:48:24.138Z","updated":"2026-11-03T22:41:32.139Z","title":"WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116858","published":"2026-11-03T16:45:49.000Z","updated":"2026-11-04T21:26:55.574Z","title":"WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39743","published":"2026-11-03T16:44:44.480Z","updated":"2026-11-04T21:27:55.181Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120846","published":"2026-11-03T16:44:19.563Z","updated":"2026-11-07T03:16:56.112Z","title":"WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Uncanny Owl","product":"Uncanny Automator","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119521","published":"2026-11-03T16:43:38.652Z","updated":"2026-11-06T15:05:02.807Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119495","published":"2026-11-03T16:43:08.775Z","updated":"2026-11-03T17:19:37.063Z","title":"WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Better Search","kev":false,"epss":0.00598,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66570","published":"2026-11-01T16:00:09.605Z","updated":"2026-11-01T17:37:10.026Z","title":"WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nickboss","product":"WordPress File Upload","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119480","published":"2026-11-01T16:00:09.213Z","updated":"2026-11-01T17:37:19.222Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62048","published":"2026-11-01T16:00:09.158Z","updated":"2026-11-01T17:37:28.623Z","title":"WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00342,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118090","published":"2026-10-30T18:30:57.420Z","updated":"2026-10-30T18:50:06.371Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00446,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118089","published":"2026-10-30T18:30:56.607Z","updated":"2026-10-30T18:50:06.521Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.0039,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118086","published":"2026-10-30T18:30:54.718Z","updated":"2026-10-30T22:15:49.368Z","title":"WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.0036,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116862","published":"2026-10-30T18:30:53.968Z","updated":"2026-10-30T18:50:06.680Z","title":"WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Acato","product":"WP REST Cache","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116861","published":"2026-10-30T18:30:53.202Z","updated":"2026-10-30T18:50:06.822Z","title":"WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"wpdesk","product":"Flexible Chat","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116854","published":"2026-10-30T18:30:52.464Z","updated":"2026-10-30T18:50:06.975Z","title":"WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116853","published":"2026-10-30T18:30:51.710Z","updated":"2026-10-30T18:50:07.134Z","title":"WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116852","published":"2026-10-30T18:30:50.961Z","updated":"2026-10-30T22:15:55.746Z","title":"WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Marketing Fire","product":"Widget Options","kev":false,"epss":0.00595,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116851","published":"2026-10-30T18:30:50.217Z","updated":"2026-10-30T18:50:07.289Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116847","published":"2026-10-30T18:30:49.476Z","updated":"2026-10-30T18:50:07.433Z","title":"WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116410","published":"2026-10-30T18:30:48.730Z","updated":"2026-10-30T18:50:07.593Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116405","published":"2026-10-30T18:30:47.976Z","updated":"2026-10-30T18:50:07.747Z","title":"WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116401","published":"2026-10-30T18:30:47.215Z","updated":"2026-10-30T22:16:02.694Z","title":"WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116386","published":"2026-10-30T18:30:46.458Z","updated":"2026-10-30T18:50:07.905Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00349,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115947","published":"2026-10-30T18:30:45.703Z","updated":"2026-10-30T18:50:08.056Z","title":"WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RealMag777","product":"HUSKY","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115604","published":"2026-10-30T18:30:44.953Z","updated":"2026-10-30T18:50:08.230Z","title":"WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114711","published":"2026-10-30T18:30:44.199Z","updated":"2026-10-30T18:50:08.382Z","title":"WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107868","published":"2026-10-30T18:30:43.460Z","updated":"2026-10-30T22:16:09.766Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITHEMES","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105077","published":"2026-10-30T18:30:42.711Z","updated":"2026-10-30T19:00:18.568Z","title":"WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94175","published":"2026-10-30T18:30:41.949Z","updated":"2026-10-30T19:00:18.724Z","title":"WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"All In One Login","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90888","published":"2026-10-30T18:30:41.184Z","updated":"2026-10-30T19:00:18.867Z","title":"WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"leadsnap","product":"LeadSnap","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78527","published":"2026-10-30T18:30:40.428Z","updated":"2026-10-30T22:16:24.495Z","title":"WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Testimonial Slider","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73186","published":"2026-10-30T18:30:39.660Z","updated":"2026-10-30T19:00:19.002Z","title":"WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ShortPixel","product":"Enable Media Replace","kev":false,"epss":0.00391,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54855","published":"2026-10-30T18:30:38.911Z","updated":"2026-10-30T19:00:19.152Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54854","published":"2026-10-30T18:30:38.149Z","updated":"2026-10-30T19:00:19.289Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54850","published":"2026-10-30T18:30:37.392Z","updated":"2026-10-30T19:00:19.472Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00363,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48201","published":"2026-10-30T18:30:36.622Z","updated":"2026-10-30T22:16:45.956Z","title":"WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Raul P.","product":"Fast Velocity Minify","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39786","published":"2026-10-30T18:30:35.811Z","updated":"2026-10-30T19:00:19.629Z","title":"WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bookingalgorithms","product":"BA Book Everything","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39738","published":"2026-10-30T18:30:34.923Z","updated":"2026-11-01T10:33:20.156Z","title":"WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39734","published":"2026-10-30T18:30:34.168Z","updated":"2026-10-30T19:00:19.915Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39732","published":"2026-10-30T18:30:33.419Z","updated":"2026-10-30T19:00:20.047Z","title":"WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Ivijan-Stefan Stipic","product":"Transliterator","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28160","published":"2026-10-30T18:30:32.657Z","updated":"2026-11-02T06:29:27.699Z","title":"WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27061","published":"2026-10-30T18:30:31.909Z","updated":"2026-10-30T19:00:20.210Z","title":"WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119526","published":"2026-10-30T18:30:31.153Z","updated":"2026-10-30T19:00:20.359Z","title":"WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Royal Event","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62056","published":"2026-10-30T18:14:58.428Z","updated":"2026-10-30T18:33:56.893Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62023","published":"2026-10-30T18:14:07.501Z","updated":"2026-10-30T18:49:58.188Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62019","published":"2026-10-30T18:13:23.687Z","updated":"2026-10-30T18:49:58.331Z","title":"WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104674","published":"2026-10-30T18:12:56.057Z","updated":"2026-10-30T18:49:58.474Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62047","published":"2026-10-30T18:12:37.091Z","updated":"2026-10-30T18:49:58.628Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39739","published":"2026-10-30T18:11:41.349Z","updated":"2026-10-30T18:34:07.113Z","title":"WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Ultimate Addons for Elementor - Lite","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52710","published":"2026-10-30T18:09:43.100Z","updated":"2026-10-30T19:00:20.558Z","title":"WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ithemelandco","product":"GIFTiT &#8211; Free Gifts for WooCommerce","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62057","published":"2026-10-30T18:08:54.944Z","updated":"2026-10-30T19:00:20.717Z","title":"WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fahim Reza","product":"Divi Contact Form 7","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62121","published":"2026-10-30T18:06:19.970Z","updated":"2026-10-30T18:49:58.770Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62122","published":"2026-10-30T18:05:54.717Z","updated":"2026-10-30T18:49:58.921Z","title":"WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119466","published":"2026-10-30T16:16:28.198Z","updated":"2026-10-30T16:39:18.607Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65566","published":"2026-10-30T16:15:59.202Z","updated":"2026-10-30T17:18:21.422Z","title":"WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62055","published":"2026-10-30T16:11:26.969Z","updated":"2026-10-30T17:18:21.560Z","title":"WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119365","published":"2026-10-30T16:11:00.627Z","updated":"2026-10-30T17:18:21.690Z","title":"WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Media Player Addons for Elementor – Media Player widget for WP","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119367","published":"2026-10-30T16:10:10.603Z","updated":"2026-10-30T17:18:21.825Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00231,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62141","published":"2026-10-30T15:29:24.363Z","updated":"2026-10-30T17:18:22.239Z","title":"WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119369","published":"2026-10-30T15:10:13.570Z","updated":"2026-10-30T15:43:43.340Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119479","published":"2026-10-30T15:09:48.592Z","updated":"2026-10-30T17:18:22.511Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116407","published":"2026-10-30T15:08:52.909Z","updated":"2026-10-30T15:50:49.510Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119368","published":"2026-10-30T15:02:22.664Z","updated":"2026-10-30T17:18:22.640Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00314,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119482","published":"2026-10-30T15:01:55.085Z","updated":"2026-10-30T17:18:22.784Z","title":"WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116860","published":"2026-10-30T14:42:18.051Z","updated":"2026-10-30T15:07:31.474Z","title":"WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119370","published":"2026-10-30T14:41:30.900Z","updated":"2026-10-30T15:07:31.625Z","title":"WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65444","published":"2026-10-30T14:40:48.198Z","updated":"2026-10-30T15:07:31.758Z","title":"WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Creative Themes","product":"Blocksy Companion","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118084","published":"2026-10-29T15:24:41.085Z","updated":"2026-10-30T18:39:14.169Z","title":"WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118083","published":"2026-10-29T15:24:40.327Z","updated":"2026-10-30T18:49:59.436Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118082","published":"2026-10-29T15:24:39.565Z","updated":"2026-10-30T18:49:59.606Z","title":"WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.0036,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118081","published":"2026-10-29T15:24:38.804Z","updated":"2026-10-29T19:43:59.116Z","title":"WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"10Web Social Photo Feed","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118080","published":"2026-10-29T15:24:38.055Z","updated":"2026-10-29T17:15:13.611Z","title":"WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Social Snap","product":"Social Snap","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118079","published":"2026-10-29T15:24:37.276Z","updated":"2026-11-03T16:48:08.846Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118078","published":"2026-10-29T15:24:36.520Z","updated":"2026-10-30T18:49:59.967Z","title":"WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PixelYourSite","product":"Product Catalog Feed by PixelYourSite","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118077","published":"2026-10-29T15:24:35.763Z","updated":"2026-10-30T18:50:00.172Z","title":"WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Fast Themes","product":"Sastra Essential Addons for Elementor","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118076","published":"2026-10-29T15:24:35.032Z","updated":"2026-10-29T19:44:58.856Z","title":"WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Frisbii","product":"Frisbii Pay","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118075","published":"2026-10-29T15:24:34.274Z","updated":"2026-10-29T17:15:20.028Z","title":"WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"dbarrere","product":"WP Media folders","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118074","published":"2026-10-29T15:24:33.509Z","updated":"2026-10-30T18:50:00.340Z","title":"WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Daman Jeet","product":"Finale Lite","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118073","published":"2026-10-29T15:24:32.755Z","updated":"2026-10-30T18:50:00.514Z","title":"WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"blazethemes","product":"News Kit Elementor Addons","kev":false,"epss":0.00391,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116869","published":"2026-10-29T15:24:32.010Z","updated":"2026-10-30T18:50:00.662Z","title":"WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"myPOS Payments","product":"myPOS Checkout","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116868","published":"2026-10-29T15:24:31.253Z","updated":"2026-10-29T19:45:42.553Z","title":"WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddyDev","product":"BuddyPress Xprofile Custom Field Types","kev":false,"epss":0.00446,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116867","published":"2026-10-29T15:24:30.502Z","updated":"2026-10-29T17:15:40.473Z","title":"WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"sosidee","product":"Dynamic QR Code &#8211; generator","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116866","published":"2026-10-29T15:24:29.747Z","updated":"2026-10-30T18:50:00.815Z","title":"WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Dotstore","product":"Extra Fees Plugin for WooCommerce","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116865","published":"2026-10-29T15:24:29.022Z","updated":"2026-10-30T18:50:00.961Z","title":"WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Gesundheit Bewegt GmbH","product":"Zippy","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116864","published":"2026-10-29T15:24:28.267Z","updated":"2026-10-30T18:50:01.124Z","title":"WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Arni Cinco","product":"WPCargo Track & Trace","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108494","published":"2026-10-29T15:24:27.520Z","updated":"2026-10-29T19:46:58.960Z","title":"WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bob","product":"Chained Quiz","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62131","published":"2026-10-29T15:24:26.750Z","updated":"2026-10-30T18:50:01.303Z","title":"WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Zoho Flow","product":"Zoho Flow","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62018","published":"2026-10-29T15:24:26.009Z","updated":"2026-10-29T19:48:00.882Z","title":"WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gunslinger","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62017","published":"2026-10-29T15:24:25.273Z","updated":"2026-10-29T17:16:01.751Z","title":"WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Good Homes","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62016","published":"2026-10-29T15:24:24.535Z","updated":"2026-10-30T18:50:01.447Z","title":"WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamic","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62015","published":"2026-10-29T15:24:23.807Z","updated":"2026-10-30T18:50:01.608Z","title":"WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Gamezone","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62014","published":"2026-10-29T15:24:23.059Z","updated":"2026-10-30T18:50:01.772Z","title":"WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"EmojiNation","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62013","published":"2026-10-29T15:24:22.290Z","updated":"2026-10-29T19:49:22.240Z","title":"WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Edge Decor","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62012","published":"2026-10-29T15:24:21.539Z","updated":"2026-10-29T17:16:19.063Z","title":"WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Coinpress","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62011","published":"2026-10-29T15:24:20.782Z","updated":"2026-10-30T18:50:01.917Z","title":"WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Bonbon","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62010","published":"2026-10-29T15:24:20.043Z","updated":"2026-10-30T18:50:02.069Z","title":"WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Avventure","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62009","published":"2026-10-29T15:24:19.287Z","updated":"2026-10-30T18:50:02.217Z","title":"WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Filmax","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62008","published":"2026-10-29T15:24:18.536Z","updated":"2026-10-29T19:43:02.462Z","title":"WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Orpheus","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62006","published":"2026-10-29T15:24:17.789Z","updated":"2026-10-29T17:16:25.167Z","title":"WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Nuts","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62005","published":"2026-10-29T15:24:17.046Z","updated":"2026-10-30T18:50:02.379Z","title":"WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Muzicon","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62004","published":"2026-10-29T15:24:16.292Z","updated":"2026-10-30T18:50:02.531Z","title":"WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Motorix","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62003","published":"2026-10-29T15:24:15.533Z","updated":"2026-10-30T18:50:02.679Z","title":"WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Mission","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62002","published":"2026-10-29T15:24:14.783Z","updated":"2026-10-29T19:42:29.362Z","title":"WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Meals & Wheels","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62001","published":"2026-10-29T15:24:14.045Z","updated":"2026-10-29T17:16:36.644Z","title":"WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Marcell","kev":false,"epss":0.00476,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61998","published":"2026-10-29T15:24:13.299Z","updated":"2026-10-30T18:50:02.827Z","title":"WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Le Truffe","kev":false,"epss":0.00476,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61997","published":"2026-10-29T15:24:12.567Z","updated":"2026-10-30T18:50:03.004Z","title":"WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Legal Stone","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61996","published":"2026-10-29T15:24:11.830Z","updated":"2026-10-30T18:39:14.014Z","title":"WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"favethemes","product":"MLS On The Fly","kev":false,"epss":0.00381,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61995","published":"2026-10-29T15:24:10.950Z","updated":"2026-10-29T19:41:43.590Z","title":"WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"emarket-design","product":"YouTube Showcase","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61993","published":"2026-10-29T15:24:10.200Z","updated":"2026-10-29T17:16:44.466Z","title":"WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"blockonomics","product":"Blockonomics","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61992","published":"2026-10-29T15:24:09.438Z","updated":"2026-10-30T18:50:03.183Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Von Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00386,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61991","published":"2026-10-29T15:24:08.677Z","updated":"2026-10-30T18:50:03.334Z","title":"WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Ajax Load More","product":"AjaxLoadMore Cache","kev":false,"epss":0.00748,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61989","published":"2026-10-29T15:24:07.932Z","updated":"2026-10-30T18:50:03.505Z","title":"WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Merv Barrett","product":"Easy Property Listings","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61988","published":"2026-10-29T15:24:07.189Z","updated":"2026-10-29T19:41:03.059Z","title":"WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"morehawes","product":"Auction Nudge – Your eBay on Your Site","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54866","published":"2026-10-29T15:24:06.443Z","updated":"2026-10-29T17:16:52.192Z","title":"WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Razorpay","product":"Razorpay Payment Button Elementor Plugin","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54865","published":"2026-10-29T15:24:05.681Z","updated":"2026-10-30T18:39:13.879Z","title":"WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Podamibe Nepal","product":"Podamibe Custom User Gravatar","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54864","published":"2026-10-29T15:24:04.940Z","updated":"2026-10-30T18:50:03.679Z","title":"WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"nicashmu","product":"Post Video Players","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54860","published":"2026-10-29T15:24:04.196Z","updated":"2026-10-30T18:50:03.835Z","title":"WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Ozisti","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54859","published":"2026-10-29T15:24:03.450Z","updated":"2026-10-29T19:40:30.116Z","title":"WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Preservation","kev":false,"epss":0.00526,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54858","published":"2026-10-29T15:24:02.681Z","updated":"2026-10-29T17:16:59.146Z","title":"WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Printy","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54857","published":"2026-10-29T15:24:01.923Z","updated":"2026-10-30T18:50:04.264Z","title":"WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Quirky","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54856","published":"2026-10-29T15:24:01.171Z","updated":"2026-10-30T18:50:04.441Z","title":"WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"RexCoin","kev":false,"epss":0.0049,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42701","published":"2026-10-29T15:24:00.414Z","updated":"2026-10-30T18:50:04.609Z","title":"WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YayCommerce","product":"YayMail","kev":false,"epss":0.0037,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42692","published":"2026-10-29T15:23:59.420Z","updated":"2026-10-29T19:39:42.399Z","title":"WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"WP Crowdfunding","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42690","published":"2026-10-29T15:23:58.663Z","updated":"2026-10-29T17:17:08.164Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27394","published":"2026-10-29T15:23:57.862Z","updated":"2026-10-30T18:50:04.772Z","title":"WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jyothis Joy","product":"Eventer","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118085","published":"2026-10-29T15:23:57.104Z","updated":"2026-10-30T18:50:05.160Z","title":"WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Global Payments","product":"GlobalPayments WooCommerce","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42694","published":"2026-10-29T15:05:18.749Z","updated":"2026-10-30T18:50:05.330Z","title":"WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48200","published":"2026-10-29T15:04:50.615Z","updated":"2026-10-29T17:18:26.068Z","title":"WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Barn2 Plugins","product":"Document Library Lite","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116848","published":"2026-10-29T15:04:29.001Z","updated":"2026-10-30T18:39:13.456Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH Innovations","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109891","published":"2026-10-29T15:04:03.409Z","updated":"2026-10-30T18:50:05.523Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.4,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25448","published":"2026-10-29T14:55:02.968Z","updated":"2026-10-29T19:34:34.063Z","title":"WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42691","published":"2026-10-29T14:40:48.838Z","updated":"2026-10-30T19:00:20.857Z","title":"WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"EventPrime","product":"EventPrime","kev":false,"epss":0.00189,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54852","published":"2026-10-29T14:40:27.236Z","updated":"2026-10-30T19:00:20.999Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97073","published":"2026-10-29T14:39:40.470Z","updated":"2026-10-29T17:18:39.592Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118097","published":"2026-10-29T14:39:07.281Z","updated":"2026-10-29T19:34:06.345Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27062","published":"2026-10-29T14:38:48.633Z","updated":"2026-10-30T19:00:21.175Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00098,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54853","published":"2026-10-29T14:32:35.962Z","updated":"2026-10-29T17:19:05.990Z","title":"WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114706","published":"2026-10-29T14:32:29.513Z","updated":"2026-10-30T18:39:13.589Z","title":"WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27063","published":"2026-10-29T14:32:08.078Z","updated":"2026-10-30T18:50:05.686Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115601","published":"2026-10-29T14:31:58.839Z","updated":"2026-10-30T18:50:05.850Z","title":"WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Custom Price for WooCommerce","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115605","published":"2026-10-29T14:29:40.076Z","updated":"2026-10-29T16:49:18.631Z","title":"WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118095","published":"2026-10-29T14:29:27.704Z","updated":"2026-10-29T16:49:18.797Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54871","published":"2026-10-29T14:29:24.576Z","updated":"2026-10-29T16:49:18.942Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25450","published":"2026-10-29T14:29:14.280Z","updated":"2026-10-29T16:49:19.089Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116850","published":"2026-10-29T14:29:07.948Z","updated":"2026-10-29T16:49:19.233Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114181","published":"2026-10-29T14:28:58.705Z","updated":"2026-10-29T16:49:19.379Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118088","published":"2026-10-29T14:26:27.526Z","updated":"2026-10-29T16:49:19.530Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116849","published":"2026-10-29T14:26:08.716Z","updated":"2026-10-29T16:49:19.673Z","title":"WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110881","published":"2026-10-29T14:25:46.727Z","updated":"2026-10-29T16:49:19.816Z","title":"WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116856","published":"2026-10-29T14:24:43.173Z","updated":"2026-10-29T16:49:19.958Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39737","published":"2026-10-29T14:24:19.832Z","updated":"2026-10-29T17:19:30.379Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118091","published":"2026-10-29T14:23:51.139Z","updated":"2026-10-30T18:50:06.004Z","title":"WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116387","published":"2026-10-29T14:22:37.807Z","updated":"2026-10-30T18:50:06.170Z","title":"WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39742","published":"2026-10-29T14:20:45.598Z","updated":"2026-10-29T14:37:20.747Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115610","published":"2026-10-29T14:20:16.168Z","updated":"2026-10-30T18:39:13.737Z","title":"WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"PublishPress Authors","kev":false,"epss":0.00139,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118092","published":"2026-10-29T14:17:28.380Z","updated":"2026-10-29T17:19:46.176Z","title":"WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116406","published":"2026-10-29T14:16:17.757Z","updated":"2026-10-29T16:49:20.101Z","title":"WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52708","published":"2026-10-29T14:15:19.164Z","updated":"2026-10-29T16:49:20.247Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116846","published":"2026-10-29T14:14:41.416Z","updated":"2026-10-29T16:49:20.397Z","title":"WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00302,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48884","published":"2026-10-29T14:13:18.988Z","updated":"2026-10-29T16:49:20.542Z","title":"WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00284,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39736","published":"2026-10-29T14:08:21.817Z","updated":"2026-10-29T16:49:21.267Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00305,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116402","published":"2026-10-29T14:05:58.547Z","updated":"2026-10-29T16:49:21.421Z","title":"WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48202","published":"2026-10-29T13:58:06.273Z","updated":"2026-10-29T16:49:21.568Z","title":"WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brave","product":"Brave","kev":false,"epss":0.00286,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39782","published":"2026-10-29T13:56:43.214Z","updated":"2026-10-29T16:49:21.714Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25467","published":"2026-10-29T13:55:28.476Z","updated":"2026-10-29T16:49:21.855Z","title":"WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116399","published":"2026-10-29T13:54:04.259Z","updated":"2026-10-29T16:49:21.999Z","title":"WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116857","published":"2026-10-29T13:53:39.647Z","updated":"2026-10-29T16:49:22.150Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54862","published":"2026-10-29T13:09:14.823Z","updated":"2026-10-29T13:47:35.097Z","title":"WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Codection","product":"Import and export users and customers","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42707","published":"2026-10-29T13:07:48.740Z","updated":"2026-10-29T13:47:35.256Z","title":"WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress Claim Listings","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48195","published":"2026-10-29T13:07:16.802Z","updated":"2026-10-29T13:47:35.412Z","title":"WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"PDF Poster","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39741","published":"2026-10-29T13:06:11.953Z","updated":"2026-10-29T13:47:35.579Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48196","published":"2026-10-29T13:04:39.022Z","updated":"2026-10-29T13:47:35.754Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-22386","published":"2026-10-29T13:04:17.195Z","updated":"2026-10-29T13:47:35.898Z","title":"WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52709","published":"2026-10-29T13:03:56.761Z","updated":"2026-10-29T13:47:36.058Z","title":"WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Video Gallery Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-24533","published":"2026-10-29T13:02:13.252Z","updated":"2026-10-29T13:47:36.226Z","title":"WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42703","published":"2026-10-29T13:01:49.395Z","updated":"2026-10-29T13:47:36.384Z","title":"WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118087","published":"2026-10-29T13:01:05.153Z","updated":"2026-10-29T13:47:36.553Z","title":"WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118094","published":"2026-10-29T12:59:46.185Z","updated":"2026-10-29T13:47:36.720Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39735","published":"2026-10-29T12:58:57.438Z","updated":"2026-10-29T13:47:36.877Z","title":"WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-56056","published":"2026-10-29T12:58:32.218Z","updated":"2026-10-29T13:47:37.027Z","title":"WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"The Post Grid","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118093","published":"2026-10-29T12:58:10.017Z","updated":"2026-10-29T13:47:37.178Z","title":"WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPFunnels Team","product":"Product Feed Manager","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27401","published":"2026-10-29T11:28:05.240Z","updated":"2026-10-29T12:36:50.510Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115611","published":"2026-10-29T11:00:26.280Z","updated":"2026-10-29T12:36:51.406Z","title":"WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"TableOn","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115964","published":"2026-10-29T11:00:25.837Z","updated":"2026-10-29T12:36:51.554Z","title":"WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115962","published":"2026-10-29T11:00:25.822Z","updated":"2026-10-29T12:36:51.694Z","title":"WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115592","published":"2026-10-29T11:00:25.353Z","updated":"2026-10-29T12:36:51.841Z","title":"WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"OceanWP","product":"OceanWP","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116409","published":"2026-10-29T11:00:25.348Z","updated":"2026-11-05T11:20:55.752Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112827","published":"2026-10-29T11:00:24.746Z","updated":"2026-10-29T12:36:52.128Z","title":"WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"HANDMADE – Dropshipping for Etsy and WooCommerce","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114193","published":"2026-10-29T11:00:24.744Z","updated":"2026-10-29T12:36:52.272Z","title":"WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Eyal Fitoussi","product":"GEO my WordPress","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115599","published":"2026-10-29T11:00:24.169Z","updated":"2026-10-29T12:36:52.417Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115965","published":"2026-10-29T11:00:24.136Z","updated":"2026-10-29T12:36:52.568Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115967","published":"2026-10-29T11:00:23.638Z","updated":"2026-10-29T12:36:52.709Z","title":"WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00354,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115963","published":"2026-10-29T11:00:23.604Z","updated":"2026-10-29T12:36:52.863Z","title":"WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115603","published":"2026-10-28T14:02:57.872Z","updated":"2026-10-29T13:47:37.343Z","title":"WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Advanced Ads GmbH","product":"Advanced Ads – Tracking","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115968","published":"2026-10-28T14:02:57.496Z","updated":"2026-10-28T16:07:03.811Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116390","published":"2026-10-28T14:02:57.098Z","updated":"2026-10-29T13:47:37.495Z","title":"WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"stepasyuk","product":"Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116389","published":"2026-10-28T14:02:56.685Z","updated":"2026-10-29T13:47:37.643Z","title":"WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"crossi72","product":"Phoenix Media Rename","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115590","published":"2026-10-28T14:02:56.306Z","updated":"2026-10-29T13:47:37.789Z","title":"WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"weDevs","product":"Dokan","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116391","published":"2026-10-28T13:00:28.765Z","updated":"2026-10-29T13:47:37.936Z","title":"WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Logo Slider","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116392","published":"2026-10-28T13:00:28.367Z","updated":"2026-10-29T13:47:38.092Z","title":"WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"PickPlugins","product":"Accordion","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116393","published":"2026-10-28T13:00:28.337Z","updated":"2026-10-28T16:07:23.809Z","title":"WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"iHomefinder, Inc.","product":"Optima Express","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116404","published":"2026-10-28T13:00:27.971Z","updated":"2026-10-29T13:47:38.245Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111850","published":"2026-10-28T13:00:27.940Z","updated":"2026-10-29T13:47:38.415Z","title":"WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"BuddyPress","product":"BuddyPress","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115612","published":"2026-10-28T13:00:14.372Z","updated":"2026-10-28T16:07:30.579Z","title":"WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115591","published":"2026-10-28T13:00:13.962Z","updated":"2026-10-29T13:47:38.566Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115593","published":"2026-10-28T13:00:13.871Z","updated":"2026-10-29T13:47:38.730Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115596","published":"2026-10-28T13:00:13.283Z","updated":"2026-10-28T16:07:36.842Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111411","published":"2026-10-28T13:00:13.279Z","updated":"2026-11-05T17:19:11.678Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.00342,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115607","published":"2026-10-28T13:00:12.493Z","updated":"2026-10-29T13:47:38.888Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115957","published":"2026-10-28T13:00:12.485Z","updated":"2026-10-30T20:05:31.800Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115606","published":"2026-10-28T13:00:11.719Z","updated":"2026-10-29T13:47:39.191Z","title":"WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crowd Favorite","product":"DXP ToolKit","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115609","published":"2026-10-28T13:00:11.577Z","updated":"2026-10-29T13:47:39.348Z","title":"WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"GetPaid","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116855","published":"2026-10-28T11:17:47.505Z","updated":"2026-10-29T13:47:39.509Z","title":"WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wphocus","product":"My auctions allegro","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116863","published":"2026-10-27T15:56:41.312Z","updated":"2026-10-29T13:47:39.657Z","title":"WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116408","published":"2026-10-26T17:29:38.120Z","updated":"2026-10-26T17:57:32.081Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111404","published":"2026-10-26T17:28:57.422Z","updated":"2026-10-26T17:57:32.283Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112839","published":"2026-10-26T17:28:17.277Z","updated":"2026-10-26T17:57:32.460Z","title":"WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"Customer Coupons for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115966","published":"2026-10-26T17:27:49.307Z","updated":"2026-10-26T17:57:32.653Z","title":"WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Typing Text – Give your texts many typing effects","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116400","published":"2026-10-26T17:27:17.642Z","updated":"2026-10-26T17:57:32.849Z","title":"WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Button Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116398","published":"2026-10-26T17:26:48.798Z","updated":"2026-10-26T17:57:33.053Z","title":"WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Content Slider Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116395","published":"2026-10-26T16:46:39.501Z","updated":"2026-10-26T17:37:09.389Z","title":"WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"LightBox Block","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115598","published":"2026-10-26T16:45:11.621Z","updated":"2026-10-26T17:37:09.543Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114710","published":"2026-10-26T16:43:59.208Z","updated":"2026-10-26T17:37:09.711Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115597","published":"2026-10-26T16:43:22.281Z","updated":"2026-10-26T17:37:09.885Z","title":"WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116388","published":"2026-10-26T16:42:54.795Z","updated":"2026-10-26T17:37:10.026Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116396","published":"2026-10-26T16:39:18.840Z","updated":"2026-10-26T17:37:10.212Z","title":"WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116403","published":"2026-10-26T16:37:59.242Z","updated":"2026-10-26T17:37:10.367Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116394","published":"2026-10-26T16:00:08.893Z","updated":"2026-10-26T17:37:11.529Z","title":"WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114708","published":"2026-10-26T10:36:32.680Z","updated":"2026-10-26T12:54:32.687Z","title":"WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115595","published":"2026-10-26T10:36:08.187Z","updated":"2026-10-26T12:54:32.838Z","title":"WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115959","published":"2026-10-26T10:35:45.823Z","updated":"2026-10-26T12:54:32.987Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115960","published":"2026-10-26T10:35:23.855Z","updated":"2026-10-26T12:54:33.130Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115955","published":"2026-10-26T10:35:04.514Z","updated":"2026-10-26T12:54:33.290Z","title":"WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Advanced Post Block - Post Grid for WordPress block editor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115956","published":"2026-10-26T10:34:34.613Z","updated":"2026-10-26T12:54:33.447Z","title":"WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Panorama Viewer – 360 Degree Image + Video Viewer","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115961","published":"2026-10-26T10:34:10.476Z","updated":"2026-10-26T12:54:33.589Z","title":"WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Slider","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114707","published":"2026-10-26T10:28:54.378Z","updated":"2026-10-26T12:54:33.861Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115594","published":"2026-10-26T10:28:26.944Z","updated":"2026-10-26T12:54:34.035Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115608","published":"2026-10-26T10:28:00.697Z","updated":"2026-10-26T12:54:34.228Z","title":"WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115953","published":"2026-10-26T10:27:38.261Z","updated":"2026-10-26T12:54:34.394Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115954","published":"2026-10-26T10:27:16.990Z","updated":"2026-10-26T12:54:34.575Z","title":"WordPress  Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115950","published":"2026-10-26T10:26:54.044Z","updated":"2026-10-26T12:54:34.713Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115951","published":"2026-10-26T10:26:34.727Z","updated":"2026-10-26T12:54:34.854Z","title":"WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kevin Weber","product":"Lazy Load for Videos","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115948","published":"2026-10-26T10:08:37.779Z","updated":"2026-10-26T12:54:35.005Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114709","published":"2026-10-26T10:08:01.188Z","updated":"2026-10-26T10:23:40.064Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115949","published":"2026-10-26T10:07:24.926Z","updated":"2026-10-26T10:23:40.211Z","title":"WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Smart Widgets","product":"Better Post & Filter Widgets for Elementor","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115614","published":"2026-10-26T10:05:22.425Z","updated":"2026-10-26T10:23:40.370Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97255","published":"2026-10-26T10:03:47.707Z","updated":"2026-10-26T10:23:40.524Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97254","published":"2026-10-26T10:02:36.972Z","updated":"2026-10-26T10:23:40.688Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97295","published":"2026-10-26T10:01:28.037Z","updated":"2026-10-26T10:23:40.842Z","title":"WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00124,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112865","published":"2026-10-26T10:01:03.255Z","updated":"2026-10-26T10:23:41.001Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110377","published":"2026-10-26T09:59:47.003Z","updated":"2026-10-26T10:23:41.157Z","title":"WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Bopo – WooCommerce Product Bundle Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115602","published":"2026-10-26T09:59:24.845Z","updated":"2026-10-26T10:23:41.317Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115613","published":"2026-10-26T09:54:36.992Z","updated":"2026-10-26T10:13:37.674Z","title":"WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Image Gallery block – Create and display photo gallery/photo album.","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115958","published":"2026-10-26T09:54:20.583Z","updated":"2026-10-26T10:13:37.956Z","title":"WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Discussion Board","product":"WP Discussion Board","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110376","published":"2026-10-26T08:47:06.966Z","updated":"2026-10-26T10:13:38.243Z","title":"WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"DEPART","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111841","published":"2026-10-26T08:46:47.663Z","updated":"2026-10-26T10:13:38.533Z","title":"WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Aman","product":"FunnelKit Automations","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112828","published":"2026-10-26T08:45:37.443Z","updated":"2026-10-26T10:13:38.809Z","title":"WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114191","published":"2026-10-24T14:00:09.573Z","updated":"2026-10-24T14:46:58.028Z","title":"WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Knit Pay","product":"UPI QR Code Payment Gateway for WooCommerce","kev":false,"epss":0.00336,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114704","published":"2026-10-24T14:00:09.045Z","updated":"2026-10-24T14:46:58.175Z","title":"WordPress Relevanssi  plugin <= 4.28.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Christoph Vielgrader","product":"Relevanssi","kev":false,"epss":0.00413,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114192","published":"2026-10-24T14:00:09.029Z","updated":"2026-10-24T14:46:58.324Z","title":"WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114705","published":"2026-10-24T10:00:11.514Z","updated":"2026-10-24T14:46:58.465Z","title":"WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"quadlayers","product":"WP Social Feed Gallery","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114194","published":"2026-10-24T09:08:50.102Z","updated":"2026-10-24T14:46:56.574Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114196","published":"2026-10-24T08:00:13.761Z","updated":"2026-10-24T14:46:58.606Z","title":"WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"paytiumsupport","product":"Paytium","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114695","published":"2026-10-24T08:00:13.590Z","updated":"2026-10-24T14:46:56.713Z","title":"WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114694","published":"2026-10-24T08:00:13.325Z","updated":"2026-10-24T14:46:56.850Z","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114693","published":"2026-10-24T08:00:12.874Z","updated":"2026-10-27T15:06:40.501Z","title":"WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugins360 Labs","product":"All-in-One Video Gallery","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110892","published":"2026-10-24T08:00:12.427Z","updated":"2026-10-24T14:46:58.746Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00296,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114697","published":"2026-10-24T08:00:12.424Z","updated":"2026-10-24T14:46:57.138Z","title":"WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114178","published":"2026-10-24T08:00:11.922Z","updated":"2026-10-24T14:46:57.285Z","title":"WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bold Grid","product":"W3 Total Cache","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114190","published":"2026-10-24T08:00:11.901Z","updated":"2026-10-24T14:46:58.879Z","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","kev":false,"epss":0.00306,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112866","published":"2026-10-24T08:00:11.483Z","updated":"2026-10-24T14:46:59.015Z","title":"WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPFactory","product":"Product Filter by WBW","kev":false,"epss":0.01164,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94075","published":"2026-10-24T08:00:11.463Z","updated":"2026-10-24T14:46:59.162Z","title":"WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112869","published":"2026-10-24T08:00:10.988Z","updated":"2026-10-24T14:46:57.432Z","title":"WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Noah Hearle","product":"We’re Open!","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111402","published":"2026-10-24T08:00:10.963Z","updated":"2026-10-24T14:46:59.295Z","title":"WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00349,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112844","published":"2026-10-24T08:00:10.546Z","updated":"2026-10-24T14:46:57.569Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114179","published":"2026-10-24T08:00:10.535Z","updated":"2026-10-24T14:46:57.707Z","title":"WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112848","published":"2026-10-23T13:00:20.030Z","updated":"2026-10-24T14:46:59.432Z","title":"WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112849","published":"2026-10-23T13:00:19.660Z","updated":"2026-10-23T14:58:45.182Z","title":"WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AivahThemes","product":"Hostme v2","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112850","published":"2026-10-23T13:00:19.609Z","updated":"2026-10-24T14:46:59.580Z","title":"WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"Your Dress","kev":false,"epss":0.00337,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112854","published":"2026-10-23T13:00:19.251Z","updated":"2026-10-24T14:46:59.714Z","title":"WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Holistic Center","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112847","published":"2026-10-23T13:00:19.203Z","updated":"2026-10-24T14:46:59.854Z","title":"WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ZenSoul","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112846","published":"2026-10-23T13:00:18.841Z","updated":"2026-10-24T14:47:00.039Z","title":"WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Save Life","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112851","published":"2026-10-23T13:00:18.778Z","updated":"2026-10-24T14:47:00.303Z","title":"WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"HotLock","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112852","published":"2026-10-23T13:00:18.393Z","updated":"2026-10-24T14:47:00.462Z","title":"WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX Group","product":"Helion","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112853","published":"2026-10-23T13:00:18.338Z","updated":"2026-10-23T14:59:06.317Z","title":"WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Hallelujah","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112856","published":"2026-10-23T13:00:17.961Z","updated":"2026-10-24T14:47:00.597Z","title":"WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Vagabonds","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112857","published":"2026-10-23T13:00:17.920Z","updated":"2026-10-23T14:59:12.653Z","title":"WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Reprizo","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112858","published":"2026-10-23T13:00:17.505Z","updated":"2026-10-24T14:47:00.738Z","title":"WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Rhodos","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112859","published":"2026-10-23T13:00:17.469Z","updated":"2026-10-24T14:47:00.875Z","title":"WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Little Birdies","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112855","published":"2026-10-23T13:00:16.938Z","updated":"2026-10-24T14:47:01.013Z","title":"WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Redy","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112863","published":"2026-10-23T13:00:16.927Z","updated":"2026-10-24T14:46:57.865Z","title":"WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Hogash","product":"KALLYAS","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112860","published":"2026-10-23T08:00:11.265Z","updated":"2026-10-23T10:56:06.122Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112862","published":"2026-10-23T08:00:11.165Z","updated":"2026-10-23T10:56:06.266Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112835","published":"2026-10-23T08:00:10.892Z","updated":"2026-10-23T10:56:06.431Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112837","published":"2026-10-23T08:00:10.809Z","updated":"2026-10-23T10:56:06.582Z","title":"WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00305,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112359","published":"2026-10-23T08:00:10.686Z","updated":"2026-10-23T10:56:06.737Z","title":"WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Amauri.IO","product":"WPMobile.App","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112838","published":"2026-10-23T08:00:10.440Z","updated":"2026-10-23T10:56:06.894Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112821","published":"2026-10-23T08:00:10.353Z","updated":"2026-10-23T10:56:07.050Z","title":"WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Knit Pay","product":"Knit Pay","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112825","published":"2026-10-23T08:00:10.214Z","updated":"2026-10-23T10:56:07.212Z","title":"WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Car Rental Manager","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112832","published":"2026-10-22T11:00:11.107Z","updated":"2026-10-22T13:37:46.390Z","title":"WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.0044,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112842","published":"2026-10-22T11:00:10.742Z","updated":"2026-10-22T13:37:46.527Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112822","published":"2026-10-22T11:00:10.699Z","updated":"2026-10-22T13:37:46.663Z","title":"WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112313","published":"2026-10-22T10:00:12.776Z","updated":"2026-11-03T15:22:36.298Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112820","published":"2026-10-22T10:00:12.735Z","updated":"2026-10-22T10:56:12.421Z","title":"WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Academist Core","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114703","published":"2026-10-22T08:59:26.154Z","updated":"2026-10-22T10:56:12.576Z","title":"WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"hupe13","product":"Extensions for Leaflet Map","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114702","published":"2026-10-22T08:58:42.642Z","updated":"2026-10-22T10:56:12.729Z","title":"WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"nicdark","product":"ND Shortcodes For Visual Composer","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114701","published":"2026-10-22T08:55:52.176Z","updated":"2026-10-22T10:56:12.880Z","title":"WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"xootix","product":"Waitlist Woocommerce ( Back in stock notifier )","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114700","published":"2026-10-22T08:54:35.279Z","updated":"2026-10-22T10:56:13.056Z","title":"WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Gloriafood","product":"Restaurant Menu – Food Ordering System – Table Reservation","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114699","published":"2026-10-22T08:53:03.761Z","updated":"2026-10-22T10:56:13.209Z","title":"WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"yoomoney","product":"ЮKassa для WooCommerce","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114195","published":"2026-10-22T08:48:20.446Z","updated":"2026-10-22T10:56:13.370Z","title":"WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"ShopMagic","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112218","published":"2026-10-22T08:47:02.409Z","updated":"2026-10-22T10:56:13.526Z","title":"WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114696","published":"2026-10-22T08:46:29.875Z","updated":"2026-10-29T18:51:12.133Z","title":"WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111842","published":"2026-10-22T08:46:02.025Z","updated":"2026-10-22T10:56:13.877Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112311","published":"2026-10-22T08:00:50.094Z","updated":"2026-10-22T10:56:14.032Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00345,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111851","published":"2026-10-22T08:00:50.041Z","updated":"2026-10-22T10:56:14.204Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":7.6,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00275,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112312","published":"2026-10-22T08:00:50.028Z","updated":"2026-10-30T14:37:49.722Z","title":"WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00336,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111830","published":"2026-10-22T08:00:49.652Z","updated":"2026-10-22T10:56:14.523Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112241","published":"2026-10-22T08:00:49.628Z","updated":"2026-10-22T10:56:14.683Z","title":"WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112242","published":"2026-10-22T08:00:49.604Z","updated":"2026-10-25T22:47:02.391Z","title":"WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112845","published":"2026-10-22T07:33:45.372Z","updated":"2026-10-22T10:56:14.997Z","title":"WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jory Hogeveen","product":"Off-Canvas Sidebars & Menus (Slidebars)","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110893","published":"2026-10-22T07:33:26.080Z","updated":"2026-10-22T10:56:15.240Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110894","published":"2026-10-22T07:32:51.134Z","updated":"2026-10-22T10:56:15.454Z","title":"WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114698","published":"2026-10-22T07:31:39.662Z","updated":"2026-10-22T10:56:15.614Z","title":"WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00241,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112327","published":"2026-10-22T07:01:09.933Z","updated":"2026-10-22T10:56:15.759Z","title":"WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112379","published":"2026-10-22T07:01:09.851Z","updated":"2026-10-22T10:56:15.899Z","title":"WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Codepeople","product":"Contact Form Email","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114182","published":"2026-10-22T06:53:38.179Z","updated":"2026-10-22T10:56:16.049Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112843","published":"2026-10-22T06:53:13.511Z","updated":"2026-10-22T10:56:16.221Z","title":"WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112826","published":"2026-10-22T06:52:48.653Z","updated":"2026-10-22T10:56:16.397Z","title":"WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"eLightUp","product":"Falcon – WordPress Optimizations & Tweaks","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114180","published":"2026-10-22T06:51:28.157Z","updated":"2026-10-22T10:56:16.552Z","title":"WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111847","published":"2026-10-22T06:50:48.346Z","updated":"2026-10-22T10:56:16.712Z","title":"WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Kings Plugins","product":"MarketKing","kev":false,"epss":0.00193,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114177","published":"2026-10-22T06:50:11.735Z","updated":"2026-10-22T10:56:16.853Z","title":"WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Xpro","product":"Xpro Elementor Addons","kev":false,"epss":0.00181,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114175","published":"2026-10-22T06:48:49.336Z","updated":"2026-10-22T10:56:16.997Z","title":"WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112867","published":"2026-10-22T06:46:23.617Z","updated":"2026-10-22T10:56:17.135Z","title":"WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"H5P","product":"H5P","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114184","published":"2026-10-22T06:45:47.353Z","updated":"2026-10-22T10:56:17.294Z","title":"WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111401","published":"2026-10-21T18:02:35.731Z","updated":"2026-10-22T10:56:17.445Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112868","published":"2026-10-21T18:01:00.900Z","updated":"2026-10-22T10:56:17.592Z","title":"WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"H5P","product":"H5P","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114176","published":"2026-10-21T18:00:12.725Z","updated":"2026-10-22T10:56:17.723Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111832","published":"2026-10-21T14:00:13.392Z","updated":"2026-10-21T17:19:12.429Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111834","published":"2026-10-21T14:00:13.142Z","updated":"2026-10-21T17:19:12.599Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111835","published":"2026-10-21T14:00:13.041Z","updated":"2026-10-21T15:47:50.932Z","title":"WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bjorntech","product":"BjornTech Swish for WooCommerce","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111848","published":"2026-10-21T14:00:12.950Z","updated":"2026-10-21T15:47:58.712Z","title":"WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112221","published":"2026-10-21T14:00:12.692Z","updated":"2026-10-21T17:19:12.758Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111833","published":"2026-10-21T14:00:12.587Z","updated":"2026-10-21T17:19:12.931Z","title":"WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"Bold Grid","product":"weForms","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111837","published":"2026-10-21T14:00:12.511Z","updated":"2026-10-21T17:19:13.111Z","title":"WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111838","published":"2026-10-21T14:00:12.248Z","updated":"2026-10-21T17:19:13.275Z","title":"WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"ThemeHunk Customizer","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111840","published":"2026-10-21T14:00:12.136Z","updated":"2026-10-21T17:19:13.467Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111852","published":"2026-10-21T14:00:12.051Z","updated":"2026-10-21T17:19:13.637Z","title":"WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111849","published":"2026-10-21T13:00:12.562Z","updated":"2026-10-21T13:13:28.148Z","title":"WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110369","published":"2026-10-21T09:10:25.410Z","updated":"2026-10-21T10:35:06.745Z","title":"WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"WordPress Team Members – GS Plugins","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110370","published":"2026-10-21T09:10:25.368Z","updated":"2026-10-21T10:35:06.886Z","title":"WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"GS Plugins","product":"GS Pins for Pinterest","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110884","published":"2026-10-21T09:10:25.275Z","updated":"2026-10-21T10:35:07.177Z","title":"WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"geekontheroad","product":"Live Summary for Gravity Forms","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110899","published":"2026-10-21T08:00:20.542Z","updated":"2026-10-30T20:01:11.038Z","title":"WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107435","published":"2026-10-21T08:00:15.941Z","updated":"2026-10-21T10:35:07.464Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112861","published":"2026-10-20T17:47:26.055Z","updated":"2026-10-21T10:35:07.995Z","title":"WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"xnau webdesign","product":"Participants Database","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112823","published":"2026-10-20T15:14:13.192Z","updated":"2026-10-21T10:35:08.137Z","title":"WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112824","published":"2026-10-20T15:13:47.804Z","updated":"2026-10-20T16:16:17.587Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111843","published":"2026-10-20T15:12:05.376Z","updated":"2026-10-21T10:35:08.438Z","title":"WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CozyThemes","product":"Rootblox","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112829","published":"2026-10-20T15:11:43.228Z","updated":"2026-10-21T10:35:08.582Z","title":"WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112840","published":"2026-10-20T15:10:54.998Z","updated":"2026-10-21T10:35:08.866Z","title":"WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112836","published":"2026-10-20T15:10:13.770Z","updated":"2026-10-20T16:44:17.508Z","title":"WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109700","published":"2026-10-20T15:06:51.007Z","updated":"2026-10-20T17:21:58.344Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.00315,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112834","published":"2026-10-20T14:53:47.737Z","updated":"2026-10-21T10:28:09.573Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112833","published":"2026-10-20T14:53:14.184Z","updated":"2026-10-20T15:14:09.857Z","title":"WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Castos","product":"Seriously Simple Podcasting","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111844","published":"2026-10-20T09:47:10.054Z","updated":"2026-10-20T16:07:12.280Z","title":"WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brizy","product":"Brizy","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111828","published":"2026-10-19T13:29:02.276Z","updated":"2026-10-19T18:13:06.617Z","title":"WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112222","published":"2026-10-19T13:28:19.208Z","updated":"2026-10-19T14:59:04.484Z","title":"WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Surfer","product":"Surfer","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111829","published":"2026-10-19T13:27:57.467Z","updated":"2026-10-19T18:14:19.288Z","title":"WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110902","published":"2026-10-19T13:27:05.415Z","updated":"2026-10-19T14:26:14.786Z","title":"WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111845","published":"2026-10-19T12:38:16.661Z","updated":"2026-10-19T16:45:42.720Z","title":"WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Bundles","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111831","published":"2026-10-19T12:24:22.785Z","updated":"2026-10-19T14:28:05.700Z","title":"WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110363","published":"2026-10-19T12:21:58.494Z","updated":"2026-10-19T18:15:27.691Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111836","published":"2026-10-19T12:21:27.605Z","updated":"2026-10-19T18:19:12.683Z","title":"WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentCommunity","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111414","published":"2026-10-19T12:20:08.655Z","updated":"2026-10-19T18:23:08.474Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111410","published":"2026-10-19T12:16:12.230Z","updated":"2026-10-19T14:28:31.696Z","title":"WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"E2Pdf.com","product":"e2pdf","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111839","published":"2026-10-19T12:13:50.340Z","updated":"2026-10-19T18:25:34.806Z","title":"WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-112199","published":"2026-10-19T12:06:43.446Z","updated":"2026-10-19T18:26:29.775Z","title":"WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110887","published":"2026-10-19T09:09:19.849Z","updated":"2026-10-19T16:51:04.682Z","title":"WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111398","published":"2026-10-19T09:09:19.440Z","updated":"2026-10-19T17:17:11.133Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00327,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110898","published":"2026-10-19T09:09:19.416Z","updated":"2026-10-19T16:50:35.254Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.4,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111407","published":"2026-10-19T09:09:19.001Z","updated":"2026-10-19T12:49:03.673Z","title":"WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111408","published":"2026-10-19T09:09:18.970Z","updated":"2026-10-19T17:17:55.950Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110379","published":"2026-10-19T09:09:18.538Z","updated":"2026-10-19T12:49:30.765Z","title":"WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ays Pro","product":"Quiz Maker","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111406","published":"2026-10-19T09:09:18.419Z","updated":"2026-10-19T16:54:29.679Z","title":"WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110895","published":"2026-10-18T11:00:30.914Z","updated":"2026-10-18T11:42:55.685Z","title":"WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"DevItems","product":"Support Genix","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107436","published":"2026-10-18T11:00:30.528Z","updated":"2026-10-19T18:44:42.166Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110373","published":"2026-10-18T11:00:30.495Z","updated":"2026-10-19T18:56:33.875Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110880","published":"2026-10-18T11:00:30.027Z","updated":"2026-10-19T18:57:25.484Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110886","published":"2026-10-18T11:00:30.021Z","updated":"2026-10-19T15:53:23.555Z","title":"WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109895","published":"2026-10-18T11:00:29.573Z","updated":"2026-10-18T11:42:55.835Z","title":"WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109894","published":"2026-10-18T11:00:29.562Z","updated":"2026-10-19T15:51:39.092Z","title":"WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110883","published":"2026-10-18T11:00:29.126Z","updated":"2026-10-19T19:00:19.026Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":0.00301,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110383","published":"2026-10-18T11:00:29.114Z","updated":"2026-10-18T11:42:55.982Z","title":"WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"WP E-Signature","product":"Electronic Signature Add-on for Fluent Forms","kev":false,"epss":0.00295,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110897","published":"2026-10-18T11:00:28.706Z","updated":"2026-10-19T15:48:00.679Z","title":"WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"IdeaBox Creations","product":"PowerPack Lite for Beaver Builder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110372","published":"2026-10-18T11:00:28.694Z","updated":"2026-10-19T19:01:11.342Z","title":"WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.01365,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110382","published":"2026-10-18T11:00:28.191Z","updated":"2026-10-19T15:45:31.217Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108485","published":"2026-10-18T11:00:28.148Z","updated":"2026-10-19T15:42:56.281Z","title":"WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"eStore","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110885","published":"2026-10-18T11:00:22.694Z","updated":"2026-10-19T19:03:21.300Z","title":"WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00333,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110365","published":"2026-10-18T11:00:22.685Z","updated":"2026-10-19T19:03:53.371Z","title":"WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPExperts","product":"Advanced File Manager","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110882","published":"2026-10-17T19:00:11.325Z","updated":"2026-10-18T11:22:45.458Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109701","published":"2026-10-17T17:00:45.175Z","updated":"2026-10-18T11:22:45.594Z","title":"WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PAYCOMET","product":"PAYCOMET for WooCommerce","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110889","published":"2026-10-17T11:00:12.190Z","updated":"2026-10-18T11:22:45.735Z","title":"WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Gantry","product":"Gantry 5 Framework","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110384","published":"2026-10-17T07:00:31.036Z","updated":"2026-10-18T11:22:46.019Z","title":"WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Fancy Comments WordPress","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111413","published":"2026-10-16T13:02:14.161Z","updated":"2026-10-16T13:32:40.971Z","title":"WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"aThemeArt","product":"aThemeArt Theme Helper","kev":false,"epss":0.00133,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110896","published":"2026-10-16T12:57:24.956Z","updated":"2026-10-16T14:01:22.556Z","title":"WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111400","published":"2026-10-16T12:55:17.830Z","updated":"2026-10-16T15:04:12.871Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111396","published":"2026-10-16T12:54:50.256Z","updated":"2026-10-16T13:44:30.141Z","title":"WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111409","published":"2026-10-16T12:52:57.180Z","updated":"2026-10-19T08:14:29.318Z","title":"WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110903","published":"2026-10-16T12:51:28.928Z","updated":"2026-10-16T14:39:00.735Z","title":"WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110900","published":"2026-10-16T12:51:01.259Z","updated":"2026-10-16T14:59:30.776Z","title":"WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"BookIt","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110901","published":"2026-10-16T12:50:03.734Z","updated":"2026-10-16T14:59:30.929Z","title":"WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPMU DEV","product":"SmartCrawl","kev":false,"epss":0.0015,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110380","published":"2026-10-16T12:31:15.231Z","updated":"2026-10-16T14:59:31.070Z","title":"WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111405","published":"2026-10-16T12:30:54.361Z","updated":"2026-10-16T13:46:12.255Z","title":"WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111399","published":"2026-10-16T12:30:32.747Z","updated":"2026-10-16T14:59:31.212Z","title":"WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111397","published":"2026-10-16T12:29:35.561Z","updated":"2026-10-16T14:02:23.262Z","title":"WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94169","published":"2026-10-16T07:00:38.023Z","updated":"2026-10-16T18:38:00.753Z","title":"WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Theme-one","product":"The Grid","kev":false,"epss":0.04422,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94388","published":"2026-10-16T07:00:37.973Z","updated":"2026-10-16T15:09:36.628Z","title":"WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"halfdata","product":"Green Popups","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97296","published":"2026-10-16T07:00:37.595Z","updated":"2026-10-16T15:09:37.442Z","title":"WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Rocketgenius, Inc","product":"Gravity Forms","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96339","published":"2026-10-16T07:00:37.525Z","updated":"2026-10-16T10:36:08.361Z","title":"WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Houzez.co","product":"Houzez","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110366","published":"2026-10-16T06:54:11.866Z","updated":"2026-10-16T15:09:37.698Z","title":"WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110361","published":"2026-10-15T18:21:40.608Z","updated":"2026-10-15T20:17:18.211Z","title":"WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ClikIT","product":"Infinite Uploads","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110362","published":"2026-10-15T18:21:16.105Z","updated":"2026-10-16T15:09:41.704Z","title":"WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Planet studio","product":"PlanetStudio Payment Gateway","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109893","published":"2026-10-15T18:18:56.045Z","updated":"2026-10-16T17:12:08.141Z","title":"WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110374","published":"2026-10-15T18:18:13.194Z","updated":"2026-10-15T18:32:12.140Z","title":"WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Hamid Alinia","product":"Login with phone number","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108499","published":"2026-10-15T18:17:52.974Z","updated":"2026-10-15T20:19:57.344Z","title":"WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebberZone","product":"Knowledge Base","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110364","published":"2026-10-15T18:16:51.303Z","updated":"2026-10-15T20:39:16.095Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110375","published":"2026-10-15T18:16:25.737Z","updated":"2026-10-16T17:12:23.090Z","title":"WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Download Monitor","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109689","published":"2026-10-15T18:14:39.051Z","updated":"2026-10-15T18:33:26.965Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110360","published":"2026-10-15T18:12:23.561Z","updated":"2026-10-16T15:09:42.011Z","title":"WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPdreams","product":"Ajax Search Lite","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109897","published":"2026-10-15T18:11:34.153Z","updated":"2026-10-15T19:59:26.898Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00209,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110378","published":"2026-10-15T18:07:26.117Z","updated":"2026-10-19T09:50:41.518Z","title":"WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP E-Signature","product":"Ninja Forms Signature Contract Add-On","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96449","published":"2026-10-15T18:06:37.312Z","updated":"2026-10-16T15:09:42.195Z","title":"WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"WP EasyPay","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106604","published":"2026-10-15T18:01:28.361Z","updated":"2026-10-16T14:39:06.911Z","title":"WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Compare","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103083","published":"2026-10-15T18:00:35.463Z","updated":"2026-10-15T19:59:10.889Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108175","published":"2026-10-15T17:48:26.005Z","updated":"2026-10-15T18:01:15.407Z","title":"WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110381","published":"2026-10-15T17:48:07.069Z","updated":"2026-10-16T17:12:29.676Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103350","published":"2026-10-15T17:47:33.578Z","updated":"2026-10-15T18:24:28.555Z","title":"WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110888","published":"2026-10-15T17:46:50.254Z","updated":"2026-10-16T17:12:38.772Z","title":"WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110891","published":"2026-10-15T17:46:27.380Z","updated":"2026-10-16T15:09:42.376Z","title":"WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WordLift Srl","product":"WordLift","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110890","published":"2026-10-15T17:45:58.863Z","updated":"2026-10-15T18:24:23.069Z","title":"WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetSmartFilters","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110367","published":"2026-10-15T17:45:13.071Z","updated":"2026-10-15T18:24:51.313Z","title":"WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"APIExperts Square for WooCommerce","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110371","published":"2026-10-15T17:43:50.465Z","updated":"2026-10-15T17:59:43.855Z","title":"WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105065","published":"2026-10-15T17:00:15.222Z","updated":"2026-10-16T14:39:07.063Z","title":"WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"8theme.com","product":"XStore","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109686","published":"2026-10-15T13:00:24.207Z","updated":"2026-10-15T15:16:30.523Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109685","published":"2026-10-15T13:00:23.963Z","updated":"2026-10-16T14:39:07.227Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109892","published":"2026-10-15T13:00:23.774Z","updated":"2026-10-15T13:18:44.529Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102389","published":"2026-10-15T13:00:23.730Z","updated":"2026-10-15T16:41:33.903Z","title":"WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Broken Link Checker","kev":false,"epss":0.0021,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105882","published":"2026-10-15T13:00:23.484Z","updated":"2026-10-15T15:03:59.807Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109688","published":"2026-10-15T13:00:23.246Z","updated":"2026-10-15T14:36:49.884Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107416","published":"2026-10-15T13:00:23.199Z","updated":"2026-10-15T13:19:10.932Z","title":"WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Webba Plugins","product":"Webba Booking","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109702","published":"2026-10-15T13:00:23.016Z","updated":"2026-10-15T15:04:14.692Z","title":"WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maxfoundry","product":"Social Share Buttons","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109698","published":"2026-10-15T12:09:05.215Z","updated":"2026-10-15T13:09:25.240Z","title":"WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109692","published":"2026-10-15T12:09:05.084Z","updated":"2026-10-15T13:14:03.798Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109693","published":"2026-10-15T12:09:04.952Z","updated":"2026-10-16T15:09:42.546Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109695","published":"2026-10-15T11:00:13.931Z","updated":"2026-10-15T15:04:25.338Z","title":"WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPManageNinja","product":"FluentCart","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109694","published":"2026-10-15T11:00:13.754Z","updated":"2026-10-15T14:37:51.972Z","title":"WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WP ManageNinja LLC","product":"Fluent CRM","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108491","published":"2026-10-15T11:00:13.399Z","updated":"2026-10-15T13:15:53.077Z","title":"WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108497","published":"2026-10-15T11:00:13.368Z","updated":"2026-10-16T15:09:42.704Z","title":"WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108498","published":"2026-10-15T11:00:13.206Z","updated":"2026-10-15T13:14:06.252Z","title":"WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bannersky","product":"BSK PDF Manager","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108480","published":"2026-10-14T18:09:35.829Z","updated":"2026-10-15T16:43:45.485Z","title":"WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"Skydropx","product":"Skydropx","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108484","published":"2026-10-14T18:09:35.659Z","updated":"2026-10-15T16:43:45.622Z","title":"WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Best Payments Plugin for WP","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108483","published":"2026-10-14T18:09:35.358Z","updated":"2026-10-16T18:42:02.176Z","title":"WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"hippooo","product":"Hippoo Mobile App for WooCommerce","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105066","published":"2026-10-14T18:09:35.203Z","updated":"2026-10-14T19:36:41.666Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SimplyRETS","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108151","published":"2026-10-14T18:09:34.882Z","updated":"2026-10-15T16:43:45.890Z","title":"WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"MDTF","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103081","published":"2026-10-14T18:09:34.742Z","updated":"2026-10-15T16:43:46.026Z","title":"WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107870","published":"2026-10-14T14:00:14.386Z","updated":"2026-10-15T16:43:47.159Z","title":"WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107417","published":"2026-10-14T13:00:15.564Z","updated":"2026-10-15T16:43:47.561Z","title":"WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Muralidharan Ramasamy","product":"Push Notification for Post and BuddyPress","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107426","published":"2026-10-14T13:00:15.455Z","updated":"2026-10-14T17:35:50.918Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00258,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108291","published":"2026-10-14T12:08:28.433Z","updated":"2026-10-15T16:43:47.695Z","title":"WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"itthinx","product":"Affiliates","kev":false,"epss":0.00444,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107425","published":"2026-10-14T12:08:28.323Z","updated":"2026-10-15T16:43:47.872Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00262,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107867","published":"2026-10-14T12:08:28.020Z","updated":"2026-10-15T16:43:48.028Z","title":"WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetProductTables","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107421","published":"2026-10-14T12:08:27.906Z","updated":"2026-10-15T16:43:48.193Z","title":"WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability","severity":"HIGH","score":7.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107424","published":"2026-10-14T12:08:27.612Z","updated":"2026-10-14T14:01:21.121Z","title":"WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"M A Vinoth Kumar","product":"Frontend Dashboard","kev":false,"epss":0.0038,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107422","published":"2026-10-14T12:08:27.530Z","updated":"2026-10-15T15:08:38.427Z","title":"WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"axew3.com","product":"WP w3all phpBB","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105874","published":"2026-10-14T12:08:27.142Z","updated":"2026-10-15T16:43:48.332Z","title":"WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106599","published":"2026-10-14T12:08:27.048Z","updated":"2026-10-14T17:32:25.261Z","title":"WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97278","published":"2026-10-14T12:08:26.651Z","updated":"2026-10-14T14:00:58.678Z","title":"WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00425,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107433","published":"2026-10-14T12:08:26.612Z","updated":"2026-10-14T17:29:24.440Z","title":"WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"miniOrange","product":"WP OAuth Server","kev":false,"epss":0.00269,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105067","published":"2026-10-14T11:00:11.690Z","updated":"2026-10-15T15:08:44.603Z","title":"WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Webnus","product":"Modern Events Calendar Lite","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103358","published":"2026-10-14T11:00:11.345Z","updated":"2026-10-15T16:43:48.459Z","title":"WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Email Template Customizer for WooCommerce","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107431","published":"2026-10-14T11:00:11.329Z","updated":"2026-10-14T14:07:43.610Z","title":"WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107428","published":"2026-10-14T08:00:25.216Z","updated":"2026-10-14T11:29:08.950Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-110227","published":"2026-10-14T07:11:41.657Z","updated":"2026-10-15T16:43:49.599Z","title":"WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"10up","product":"Restricted Site Access","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109901","published":"2026-10-14T07:11:16.010Z","updated":"2026-10-14T15:56:23.123Z","title":"WordPress CP Multi View Event Calendar  plugin <= 1.4.41 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Codepeople","product":"CP Multi View Event Calendar","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109898","published":"2026-10-13T16:23:02.114Z","updated":"2026-10-15T16:43:51.594Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109896","published":"2026-10-13T16:22:06.720Z","updated":"2026-10-15T16:43:51.727Z","title":"WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Chill","product":"Download Monitor integration for WooCommerce","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109890","published":"2026-10-13T16:21:41.444Z","updated":"2026-10-14T15:25:49.121Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109699","published":"2026-10-13T08:53:05.371Z","updated":"2026-10-13T12:07:52.426Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00165,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108487","published":"2026-10-13T08:51:33.492Z","updated":"2026-10-13T12:07:52.552Z","title":"WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hossni Mubarak","product":"Books Gallery","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106598","published":"2026-10-13T08:49:45.050Z","updated":"2026-10-13T12:07:52.660Z","title":"WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109687","published":"2026-10-13T08:49:07.664Z","updated":"2026-10-13T12:07:52.773Z","title":"WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Link Whisper INC","product":"Link Whisper Free","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105881","published":"2026-10-13T08:45:21.284Z","updated":"2026-10-13T12:07:52.911Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108179","published":"2026-10-13T08:44:24.127Z","updated":"2026-10-13T12:07:53.047Z","title":"WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PluginUs.Net","product":"WOLF","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108489","published":"2026-10-13T08:43:51.589Z","updated":"2026-10-13T12:07:53.195Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.002,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103076","published":"2026-10-13T08:43:07.734Z","updated":"2026-10-13T12:07:53.347Z","title":"WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00101,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108174","published":"2026-10-13T08:42:35.004Z","updated":"2026-10-13T12:07:53.461Z","title":"WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106597","published":"2026-10-13T08:42:04.867Z","updated":"2026-10-13T12:07:53.621Z","title":"WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109697","published":"2026-10-13T08:41:17.199Z","updated":"2026-10-30T20:04:49.375Z","title":"WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109691","published":"2026-10-13T08:39:18.284Z","updated":"2026-10-13T12:07:53.947Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108488","published":"2026-10-13T08:38:44.619Z","updated":"2026-10-13T12:07:54.071Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109696","published":"2026-10-13T08:36:20.364Z","updated":"2026-10-13T12:07:54.186Z","title":"WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":0.00144,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108490","published":"2026-10-13T08:35:52.144Z","updated":"2026-10-13T12:07:54.303Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109684","published":"2026-10-13T08:34:34.941Z","updated":"2026-10-13T12:07:54.433Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108496","published":"2026-10-13T08:33:20.679Z","updated":"2026-10-21T10:21:15.616Z","title":"WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108493","published":"2026-10-13T08:32:30.517Z","updated":"2026-10-13T12:07:54.689Z","title":"WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Karolína Vyskočilová","product":"Pay for Payment for WooCommerce","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108495","published":"2026-10-13T08:30:25.869Z","updated":"2026-10-13T12:07:54.820Z","title":"WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00135,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108492","published":"2026-10-13T08:29:26.631Z","updated":"2026-10-19T08:14:59.464Z","title":"WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Fullworks Plugins","product":"Quick Paypal Payments","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109703","published":"2026-10-13T07:32:54.095Z","updated":"2026-10-13T12:07:55.100Z","title":"WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGraphQL","product":"WPGraphQL","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54867","published":"2026-10-13T05:51:18.751Z","updated":"2026-10-13T12:07:55.225Z","title":"WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Griden","product":"Responsive Slider","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54868","published":"2026-10-13T05:50:34.068Z","updated":"2026-10-13T12:07:55.346Z","title":"WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Simpler SEO","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54869","published":"2026-10-13T05:49:47.849Z","updated":"2026-10-13T12:07:55.494Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54870","published":"2026-10-13T05:48:07.438Z","updated":"2026-10-13T12:07:55.615Z","title":"WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpweaver","product":"Weaver Xtreme Theme Support","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61994","published":"2026-10-12T17:51:32.988Z","updated":"2026-10-12T22:53:59.531Z","title":"WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"RocketGeek","product":"WP-Members","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42689","published":"2026-10-12T17:47:51.774Z","updated":"2026-10-12T22:53:59.670Z","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00151,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108479","published":"2026-10-12T17:34:29.483Z","updated":"2026-10-12T22:53:59.811Z","title":"WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00128,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108481","published":"2026-10-12T17:33:28.910Z","updated":"2026-10-12T22:53:59.945Z","title":"WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.4,"vendor":"Patreon","product":"Patreon WordPress","kev":false,"epss":0.00116,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103080","published":"2026-10-12T17:32:51.719Z","updated":"2026-10-12T22:54:00.096Z","title":"WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Salevo","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108482","published":"2026-10-12T17:14:08.317Z","updated":"2026-10-12T22:54:00.236Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107862","published":"2026-10-12T17:13:40.320Z","updated":"2026-10-12T22:54:00.380Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108486","published":"2026-10-12T17:13:17.372Z","updated":"2026-10-12T22:54:00.527Z","title":"WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107418","published":"2026-10-12T17:12:33.445Z","updated":"2026-10-12T22:54:00.660Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108478","published":"2026-10-12T17:11:55.879Z","updated":"2026-10-12T22:54:00.791Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108475","published":"2026-10-12T17:09:53.457Z","updated":"2026-10-12T22:54:00.913Z","title":"WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108476","published":"2026-10-12T17:09:22.796Z","updated":"2026-10-12T22:54:01.038Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108477","published":"2026-10-12T16:32:19.815Z","updated":"2026-10-12T22:54:01.160Z","title":"WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107864","published":"2026-10-12T09:05:53.751Z","updated":"2026-10-12T11:40:33.566Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":0.00129,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107865","published":"2026-10-12T09:03:11.930Z","updated":"2026-10-12T11:40:33.699Z","title":"WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetMenu","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107866","published":"2026-10-12T09:00:06.057Z","updated":"2026-10-12T11:40:33.826Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107423","published":"2026-10-12T08:26:10.250Z","updated":"2026-10-12T11:40:33.963Z","title":"WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107869","published":"2026-10-12T08:25:47.632Z","updated":"2026-10-12T11:40:34.088Z","title":"WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Flexible Subscriptions","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107863","published":"2026-10-12T08:24:45.942Z","updated":"2026-10-19T07:34:27.782Z","title":"WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Codection","product":"Products Restricted Users for WooCommerce","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108168","published":"2026-10-12T08:22:50.917Z","updated":"2026-10-12T11:40:34.371Z","title":"WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"DLX Plugins","product":"Custom Query Blocks","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2023-25996","published":"2026-10-12T08:15:39.939Z","updated":"2026-10-12T11:40:34.485Z","title":"WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Pluggabl LLC.","product":"Booster Elite for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107432","published":"2026-10-12T07:47:11.169Z","updated":"2026-10-12T11:40:34.601Z","title":"WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103356","published":"2026-10-12T07:45:51.286Z","updated":"2026-10-12T11:40:34.720Z","title":"WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VillaTheme","product":"TMDS","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107430","published":"2026-10-12T07:45:32.370Z","updated":"2026-10-12T11:40:34.840Z","title":"WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VideoWhisper.com","product":"VideoWhisper Site Manager for ChatGPT, Claude, Codex","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107429","published":"2026-10-12T07:44:56.102Z","updated":"2026-10-12T11:40:34.968Z","title":"WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VideoWhisper.com","product":"Paid Videochat Turnkey Site","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107427","published":"2026-10-12T07:44:34.562Z","updated":"2026-10-12T11:40:35.088Z","title":"WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106605","published":"2026-10-12T07:44:09.895Z","updated":"2026-10-12T11:40:35.215Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103685","published":"2026-10-10T19:55:52.636Z","updated":"2026-10-11T12:13:33.093Z","title":"WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27350","published":"2026-10-10T19:44:36.929Z","updated":"2026-10-11T11:42:57.301Z","title":"WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Builderius.io","product":"Builderius","kev":false,"epss":0.00155,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66480","published":"2026-10-10T19:42:40.322Z","updated":"2026-10-11T11:40:27.998Z","title":"WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Add-Ons","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57742","published":"2026-10-10T19:40:34.607Z","updated":"2026-10-11T11:42:54.152Z","title":"WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX Group","product":"Kids Planet","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107434","published":"2026-10-10T19:36:24.555Z","updated":"2026-10-11T12:13:33.222Z","title":"WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.4,"vendor":"videowhisper","product":"MicroPayments","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107420","published":"2026-10-10T19:36:23.815Z","updated":"2026-10-11T12:13:33.358Z","title":"WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Narinder Singh","product":"Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway","kev":false,"epss":0.00124,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81797","published":"2026-10-10T19:36:20.181Z","updated":"2026-10-11T11:47:06.948Z","title":"WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78535","published":"2026-10-10T19:36:19.431Z","updated":"2026-10-11T11:53:08.903Z","title":"WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"Photolia","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78534","published":"2026-10-10T19:36:18.684Z","updated":"2026-10-11T11:42:57.594Z","title":"WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Keen IT Solutions","product":"Educavo","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78533","published":"2026-10-10T19:36:17.936Z","updated":"2026-10-11T11:53:09.041Z","title":"WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Qwery","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78532","published":"2026-10-10T19:36:17.241Z","updated":"2026-10-11T11:42:57.727Z","title":"WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"designthemes","product":"LMS","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78531","published":"2026-10-10T19:36:16.484Z","updated":"2026-10-11T11:53:09.192Z","title":"WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Jacqueline","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78530","published":"2026-10-10T19:36:15.786Z","updated":"2026-10-11T12:13:33.478Z","title":"WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"Chimpstudio","product":"FoodBakery","kev":false,"epss":0.00393,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78529","published":"2026-10-10T19:36:15.048Z","updated":"2026-10-11T11:53:09.311Z","title":"WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Alliance","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66569","published":"2026-10-10T19:36:14.295Z","updated":"2026-10-11T11:53:09.437Z","title":"WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Kicker","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66568","published":"2026-10-10T19:36:13.592Z","updated":"2026-10-11T11:53:09.567Z","title":"WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"Original","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66567","published":"2026-10-10T19:36:12.850Z","updated":"2026-10-11T11:53:09.687Z","title":"WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Anesta","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66566","published":"2026-10-10T19:36:12.066Z","updated":"2026-10-11T11:53:06.480Z","title":"WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Ambient","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66565","published":"2026-10-10T19:36:11.322Z","updated":"2026-10-11T11:53:09.804Z","title":"WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"axiomthemes","product":"FC United","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66564","published":"2026-10-10T19:36:10.604Z","updated":"2026-10-11T11:53:09.938Z","title":"WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"ShiftCV","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66563","published":"2026-10-10T19:36:09.853Z","updated":"2026-10-11T11:53:10.057Z","title":"WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Windsor","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66483","published":"2026-10-10T19:36:09.122Z","updated":"2026-10-11T11:53:10.197Z","title":"WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66482","published":"2026-10-10T19:36:08.416Z","updated":"2026-10-11T11:53:10.333Z","title":"WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"Drone Media","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66481","published":"2026-10-10T19:36:07.665Z","updated":"2026-10-11T12:13:33.600Z","title":"WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Presto Player","product":"Presto Player Pro","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65459","published":"2026-10-10T19:36:06.909Z","updated":"2026-10-11T12:13:33.722Z","title":"WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62130","published":"2026-10-10T19:36:06.188Z","updated":"2026-10-11T12:13:33.844Z","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Amir Helzer","product":"WooCommerce Multilingual & Multicurrency","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62129","published":"2026-10-10T19:36:05.441Z","updated":"2026-10-11T12:13:33.961Z","title":"WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62125","published":"2026-10-10T19:36:04.679Z","updated":"2026-10-11T11:53:10.453Z","title":"WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Asia Garden","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62124","published":"2026-10-10T19:36:03.928Z","updated":"2026-10-11T11:53:10.566Z","title":"WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"N7 | Golf Club Sports & Events","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62123","published":"2026-10-10T19:36:03.180Z","updated":"2026-10-11T11:53:10.683Z","title":"WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Invetex","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62120","published":"2026-10-10T19:36:02.422Z","updated":"2026-10-11T11:53:10.812Z","title":"WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Law Office","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62118","published":"2026-10-10T19:36:01.668Z","updated":"2026-10-11T12:13:34.084Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62117","published":"2026-10-10T19:36:00.956Z","updated":"2026-10-11T12:03:19.855Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62116","published":"2026-10-10T19:35:59.761Z","updated":"2026-10-11T11:42:57.844Z","title":"WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dmitry V.","product":"Barcode Scanner with Inventory & Order Manager","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62115","published":"2026-10-10T19:35:58.997Z","updated":"2026-10-11T11:53:06.600Z","title":"WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62100","published":"2026-10-10T19:35:58.260Z","updated":"2026-10-11T11:42:57.978Z","title":"WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"KuteShop","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62099","published":"2026-10-10T19:35:57.377Z","updated":"2026-10-11T11:53:06.723Z","title":"WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62098","published":"2026-10-10T19:35:56.621Z","updated":"2026-10-11T12:13:34.271Z","title":"WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kutethemes","product":"Boutique","kev":false,"epss":0.00199,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62096","published":"2026-10-10T19:35:55.878Z","updated":"2026-10-11T11:53:06.836Z","title":"WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62095","published":"2026-10-10T19:35:55.124Z","updated":"2026-10-11T11:42:58.099Z","title":"WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Biolife","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62094","published":"2026-10-10T19:35:54.377Z","updated":"2026-10-11T11:53:06.957Z","title":"WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62093","published":"2026-10-10T19:35:53.628Z","updated":"2026-10-11T11:42:58.242Z","title":"WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"TechOne","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62092","published":"2026-10-10T19:35:52.885Z","updated":"2026-10-11T11:53:07.072Z","title":"WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62091","published":"2026-10-10T19:35:52.151Z","updated":"2026-10-11T11:42:58.368Z","title":"WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"kutethemes","product":"Armania","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62090","published":"2026-10-10T19:35:51.406Z","updated":"2026-10-11T11:53:10.946Z","title":"WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"WineShop","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62087","published":"2026-10-10T19:35:50.660Z","updated":"2026-10-11T11:53:11.062Z","title":"WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Equadio","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62086","published":"2026-10-10T19:35:49.927Z","updated":"2026-10-11T11:53:11.187Z","title":"WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Juno","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62082","published":"2026-10-10T19:35:49.222Z","updated":"2026-10-11T11:42:58.500Z","title":"WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"An-Themes","product":"Pin WP","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62077","published":"2026-10-10T19:35:48.485Z","updated":"2026-10-11T11:53:11.303Z","title":"WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"BoldThemes","product":"Avala","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62076","published":"2026-10-10T19:35:47.777Z","updated":"2026-10-11T11:53:11.425Z","title":"WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"The4","product":"Kalles","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62075","published":"2026-10-10T19:35:47.010Z","updated":"2026-10-11T11:53:07.199Z","title":"WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mymoun","product":"Backhoe","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62074","published":"2026-10-10T19:35:46.304Z","updated":"2026-10-11T11:53:07.312Z","title":"WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"ThemeREX","product":"Ozeum","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62070","published":"2026-10-10T19:35:45.567Z","updated":"2026-10-11T11:53:07.428Z","title":"WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CKThemes","product":"Flipmart","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62069","published":"2026-10-10T19:35:44.815Z","updated":"2026-10-11T11:53:07.538Z","title":"WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Fabius","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62068","published":"2026-10-10T19:35:44.070Z","updated":"2026-10-11T11:53:07.654Z","title":"WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Teoro","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62067","published":"2026-10-10T19:35:43.329Z","updated":"2026-10-11T11:53:07.770Z","title":"WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Kaven","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62066","published":"2026-10-10T19:35:42.575Z","updated":"2026-10-11T11:53:07.887Z","title":"WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Volos","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62065","published":"2026-10-10T19:35:41.822Z","updated":"2026-10-11T11:53:08.012Z","title":"WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"CocoBasic","product":"Cardea","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62064","published":"2026-10-10T19:35:41.077Z","updated":"2026-10-11T11:42:58.736Z","title":"WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ambed","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62054","published":"2026-10-10T19:35:40.282Z","updated":"2026-10-11T11:53:11.542Z","title":"WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Yacht Rental","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62053","published":"2026-10-10T19:35:39.525Z","updated":"2026-10-11T11:53:11.661Z","title":"WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Wine House","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62052","published":"2026-10-10T19:35:38.667Z","updated":"2026-10-11T11:53:11.771Z","title":"WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Tipsy","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62051","published":"2026-10-10T19:35:37.951Z","updated":"2026-10-11T11:53:11.895Z","title":"WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Stargaze","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62050","published":"2026-10-10T19:35:37.198Z","updated":"2026-10-11T11:53:12.013Z","title":"WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX","product":"Splendour","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62043","published":"2026-10-10T19:35:36.442Z","updated":"2026-10-11T12:03:21.565Z","title":"WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"sevenspark","product":"Contact Form 7 – Dynamic Text Extension","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62038","published":"2026-10-10T19:35:35.694Z","updated":"2026-10-11T12:13:34.392Z","title":"WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"DigitalME","product":"eRoom","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62037","published":"2026-10-10T19:35:34.938Z","updated":"2026-10-11T11:42:58.866Z","title":"WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Document Embedder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62035","published":"2026-10-10T19:35:34.192Z","updated":"2026-10-11T12:13:34.513Z","title":"WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"upcasted","product":"AWS S3 for WordPress Plugin – Upcasted","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62034","published":"2026-10-10T19:35:33.484Z","updated":"2026-10-11T11:42:59.001Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62033","published":"2026-10-10T19:35:32.726Z","updated":"2026-10-11T12:13:34.635Z","title":"WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00297,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62032","published":"2026-10-10T19:35:31.972Z","updated":"2026-11-07T07:22:25.682Z","title":"WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Designinvento","product":"DirectoryPress","kev":false,"epss":0.00404,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62031","published":"2026-10-10T19:35:31.204Z","updated":"2026-10-11T12:03:19.985Z","title":"WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Stylemix","product":"uListing","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62030","published":"2026-10-10T19:35:30.447Z","updated":"2026-10-11T11:42:57.453Z","title":"WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"StreamCast","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62027","published":"2026-10-10T19:35:29.582Z","updated":"2026-10-11T11:42:59.155Z","title":"WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Team Section Block","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62025","published":"2026-10-10T19:35:28.815Z","updated":"2026-10-11T12:13:34.756Z","title":"WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62024","published":"2026-10-10T19:35:28.051Z","updated":"2026-10-11T12:13:34.867Z","title":"WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"CodeBard","product":"CodeBard Help Desk","kev":false,"epss":0.00434,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62022","published":"2026-10-10T19:35:27.261Z","updated":"2026-10-11T12:13:34.985Z","title":"WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Select-Themes","product":"Tonda Membership","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62021","published":"2026-10-10T19:35:26.468Z","updated":"2026-10-11T12:13:35.107Z","title":"WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rascals","product":"Angio","kev":false,"epss":0.00468,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62020","published":"2026-10-10T19:35:25.680Z","updated":"2026-10-11T11:53:08.144Z","title":"WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"TouchUp","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48194","published":"2026-10-10T19:35:24.166Z","updated":"2026-10-11T11:53:08.274Z","title":"WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"DukaMarket","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48193","published":"2026-10-10T19:35:23.448Z","updated":"2026-10-11T11:53:08.402Z","title":"WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"kutethemes","product":"Uminex","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-45440","published":"2026-10-10T19:35:22.690Z","updated":"2026-10-11T12:03:20.105Z","title":"WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Smackcoders Inc.","product":"WP Ultimate CSV Importer","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42777","published":"2026-10-10T19:35:21.931Z","updated":"2026-10-11T11:53:08.533Z","title":"WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Aalto","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42724","published":"2026-10-10T19:35:21.169Z","updated":"2026-10-11T11:53:08.651Z","title":"WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42723","published":"2026-10-10T19:35:20.422Z","updated":"2026-10-11T11:53:12.158Z","title":"WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AncoraThemes","product":"CleanSkin","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42722","published":"2026-10-10T19:35:19.708Z","updated":"2026-10-11T12:03:20.221Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42719","published":"2026-10-10T19:35:18.996Z","updated":"2026-10-11T12:13:35.224Z","title":"WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.0051,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42718","published":"2026-10-10T19:35:18.277Z","updated":"2026-10-11T11:53:12.284Z","title":"WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Pluggabl","product":"Booster for WooCommerce","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42717","published":"2026-10-10T19:35:17.515Z","updated":"2026-10-11T12:03:20.341Z","title":"WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42716","published":"2026-10-10T19:35:16.768Z","updated":"2026-10-11T11:53:12.414Z","title":"WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"payever","product":"Payever - WooCommerce Gateway","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42715","published":"2026-10-10T19:35:16.054Z","updated":"2026-10-11T11:42:59.293Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42712","published":"2026-10-10T19:35:15.340Z","updated":"2026-10-11T12:03:20.465Z","title":"WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"QODE","product":"Qode Tours","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42711","published":"2026-10-10T19:35:14.606Z","updated":"2026-10-11T11:42:59.426Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42709","published":"2026-10-10T19:35:13.809Z","updated":"2026-10-11T11:42:59.539Z","title":"WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Food Menu – Restaurant Menu & Online Ordering for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42706","published":"2026-10-10T19:35:13.010Z","updated":"2026-10-11T12:13:35.348Z","title":"WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"DK","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42705","published":"2026-10-10T19:35:12.244Z","updated":"2026-10-11T12:13:35.480Z","title":"WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeGoods","product":"Grand News","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42704","published":"2026-10-10T19:35:11.485Z","updated":"2026-10-11T11:53:08.769Z","title":"WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"axiomthemes","product":"Kids Care","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42702","published":"2026-10-10T19:35:10.741Z","updated":"2026-10-13T16:32:55.073Z","title":"WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42699","published":"2026-10-10T19:35:10.023Z","updated":"2026-10-11T11:42:59.770Z","title":"WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"FV Player 8","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42697","published":"2026-10-10T19:35:09.276Z","updated":"2026-10-13T06:13:04.166Z","title":"WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Inisev","product":"Social Share Icons & Social Share Buttons","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42696","published":"2026-10-10T19:35:08.522Z","updated":"2026-10-13T06:13:18.105Z","title":"WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42693","published":"2026-10-10T19:35:07.750Z","updated":"2026-10-29T12:08:20.728Z","title":"WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TieLabs","product":"Jannah","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42633","published":"2026-10-10T19:35:07.003Z","updated":"2026-10-11T12:03:20.589Z","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Marcus","product":"Events Manager","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42632","published":"2026-10-10T19:35:06.270Z","updated":"2026-10-11T11:43:00.299Z","title":"WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Real Estate","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42631","published":"2026-10-10T19:35:05.518Z","updated":"2026-10-11T11:43:00.412Z","title":"WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"QODE","product":"Qode Music","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42630","published":"2026-10-10T19:35:04.739Z","updated":"2026-10-11T12:03:21.321Z","title":"WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Plura","product":"Web Plura Backup &amp; Restore Manager","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42419","published":"2026-10-10T19:35:03.982Z","updated":"2026-10-11T12:03:21.445Z","title":"WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"SwishFolio","product":"Swish Migrate and Backup","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40808","published":"2026-10-10T19:35:03.250Z","updated":"2026-10-11T12:13:35.708Z","title":"WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Automattic","product":"Jetpack VideoPress","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40805","published":"2026-10-10T19:35:02.525Z","updated":"2026-10-11T12:13:35.834Z","title":"WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"PeepSo","product":"PeepSo","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40803","published":"2026-10-10T19:35:01.775Z","updated":"2026-10-11T11:43:00.531Z","title":"WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jotform","product":"Jotform &#8211; AI Chatbot","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40802","published":"2026-10-10T19:35:01.019Z","updated":"2026-11-06T07:17:26.310Z","title":"WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability","severity":"HIGH","score":7.6,"vendor":"pubjet","product":"Pubjet | پاب‌جت","kev":false,"epss":0.00292,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40801","published":"2026-10-10T19:35:00.257Z","updated":"2026-10-11T12:13:36.097Z","title":"WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Wordable","product":"Wordable","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40800","published":"2026-10-10T19:34:59.496Z","updated":"2026-10-11T12:03:20.711Z","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ELEXtensions","product":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40777","published":"2026-10-10T19:34:58.723Z","updated":"2026-10-11T12:13:36.220Z","title":"WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Rashid","product":"WPSection","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39802","published":"2026-10-10T19:34:57.947Z","updated":"2026-10-11T12:13:36.342Z","title":"WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.1,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.00448,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39801","published":"2026-10-10T19:34:57.214Z","updated":"2026-10-11T12:13:36.457Z","title":"WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Sergey","product":"AIWU","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39800","published":"2026-10-10T19:34:56.435Z","updated":"2026-10-11T11:43:00.654Z","title":"WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Anton Bond","product":"Additional Order Filters for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39799","published":"2026-10-10T19:34:55.718Z","updated":"2026-10-11T11:43:00.768Z","title":"WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Joomunited","product":"WP File Download","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94590","published":"2026-10-10T18:45:45.857Z","updated":"2026-10-11T12:13:36.569Z","title":"WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodePeople2","product":"Sell Downloads","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57806","published":"2026-10-10T18:44:38.221Z","updated":"2026-10-11T11:42:54.287Z","title":"WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"drfuri","product":"Martfury - WooCommerce Marketplace WordPress Theme","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106610","published":"2026-10-10T18:09:06.421Z","updated":"2026-10-11T12:13:36.684Z","title":"WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00399,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96341","published":"2026-10-10T18:09:06.215Z","updated":"2026-10-11T12:13:42.585Z","title":"WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.2,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00269,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105892","published":"2026-10-10T18:09:05.758Z","updated":"2026-10-11T12:13:42.710Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.0041,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105889","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:03:20.837Z","title":"WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104398","published":"2026-10-10T17:00:10.991Z","updated":"2026-10-11T12:13:42.842Z","title":"WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"VillaTheme","product":"AFFI – Affiliate Marketing for WooCommerce","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103071","published":"2026-10-10T17:00:10.567Z","updated":"2026-10-11T12:13:36.805Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103357","published":"2026-10-10T17:00:10.501Z","updated":"2026-10-11T12:13:36.927Z","title":"WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.9,"vendor":"VillaTheme","product":"GIFT4U","kev":false,"epss":0.00262,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106608","published":"2026-10-10T17:00:10.174Z","updated":"2026-10-11T12:13:37.058Z","title":"WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106609","published":"2026-10-10T17:00:10.072Z","updated":"2026-10-11T12:13:37.201Z","title":"WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Web Impian","product":"Bayarcash WooCommerce","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94160","published":"2026-10-10T17:00:09.779Z","updated":"2026-10-11T11:42:54.432Z","title":"WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themeStek","product":"ThemeStek Extras for LabtechCO Theme","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62044","published":"2026-10-10T17:00:09.638Z","updated":"2026-10-11T12:13:37.319Z","title":"WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"bPlugins","product":"Super Video Player","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66435","published":"2026-10-10T14:00:13.260Z","updated":"2026-10-11T12:13:37.438Z","title":"WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Devin Walker","product":"WP Rollback","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97264","published":"2026-10-10T14:00:13.151Z","updated":"2026-10-11T11:42:54.561Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97263","published":"2026-10-10T14:00:12.696Z","updated":"2026-10-11T11:42:54.692Z","title":"WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94676","published":"2026-10-10T14:00:12.587Z","updated":"2026-10-11T12:13:37.549Z","title":"WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Tainacan Community","product":"Tainacan","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105885","published":"2026-10-10T14:00:10.868Z","updated":"2026-10-11T12:13:38.290Z","title":"WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102388","published":"2026-10-10T14:00:10.087Z","updated":"2026-10-11T11:42:54.822Z","title":"WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93951","published":"2026-10-10T08:00:09.334Z","updated":"2026-10-11T11:42:54.945Z","title":"WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Zeinet","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62045","published":"2026-10-10T07:00:39.141Z","updated":"2026-10-11T12:13:38.417Z","title":"WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Booklovers","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62046","published":"2026-10-10T07:00:38.957Z","updated":"2026-10-11T12:13:38.529Z","title":"WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Gutentype","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93945","published":"2026-10-10T07:00:38.671Z","updated":"2026-10-11T12:13:42.978Z","title":"WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Balance","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93944","published":"2026-10-10T07:00:38.483Z","updated":"2026-10-11T12:13:43.101Z","title":"WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Camelia","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93943","published":"2026-10-10T07:00:38.253Z","updated":"2026-10-11T12:13:38.647Z","title":"WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Convex","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93942","published":"2026-10-10T07:00:38.027Z","updated":"2026-10-11T12:13:38.769Z","title":"WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Dwell","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93941","published":"2026-10-10T07:00:37.796Z","updated":"2026-10-11T12:13:38.936Z","title":"WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Edema","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93940","published":"2026-10-10T07:00:37.570Z","updated":"2026-10-11T12:13:39.061Z","title":"WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Greeny","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93938","published":"2026-10-10T07:00:37.342Z","updated":"2026-10-11T12:13:39.189Z","title":"WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hogwords","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93937","published":"2026-10-10T07:00:37.101Z","updated":"2026-10-11T12:13:39.314Z","title":"WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Hygia","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93936","published":"2026-10-10T07:00:36.862Z","updated":"2026-10-11T12:13:39.432Z","title":"WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"IPharm","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93935","published":"2026-10-10T07:00:36.635Z","updated":"2026-10-11T12:13:39.559Z","title":"WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Let's Play","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93934","published":"2026-10-10T07:00:36.397Z","updated":"2026-10-11T12:13:39.683Z","title":"WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Partiso","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93933","published":"2026-10-10T07:00:35.938Z","updated":"2026-10-11T12:13:39.804Z","title":"WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Rosalinda","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93932","published":"2026-10-10T07:00:35.688Z","updated":"2026-10-11T12:13:39.922Z","title":"WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smart Casa","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93931","published":"2026-10-10T07:00:35.434Z","updated":"2026-10-11T12:13:40.048Z","title":"WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Smash","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93930","published":"2026-10-10T07:00:35.196Z","updated":"2026-10-11T12:13:40.173Z","title":"WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Tantra","kev":false,"epss":0.00304,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93929","published":"2026-10-10T07:00:34.898Z","updated":"2026-10-11T12:13:40.386Z","title":"WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeREX Group","product":"Travesia","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93927","published":"2026-10-10T07:00:34.675Z","updated":"2026-10-11T12:13:40.518Z","title":"WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Axiomthemes","product":"Veto","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93950","published":"2026-10-10T07:00:34.389Z","updated":"2026-10-11T12:13:40.643Z","title":"WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93949","published":"2026-10-10T07:00:34.180Z","updated":"2026-10-11T12:13:40.757Z","title":"WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"Omegathemes","product":"Grocery Shopping Store","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106606","published":"2026-10-10T07:00:33.921Z","updated":"2026-10-11T12:13:40.905Z","title":"WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"YITH","product":"YITH WooCommerce Affiliates","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42695","published":"2026-10-09T16:51:45.133Z","updated":"2026-10-11T11:42:55.084Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94067","published":"2026-10-09T14:00:10.842Z","updated":"2026-10-09T20:00:14.448Z","title":"WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"The Voux","kev":false,"epss":0.00327,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94066","published":"2026-10-09T14:00:10.562Z","updated":"2026-10-09T17:30:30.300Z","title":"WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SpabRice","product":"Pond","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94063","published":"2026-10-09T14:00:10.469Z","updated":"2026-10-09T15:09:20.784Z","title":"WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeREX","product":"Education Center","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94065","published":"2026-10-09T14:00:10.127Z","updated":"2026-10-11T12:13:41.024Z","title":"WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"ColorFolio","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94064","published":"2026-10-09T14:00:10.022Z","updated":"2026-10-11T12:13:41.160Z","title":"WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"BuddhaThemes","product":"Neo | Barber Shop WordPress Theme","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62026","published":"2026-10-09T13:15:27.207Z","updated":"2026-10-09T19:55:18.178Z","title":"WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"MIGHTYminnow","product":"Dashboard Notes","kev":false,"epss":0.00089,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94062","published":"2026-10-09T13:00:16.921Z","updated":"2026-10-09T17:43:13.501Z","title":"WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Fuelthemes","product":"Werkstatt","kev":false,"epss":0.00334,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94061","published":"2026-10-09T13:00:16.730Z","updated":"2026-10-11T11:42:55.234Z","title":"WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Designthemes","product":"Whistle - Sports Club","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94060","published":"2026-10-09T13:00:16.560Z","updated":"2026-10-11T11:42:55.373Z","title":"WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Voldor","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94059","published":"2026-10-09T13:00:16.346Z","updated":"2026-10-09T15:09:41.245Z","title":"WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Ogency","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94058","published":"2026-10-09T13:00:16.159Z","updated":"2026-10-09T19:56:25.807Z","title":"WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bracketweb","product":"Treck","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62028","published":"2026-10-09T12:14:54.653Z","updated":"2026-10-11T12:13:41.276Z","title":"WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"bPlugins","product":"Before After Image Comparison – Image comparison for WP","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105883","published":"2026-10-09T12:08:39.172Z","updated":"2026-10-09T19:59:10.283Z","title":"WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Th Shop Mania","kev":false,"epss":0.00183,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106601","published":"2026-10-09T12:08:38.787Z","updated":"2026-10-09T15:09:49.660Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106602","published":"2026-10-09T12:08:38.768Z","updated":"2026-10-11T12:13:41.420Z","title":"WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Automattic","product":"Jetpack","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104392","published":"2026-10-09T12:08:37.866Z","updated":"2026-10-09T20:01:16.901Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105870","published":"2026-10-09T12:08:37.726Z","updated":"2026-10-11T11:42:55.514Z","title":"WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Delight Star Inc.","product":"WP Associate Post R2","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105872","published":"2026-10-09T12:08:37.425Z","updated":"2026-10-11T12:13:41.572Z","title":"WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"mklacroix","product":"Product Configurator for WooCommerce","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105877","published":"2026-10-09T12:08:37.272Z","updated":"2026-10-09T17:33:02.391Z","title":"WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105318","published":"2026-10-09T12:08:37.036Z","updated":"2026-10-13T06:22:16.869Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Datasolution","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62029","published":"2026-10-09T12:04:39.782Z","updated":"2026-10-09T17:34:23.625Z","title":"WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels Team","product":"WPFunnels","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62036","published":"2026-10-09T11:49:30.979Z","updated":"2026-10-11T11:40:37.609Z","title":"WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"AREOI","product":"All Bootstrap Blocks","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39779","published":"2026-10-09T11:44:42.274Z","updated":"2026-10-09T15:10:10.428Z","title":"WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Asgaros","product":"Asgaros Forum","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62039","published":"2026-10-09T11:44:04.748Z","updated":"2026-10-11T11:42:55.643Z","title":"WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Html5 Audio Player","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62040","published":"2026-10-09T11:42:11.802Z","updated":"2026-10-14T12:23:44.503Z","title":"WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DEV Institute","product":"Restrict User Access – Membership Plugin with Force","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62041","published":"2026-10-09T11:40:25.660Z","updated":"2026-11-05T07:54:34.890Z","title":"WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ashok Dudhat","product":"WP Event Manager","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62042","published":"2026-10-09T11:32:27.683Z","updated":"2026-10-09T19:57:53.346Z","title":"WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"unFocus Projects","product":"Scripts n Styles","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107419","published":"2026-10-09T11:17:43.577Z","updated":"2026-10-11T12:13:41.693Z","title":"WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Cool Plugins","product":"AI Translation for Polylang","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93947","published":"2026-10-09T10:00:36.351Z","updated":"2026-10-09T15:10:20.858Z","title":"WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shinetheme","product":"Traveler","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94158","published":"2026-10-09T10:00:36.253Z","updated":"2026-10-11T11:42:55.888Z","title":"WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bkninja","product":"Gloria Admin Panel","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94503","published":"2026-10-09T10:00:35.938Z","updated":"2026-10-12T06:17:40.182Z","title":"WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"PX-lab","product":"Zombify","kev":false,"epss":0.0035,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94161","published":"2026-10-09T10:00:35.885Z","updated":"2026-10-09T17:38:14.641Z","title":"WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGoods","product":"Grand Restaurant","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94159","published":"2026-10-09T10:00:35.516Z","updated":"2026-10-11T11:42:56.008Z","title":"WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94167","published":"2026-10-09T10:00:35.453Z","updated":"2026-10-09T15:10:28.354Z","title":"WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Extend Themes","product":"Kubio AI Page Builder","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96334","published":"2026-10-09T10:00:35.107Z","updated":"2026-10-11T12:13:41.820Z","title":"WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.6,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00149,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94170","published":"2026-10-09T10:00:35.060Z","updated":"2026-10-11T11:42:56.139Z","title":"WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Heateor Support","product":"Sassy Social Share","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94664","published":"2026-10-09T10:00:34.694Z","updated":"2026-10-09T20:05:07.048Z","title":"WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"add-ons.org","product":"PDF for Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96607","published":"2026-10-09T10:00:34.684Z","updated":"2026-10-09T17:39:12.169Z","title":"WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Basix","product":"NEX-Forms","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94666","published":"2026-10-09T10:00:34.337Z","updated":"2026-10-11T12:13:41.956Z","title":"WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"ZealousWeb","product":"Generate PDF using Contact Form 7","kev":false,"epss":0.00362,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96332","published":"2026-10-09T10:00:34.303Z","updated":"2026-10-09T20:06:18.069Z","title":"WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"yalla ya!","product":"Simple Payment","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95589","published":"2026-10-09T10:00:33.945Z","updated":"2026-10-09T20:10:23.743Z","title":"WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Deposits and Partial Payments for WooCommerce","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94668","published":"2026-10-09T10:00:33.924Z","updated":"2026-10-09T17:40:22.596Z","title":"WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94667","published":"2026-10-09T10:00:33.558Z","updated":"2026-10-11T11:42:56.267Z","title":"WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetReviews","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94665","published":"2026-10-09T10:00:33.513Z","updated":"2026-10-09T15:10:39.045Z","title":"WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94663","published":"2026-10-09T10:00:33.105Z","updated":"2026-10-09T17:41:11.576Z","title":"WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94661","published":"2026-10-09T10:00:33.072Z","updated":"2026-10-11T11:42:56.385Z","title":"WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetBlog","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94641","published":"2026-10-09T10:00:32.734Z","updated":"2026-10-11T11:42:56.522Z","title":"WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94632","published":"2026-10-09T10:00:32.671Z","updated":"2026-10-09T15:10:48.031Z","title":"WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stiofan","product":"BlockStrap Page Builder - Bootstrap Blocks","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96809","published":"2026-10-09T10:00:32.302Z","updated":"2026-10-11T12:03:20.949Z","title":"WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"MultiNet Interactive AB","product":"EduAdmin Booking","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94415","published":"2026-10-09T10:00:32.301Z","updated":"2026-10-11T11:42:56.644Z","title":"WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Muffingroup","product":"Betheme","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94166","published":"2026-10-09T10:00:22.170Z","updated":"2026-10-09T20:11:22.652Z","title":"WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96761","published":"2026-10-09T10:00:22.064Z","updated":"2026-10-09T15:10:57.640Z","title":"WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96671","published":"2026-10-09T10:00:21.368Z","updated":"2026-10-09T20:12:12.139Z","title":"WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96331","published":"2026-10-09T10:00:21.324Z","updated":"2026-10-20T17:58:59.053Z","title":"WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpdreams","product":"Ajax Search Pro","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96330","published":"2026-10-09T10:00:20.965Z","updated":"2026-10-11T12:03:21.072Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96329","published":"2026-10-09T10:00:20.895Z","updated":"2026-10-11T12:03:21.202Z","title":"WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"tagDiv","product":"tagDiv Opt-In Builder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96328","published":"2026-10-09T10:00:20.599Z","updated":"2026-10-09T15:11:09.645Z","title":"WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"jegtheme","product":"JNews - Pay Writer","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95609","published":"2026-10-09T10:00:20.474Z","updated":"2026-10-11T11:42:56.776Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95599","published":"2026-10-09T10:00:20.145Z","updated":"2026-10-09T20:13:14.977Z","title":"WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Taskbuilder","product":"Taskbuilder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95598","published":"2026-10-09T10:00:20.071Z","updated":"2026-10-09T17:43:35.650Z","title":"WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Search in Place","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95597","published":"2026-10-09T10:00:19.713Z","updated":"2026-10-11T12:13:42.073Z","title":"WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codemstory","product":"워드프레스 결제 심플페이","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95596","published":"2026-10-09T10:00:19.652Z","updated":"2026-10-11T11:42:56.912Z","title":"WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95591","published":"2026-10-09T10:00:19.352Z","updated":"2026-10-09T15:11:17.737Z","title":"WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikBooking Hotel Booking Engine & PMS","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94568","published":"2026-10-09T10:00:19.289Z","updated":"2026-10-09T20:18:08.028Z","title":"WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95607","published":"2026-10-09T10:00:18.459Z","updated":"2026-10-09T15:11:27.797Z","title":"WordPress WPLMS  theme <= 4.973 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96327","published":"2026-10-09T10:00:18.114Z","updated":"2026-10-09T20:19:06.443Z","title":"WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95608","published":"2026-10-09T10:00:18.049Z","updated":"2026-10-11T11:42:57.048Z","title":"WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginUs.Net","product":"HUSKY","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95610","published":"2026-10-09T10:00:17.308Z","updated":"2026-10-27T13:20:09.827Z","title":"WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"UpSolution","product":"UpSolution Core","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96461","published":"2026-10-09T10:00:17.179Z","updated":"2026-10-09T20:20:07.252Z","title":"WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"TMS","product":"Amelia","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96337","published":"2026-10-09T10:00:16.886Z","updated":"2026-10-09T17:44:38.003Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96518","published":"2026-10-09T10:00:16.773Z","updated":"2026-10-09T15:11:34.573Z","title":"WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96333","published":"2026-10-09T10:00:16.516Z","updated":"2026-10-09T15:11:44.568Z","title":"WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96553","published":"2026-10-09T10:00:16.406Z","updated":"2026-10-11T11:42:57.165Z","title":"WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Damian Góra","product":"FiboSearch","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96539","published":"2026-10-09T10:00:16.120Z","updated":"2026-10-11T12:13:42.212Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96336","published":"2026-10-09T10:00:15.190Z","updated":"2026-10-11T12:13:42.343Z","title":"WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62049","published":"2026-10-09T09:15:43.867Z","updated":"2026-10-09T20:21:08.550Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetBlocks For Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97075","published":"2026-10-09T08:00:19.896Z","updated":"2026-10-09T18:02:29.120Z","title":"WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00159,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97076","published":"2026-10-09T07:00:48.876Z","updated":"2026-10-11T12:13:42.465Z","title":"WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Media","product":"WP Rocket","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40804","published":"2026-10-08T18:48:17.611Z","updated":"2026-10-08T19:29:11.917Z","title":"WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kodezen LLC","product":"aBlocks","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105436","published":"2026-10-08T17:00:12.300Z","updated":"2026-10-09T15:15:11.490Z","title":"WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability","severity":"HIGH","score":8.8,"vendor":"MainWP","product":"MainWP Child","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27420","published":"2026-10-08T13:26:16.676Z","updated":"2026-10-08T15:49:00.862Z","title":"WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Katie Seaborn","product":"Zotpress","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42698","published":"2026-10-08T13:14:10.326Z","updated":"2026-10-08T14:06:52.143Z","title":"WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themeum","product":"Tutor LMS","kev":false,"epss":0.00167,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62127","published":"2026-10-08T13:09:19.885Z","updated":"2026-10-08T14:05:57.477Z","title":"WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MediaRon LLC","product":"WP Plugin Info Card","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62128","published":"2026-10-08T13:08:46.298Z","updated":"2026-10-10T03:00:58.682Z","title":"WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Creator LMS","product":"Creator LMS","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106611","published":"2026-10-08T13:05:37.797Z","updated":"2026-10-08T17:53:46.740Z","title":"WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00117,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105893","published":"2026-10-08T13:05:12.901Z","updated":"2026-10-08T16:59:47.202Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105079","published":"2026-10-08T13:04:48.139Z","updated":"2026-10-10T02:58:43.411Z","title":"WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105891","published":"2026-10-08T13:03:39.883Z","updated":"2026-10-10T02:58:07.274Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103072","published":"2026-10-08T13:03:10.908Z","updated":"2026-10-08T17:53:52.213Z","title":"WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"VillaTheme","product":"VillaTheme Core","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105890","published":"2026-10-08T13:02:50.319Z","updated":"2026-10-08T14:07:23.790Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105888","published":"2026-10-08T13:02:00.900Z","updated":"2026-10-08T17:53:58.712Z","title":"WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105078","published":"2026-10-08T13:01:36.116Z","updated":"2026-10-08T14:07:52.571Z","title":"WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Store Locator","product":"WP Store Locator","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106596","published":"2026-10-08T13:00:34.650Z","updated":"2026-10-08T14:07:40.315Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105887","published":"2026-10-08T13:00:14.204Z","updated":"2026-10-08T14:10:10.343Z","title":"WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Robosoft","product":"Robo Gallery","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103070","published":"2026-10-08T12:58:32.583Z","updated":"2026-10-08T14:18:45.750Z","title":"WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105886","published":"2026-10-08T12:57:40.288Z","updated":"2026-10-08T17:01:38.992Z","title":"WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Ultimate Post Kit","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105076","published":"2026-10-08T12:56:35.162Z","updated":"2026-10-08T17:10:45.652Z","title":"WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Appsbd","product":"Vitepos","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62142","published":"2026-10-08T12:31:10.868Z","updated":"2026-10-08T14:11:39.688Z","title":"WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Melapress","product":"WP 2FA","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105878","published":"2026-10-08T12:29:51.708Z","updated":"2026-10-08T17:02:33.651Z","title":"WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Product Bundles","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106603","published":"2026-10-08T12:27:58.657Z","updated":"2026-10-09T07:24:52.632Z","title":"WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Groundhogg","product":"HollerBox","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66479","published":"2026-10-08T12:20:49.278Z","updated":"2026-10-08T14:12:00.074Z","title":"WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"WPComplete","kev":false,"epss":0.00089,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106600","published":"2026-10-08T12:20:18.826Z","updated":"2026-10-08T14:19:36.619Z","title":"WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96335","published":"2026-10-07T17:09:50.213Z","updated":"2026-10-07T19:23:46.015Z","title":"WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95606","published":"2026-10-07T17:07:23.189Z","updated":"2026-10-07T17:49:58.857Z","title":"WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95605","published":"2026-10-07T17:05:14.177Z","updated":"2026-10-07T18:04:51.175Z","title":"WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95595","published":"2026-10-07T17:03:19.480Z","updated":"2026-10-07T19:23:46.144Z","title":"WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fontsplugin","product":"Disable and Remove Google Fonts | GDPR & DSGVO friendly","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95534","published":"2026-10-07T17:00:23.166Z","updated":"2026-10-07T17:32:12.169Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94670","published":"2026-10-07T16:57:43.166Z","updated":"2026-10-07T19:23:46.278Z","title":"WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94662","published":"2026-10-07T16:55:21.832Z","updated":"2026-10-07T17:49:13.996Z","title":"WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42708","published":"2026-10-07T11:59:35.547Z","updated":"2026-10-07T19:23:47.417Z","title":"WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"AF themes","product":"WP Post Author","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42710","published":"2026-10-07T11:55:51.698Z","updated":"2026-10-07T17:05:16.763Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42713","published":"2026-10-07T10:57:33.366Z","updated":"2026-10-07T19:23:47.540Z","title":"WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Gopiplus","product":"Post title marquee scroll","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42714","published":"2026-10-07T10:56:56.499Z","updated":"2026-10-07T17:43:50.109Z","title":"WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Piggly Dev","product":"Pix por Piggly (para Woocommerce)","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42720","published":"2026-10-07T09:57:33.748Z","updated":"2026-10-07T10:26:54.695Z","title":"WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Sarah Giles","product":"Dynamic User Directory","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42721","published":"2026-10-07T09:56:56.962Z","updated":"2026-10-07T10:26:38.797Z","title":"WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"SERVIT Software Solutions","product":"affiliate-toolkit","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27434","published":"2026-10-07T09:24:43.741Z","updated":"2026-10-07T10:09:58.783Z","title":"WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"sc Internet Vivoo","product":"WP Rentals","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104390","published":"2026-10-07T09:17:31.432Z","updated":"2026-10-07T10:09:58.909Z","title":"WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105876","published":"2026-10-07T09:16:26.835Z","updated":"2026-10-07T10:09:59.051Z","title":"WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Modula Image Gallery","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104393","published":"2026-10-07T09:16:04.708Z","updated":"2026-10-07T10:09:59.187Z","title":"WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105875","published":"2026-10-07T09:15:39.584Z","updated":"2026-10-07T10:09:59.320Z","title":"WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Prime Slider – Addons For Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104391","published":"2026-10-07T09:15:11.909Z","updated":"2026-10-07T10:09:59.457Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103075","published":"2026-10-07T09:12:48.442Z","updated":"2026-10-07T10:09:59.577Z","title":"WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPMU DEV","product":"Hustle","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105884","published":"2026-10-07T09:12:23.408Z","updated":"2026-10-07T10:09:59.723Z","title":"WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Media","product":"Rocket Lazy Load","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105873","published":"2026-10-07T09:11:27.437Z","updated":"2026-10-07T10:09:59.849Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97294","published":"2026-10-07T09:10:56.001Z","updated":"2026-10-07T10:10:00.035Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105871","published":"2026-10-07T09:04:25.788Z","updated":"2026-10-07T10:10:00.383Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66666","published":"2026-10-06T17:48:37.371Z","updated":"2026-10-06T20:05:54.337Z","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Automattic","product":"WordPress","kev":false,"epss":0.00403,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104399","published":"2026-10-06T08:40:47.824Z","updated":"2026-10-06T10:31:25.740Z","title":"WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.0041,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105317","published":"2026-10-06T08:35:24.406Z","updated":"2026-10-06T10:31:25.873Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105071","published":"2026-10-06T08:35:23.670Z","updated":"2026-10-06T10:31:26.009Z","title":"WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","kev":false,"epss":0.00398,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105070","published":"2026-10-06T08:35:22.951Z","updated":"2026-10-06T10:31:26.150Z","title":"WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105061","published":"2026-10-06T08:35:22.227Z","updated":"2026-10-06T10:31:26.294Z","title":"WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Bởi brandtoss","product":"WP Mailster","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105059","published":"2026-10-06T08:35:21.544Z","updated":"2026-10-12T14:27:14.634Z","title":"WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"royalnavneet","product":"Delete All Comments of wordpress","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105058","published":"2026-10-06T08:35:20.818Z","updated":"2026-10-06T10:31:26.566Z","title":"WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"John James Jacoby","product":"WP User Profiles","kev":false,"epss":0.00306,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105057","published":"2026-10-06T08:35:20.081Z","updated":"2026-10-06T10:31:26.694Z","title":"WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ben Marshall","product":"Zero Spam","kev":false,"epss":0.00315,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104814","published":"2026-10-06T08:35:19.361Z","updated":"2026-10-06T10:31:26.835Z","title":"WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"epiphyt","product":"Form Block","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104757","published":"2026-10-06T08:35:18.658Z","updated":"2026-10-06T10:31:26.972Z","title":"WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"Javier Carazo","product":"Import and export users and customers","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104747","published":"2026-10-06T08:35:17.979Z","updated":"2026-10-06T10:31:27.096Z","title":"WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Haaken","kev":false,"epss":0.0025,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104672","published":"2026-10-06T08:35:17.268Z","updated":"2026-10-06T10:31:27.261Z","title":"WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104670","published":"2026-10-06T08:35:16.585Z","updated":"2026-10-06T10:31:27.439Z","title":"WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104406","published":"2026-10-06T08:35:15.890Z","updated":"2026-10-06T10:31:27.573Z","title":"WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"picu","product":"picu","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104405","published":"2026-10-06T08:35:15.194Z","updated":"2026-10-06T10:31:27.703Z","title":"WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104395","published":"2026-10-06T08:35:14.474Z","updated":"2026-10-06T10:31:27.829Z","title":"WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"picu","product":"picu","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104394","published":"2026-10-06T08:35:13.805Z","updated":"2026-10-06T10:31:27.975Z","title":"WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104387","published":"2026-10-06T08:35:13.107Z","updated":"2026-10-06T10:31:28.112Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.2,"vendor":"blubrry","product":"PowerPress Podcasting","kev":false,"epss":0.00318,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104385","published":"2026-10-06T08:35:12.401Z","updated":"2026-10-06T10:31:28.298Z","title":"WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102915","published":"2026-10-06T08:35:10.971Z","updated":"2026-10-06T10:31:28.455Z","title":"WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.5,"vendor":"Marco van Wieren","product":"WPO365","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102387","published":"2026-10-06T08:35:10.255Z","updated":"2026-10-06T10:31:28.617Z","title":"WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"XServer","product":"Xserver Migrator","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100518","published":"2026-10-06T08:35:09.522Z","updated":"2026-10-06T10:31:28.757Z","title":"WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebFactory","product":"Advanced Google reCAPTCHA","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97308","published":"2026-10-06T08:35:08.814Z","updated":"2026-10-06T10:31:28.890Z","title":"WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.8,"vendor":"WebFactory","product":"Login Lockdown","kev":false,"epss":0.00184,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95594","published":"2026-10-06T08:35:08.065Z","updated":"2026-10-12T14:07:16.423Z","title":"WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95526","published":"2026-10-06T08:35:07.323Z","updated":"2026-10-06T10:31:29.166Z","title":"WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"RealMag777","product":"BEAR","kev":false,"epss":0.00213,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94675","published":"2026-10-06T08:35:06.593Z","updated":"2026-10-06T10:31:29.335Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fluent Forms Free vs Pro","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62072","published":"2026-10-06T08:35:05.157Z","updated":"2026-10-06T10:31:29.627Z","title":"WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Planner","product":"Progress Planner","kev":false,"epss":0.00315,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48199","published":"2026-10-06T08:35:04.446Z","updated":"2026-10-06T10:31:29.791Z","title":"WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Beplusthemes","product":"Sermon'e","kev":false,"epss":0.00366,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48197","published":"2026-10-06T08:35:03.720Z","updated":"2026-10-06T10:31:29.926Z","title":"WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.0043,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42638","published":"2026-10-06T08:35:02.876Z","updated":"2026-10-07T07:41:51.824Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Awesomemotive","product":"Easy Digital Downloads","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42637","published":"2026-10-06T08:35:02.145Z","updated":"2026-10-06T10:31:30.233Z","title":"WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","kev":false,"epss":0.00318,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42636","published":"2026-10-06T08:35:01.411Z","updated":"2026-10-06T10:31:30.386Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42635","published":"2026-10-06T08:35:00.661Z","updated":"2026-10-06T10:31:30.527Z","title":"WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpgenie","product":"WooCommerce Simple Auctions","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42634","published":"2026-10-06T08:34:59.948Z","updated":"2026-10-06T10:31:30.659Z","title":"WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Video Background Block – Use video as background in the section.","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42418","published":"2026-10-06T08:34:59.233Z","updated":"2026-10-07T07:41:55.087Z","title":"WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Socialrocket","product":"Social Rocket","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42417","published":"2026-10-06T08:34:58.496Z","updated":"2026-10-06T10:31:30.946Z","title":"WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"reputeinfosystems","product":"ARMember Premium","kev":false,"epss":0.00312,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42416","published":"2026-10-06T08:34:57.756Z","updated":"2026-10-06T10:31:31.076Z","title":"WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"AndonDesign","product":"UDesign Core","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42415","published":"2026-10-06T08:34:57.024Z","updated":"2026-10-06T10:31:31.207Z","title":"WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"p-themes","product":"Porto Theme - Functionality","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42414","published":"2026-10-06T08:34:56.108Z","updated":"2026-10-06T10:31:31.351Z","title":"WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CridioStudio","product":"ListingPro","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42413","published":"2026-10-06T08:34:55.402Z","updated":"2026-10-06T10:31:31.489Z","title":"WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"DaftPlug","product":"Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41562","published":"2026-10-06T08:34:54.683Z","updated":"2026-10-06T10:31:31.621Z","title":"WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"norvisgabriel","product":"Norvis Backup","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41561","published":"2026-10-06T08:34:53.939Z","updated":"2026-10-06T10:31:31.857Z","title":"WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Adrian Lin","product":"Museder RestoreOne","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41560","published":"2026-10-06T08:34:53.188Z","updated":"2026-10-06T10:31:32.165Z","title":"WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wxdlabs","product":"WXD Backup Lite","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41559","published":"2026-10-06T08:34:52.473Z","updated":"2026-10-06T10:31:32.284Z","title":"WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Pluginjoy","product":"SafeSnap – Verified WordPress Backup &amp; Restore","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41555","published":"2026-10-06T08:34:51.734Z","updated":"2026-10-06T10:31:32.436Z","title":"WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Weblizar – WordPress Themes & Plugin","product":"Newsletter Subscription Form – User Subscriptions Form, Capture Email","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40807","published":"2026-10-06T08:34:51.025Z","updated":"2026-10-06T10:31:32.614Z","title":"WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40806","published":"2026-10-06T08:34:50.271Z","updated":"2026-10-06T10:31:32.786Z","title":"WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Plugin Devs","product":"Blog, Posts and Category Filter for Elementor","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39798","published":"2026-10-06T08:34:49.525Z","updated":"2026-10-06T10:31:32.929Z","title":"WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemetechMount","product":"TrueBooker","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39797","published":"2026-10-06T08:34:48.786Z","updated":"2026-10-06T10:31:33.072Z","title":"WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Data443 Risk Mitigation, Inc.","product":"GDPR Framework By Data443","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39796","published":"2026-10-06T08:34:48.042Z","updated":"2026-10-06T10:31:33.215Z","title":"WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Flipper Code – WordPress Development Company","product":"Advanced Posts Listing – Show Post List Easily","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39795","published":"2026-10-06T08:34:47.283Z","updated":"2026-10-28T17:37:08.624Z","title":"WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"brewlabs","product":"SendPress Newsletters","kev":false,"epss":0.00302,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39794","published":"2026-10-06T08:34:46.533Z","updated":"2026-10-06T10:31:33.503Z","title":"WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WC Lovers","product":"WooCommerce Multivendor Marketplace – REST API","kev":false,"epss":0.00377,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39793","published":"2026-10-06T08:34:45.833Z","updated":"2026-10-06T10:31:33.635Z","title":"WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability","severity":"HIGH","score":8.8,"vendor":"Nicu Micle","product":"Simple JWT Login","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39792","published":"2026-10-06T08:34:45.084Z","updated":"2026-10-06T10:31:33.763Z","title":"WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Mitchell Bennis","product":"Simple File List","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39791","published":"2026-10-06T08:34:44.345Z","updated":"2026-10-06T10:31:33.890Z","title":"WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mailjet","product":"Mailjet Email Marketing","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39790","published":"2026-10-06T08:34:43.639Z","updated":"2026-10-08T16:26:51.693Z","title":"WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"e4jvikwp","product":"VikRentCar","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39788","published":"2026-10-06T08:34:42.945Z","updated":"2026-10-06T10:31:34.162Z","title":"WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shamim Hasan","product":"Front End PM","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39787","published":"2026-10-06T08:34:42.197Z","updated":"2026-10-06T10:31:34.287Z","title":"WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"10Web","product":"10Web Social Photo Feed","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39785","published":"2026-10-06T08:34:41.464Z","updated":"2026-10-13T16:31:43.279Z","title":"WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Serhii Pasyuk","product":"Gmedia Photo Gallery","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39784","published":"2026-10-06T08:34:40.759Z","updated":"2026-10-06T10:31:34.555Z","title":"WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"nicdark","product":"Hotel Booking","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39781","published":"2026-10-06T08:34:40.014Z","updated":"2026-10-15T16:32:45.612Z","title":"WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dan Rossiter","product":"Document Gallery","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39780","published":"2026-10-06T08:34:39.270Z","updated":"2026-10-06T10:31:34.839Z","title":"WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39778","published":"2026-10-06T08:34:38.441Z","updated":"2026-10-06T10:31:35.026Z","title":"WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"themeansar","product":"Ansar Import – One Click Starter Sites – for Elementor &amp; Themes","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39776","published":"2026-10-06T08:34:37.696Z","updated":"2026-10-06T10:31:35.164Z","title":"WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8,"vendor":"wpshopmart","product":"Tabs","kev":false,"epss":0.00348,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39775","published":"2026-10-06T08:34:36.958Z","updated":"2026-10-06T10:31:35.298Z","title":"WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"DexignZone","product":"JobZilla - Job Board WordPress Theme","kev":false,"epss":0.00306,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39774","published":"2026-10-06T08:34:36.214Z","updated":"2026-10-06T10:31:35.455Z","title":"WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Tourfic AI Studio","product":"Tourfic Pro","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39773","published":"2026-10-06T08:34:35.478Z","updated":"2026-10-06T10:31:35.630Z","title":"WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":10,"vendor":"AmentoTech","product":"Doctreat Core","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39772","published":"2026-10-06T08:34:34.779Z","updated":"2026-10-06T10:31:35.769Z","title":"WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"bestwebsoft","product":"Captcha by BestWebSoft","kev":false,"epss":0.00342,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39771","published":"2026-10-06T08:34:34.040Z","updated":"2026-10-06T10:31:35.912Z","title":"WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"MightyNetworks vs BuddyBoss","product":"Buddyboss Platform","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39770","published":"2026-10-06T08:34:33.299Z","updated":"2026-10-06T10:31:36.033Z","title":"WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"AmentoTech","product":"Doctreat","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39769","published":"2026-10-06T08:34:32.593Z","updated":"2026-10-23T08:42:43.466Z","title":"WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"Iqonic Designs","product":"Graphina – Charts and Graphs For Elementor","kev":false,"epss":0.00493,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39767","published":"2026-10-06T08:34:31.166Z","updated":"2026-10-06T10:31:36.500Z","title":"WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":6.5,"vendor":"baseapp","product":"WPBase Cache","kev":false,"epss":0.00382,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39766","published":"2026-10-06T08:34:30.421Z","updated":"2026-10-06T10:31:36.624Z","title":"WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"reputeinfosystems","product":"ARForms","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39765","published":"2026-10-06T08:34:29.700Z","updated":"2026-10-06T10:31:36.756Z","title":"WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"WebAppick","product":"Challan","kev":false,"epss":0.0043,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39764","published":"2026-10-06T08:34:28.966Z","updated":"2026-10-06T10:31:36.888Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RadiusTheme","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39762","published":"2026-10-06T08:34:28.253Z","updated":"2026-10-06T10:31:37.034Z","title":"WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Patterns In The Cloud","product":"Autoship Cloud for WooCommerce Subscription Products","kev":false,"epss":0.00318,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39761","published":"2026-10-06T08:34:27.505Z","updated":"2026-10-06T10:31:37.178Z","title":"WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"eLightUp","product":"Meta Box AIO","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39759","published":"2026-10-06T08:34:26.777Z","updated":"2026-10-06T10:31:37.320Z","title":"WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"AmentoTech","product":"Workreap Core","kev":false,"epss":0.00434,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39758","published":"2026-10-06T08:34:25.937Z","updated":"2026-10-06T10:31:37.448Z","title":"WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Midtrans","product":"Midtrans-WooCommerce","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39757","published":"2026-10-06T08:34:25.188Z","updated":"2026-10-06T10:31:37.577Z","title":"WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"AmentoTech","product":"Taskbot","kev":false,"epss":0.00434,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39756","published":"2026-10-06T08:34:24.471Z","updated":"2026-10-06T10:31:37.698Z","title":"WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wappointment team","product":"Wappointment","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39755","published":"2026-10-06T08:34:23.714Z","updated":"2026-10-06T10:31:37.844Z","title":"WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"revmakx","product":"WP Duplicate","kev":false,"epss":0.00434,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39754","published":"2026-10-06T08:34:22.980Z","updated":"2026-10-06T10:31:37.977Z","title":"WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"About Piotnet","product":"Piotnet Addons For Elementor","kev":false,"epss":0.00319,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39753","published":"2026-10-06T08:34:22.228Z","updated":"2026-10-06T10:31:38.113Z","title":"WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AmentoTech","product":"Taskbot","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39752","published":"2026-10-06T08:34:21.489Z","updated":"2026-10-06T10:31:38.249Z","title":"WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.7,"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39751","published":"2026-10-06T08:34:20.780Z","updated":"2026-10-06T10:31:38.368Z","title":"WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39750","published":"2026-10-06T08:34:20.040Z","updated":"2026-10-06T10:31:38.496Z","title":"WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39749","published":"2026-10-06T08:34:19.329Z","updated":"2026-10-06T10:31:38.645Z","title":"WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"digitalpoint","product":"App for Cloudflare®","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39748","published":"2026-10-06T08:34:18.613Z","updated":"2026-10-06T10:31:38.779Z","title":"WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeMove","product":"EduMall","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39747","published":"2026-10-06T08:34:17.916Z","updated":"2026-11-05T13:00:30.751Z","title":"WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WofficeIO","product":"Woffice","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39746","published":"2026-10-06T08:34:17.195Z","updated":"2026-10-29T11:35:28.523Z","title":"WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Booknetic","product":"Booknetic","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39745","published":"2026-10-06T08:34:16.474Z","updated":"2026-10-06T10:31:39.162Z","title":"WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bestweblayout","product":"Contact Form to DB by BestWebSoft","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39731","published":"2026-10-06T08:34:15.745Z","updated":"2026-10-06T10:31:39.296Z","title":"WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"code4life","product":"Database for CF7","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39730","published":"2026-10-06T08:34:15.038Z","updated":"2026-10-07T14:58:48.197Z","title":"WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39729","published":"2026-10-06T08:34:14.325Z","updated":"2026-10-06T10:31:39.562Z","title":"WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.2,"vendor":"WisdmLabs","product":"Edwiser Bridge","kev":false,"epss":0.00336,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39728","published":"2026-10-06T08:34:13.608Z","updated":"2026-10-06T10:31:39.691Z","title":"WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"instapagedev","product":"Instapage Plugin","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39727","published":"2026-10-06T08:34:12.878Z","updated":"2026-10-06T10:31:39.836Z","title":"WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saravana Kumar K","product":"WC Fields Factory","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39726","published":"2026-10-06T08:34:12.139Z","updated":"2026-11-05T14:05:45.646Z","title":"WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lumise","product":"Lumise Product Designer","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39724","published":"2026-10-06T08:34:10.675Z","updated":"2026-10-06T10:31:40.239Z","title":"WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"veppa","product":"HTTP Requests Manager","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39722","published":"2026-10-06T08:34:09.939Z","updated":"2026-10-06T10:31:40.382Z","title":"WordPress WPLMS  theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VibeThemes","product":"WPLMS","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39720","published":"2026-10-06T08:34:09.205Z","updated":"2026-10-06T10:31:40.515Z","title":"WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mapster","product":"Mapster WP Maps","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39719","published":"2026-10-06T08:34:08.460Z","updated":"2026-10-06T10:31:40.658Z","title":"WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"DeKnows","product":"PDF Smart Viewer for Elementor","kev":false,"epss":0.00248,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32581","published":"2026-10-06T08:34:07.719Z","updated":"2026-10-06T10:31:40.798Z","title":"WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"mooberrydreams","product":"Mooberry Book Manager","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32580","published":"2026-10-06T08:34:06.978Z","updated":"2026-10-06T10:31:40.926Z","title":"WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"wpgenie","product":"WooCommerce Lottery","kev":false,"epss":0.00297,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32579","published":"2026-10-06T08:34:06.232Z","updated":"2026-10-06T10:31:41.067Z","title":"WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"kognetiks","product":"Kognetiks Chatbot for WordPress","kev":false,"epss":0.00472,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32578","published":"2026-10-06T08:34:05.522Z","updated":"2026-10-06T10:31:41.205Z","title":"WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"techsupport","product":"ECPay Ecommerce for WooCommerce","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32577","published":"2026-10-06T08:34:04.809Z","updated":"2026-10-06T10:31:41.352Z","title":"WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"N-Media","product":"Frontend File Manager","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32575","published":"2026-10-06T08:34:03.887Z","updated":"2026-10-06T10:31:41.490Z","title":"WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Fantastic Plugins","product":"SUMO Affiliates Pro","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32574","published":"2026-10-06T08:34:03.141Z","updated":"2026-10-13T16:35:59.917Z","title":"WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"EDGARROJAS","product":"Smart Forms","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32572","published":"2026-10-06T08:34:02.373Z","updated":"2026-10-06T10:31:41.804Z","title":"WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"WP User Frontend Pro","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32571","published":"2026-10-06T08:34:01.623Z","updated":"2026-10-06T10:31:41.949Z","title":"WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Colabrio","product":"Ohio Extra","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32570","published":"2026-10-06T08:34:00.908Z","updated":"2026-10-06T10:31:42.083Z","title":"WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"DaftPlug","product":"Progressify - Progressive Web App (PWA)","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32569","published":"2026-10-06T08:33:59.999Z","updated":"2026-10-06T10:31:42.269Z","title":"WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Joomunited","product":"WP Media folder","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32568","published":"2026-10-06T08:33:59.253Z","updated":"2026-10-06T10:31:42.412Z","title":"WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"JMAPlugins","product":"WooCommerce Designer Pro","kev":false,"epss":0.00714,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32557","published":"2026-10-06T08:33:58.564Z","updated":"2026-10-29T07:21:07.586Z","title":"WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"BookingWP","product":"WooCommerce Appointments","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25434","published":"2026-10-06T08:33:57.852Z","updated":"2026-10-06T10:31:42.715Z","title":"WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25433","published":"2026-10-06T08:33:57.132Z","updated":"2026-10-06T10:41:48.647Z","title":"WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","kev":false,"epss":0.00348,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105879","published":"2026-10-06T08:08:49.411Z","updated":"2026-10-06T10:41:48.785Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetElements For Elementor","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103346","published":"2026-10-06T08:00:10.782Z","updated":"2026-10-06T10:41:48.907Z","title":"WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tomlister","product":"Payflex Payment Gateway","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97300","published":"2026-10-06T05:14:51.890Z","updated":"2026-10-06T10:41:49.035Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41563","published":"2026-10-06T05:14:51.195Z","updated":"2026-10-06T10:41:49.165Z","title":"WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Dawer Drew","product":"Sitemovr","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-41558","published":"2026-10-06T05:14:50.478Z","updated":"2026-10-06T10:41:49.297Z","title":"WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Synchro","product":"WP Migration Plugin DB & Files – WP Synchro","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39789","published":"2026-10-06T05:14:49.764Z","updated":"2026-10-06T10:41:49.423Z","title":"WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Affiliate Pro","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39760","published":"2026-10-06T05:14:49.003Z","updated":"2026-10-06T10:41:49.552Z","title":"WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Creative interactive media","product":"Real 3D FlipBook","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39723","published":"2026-10-06T05:14:48.278Z","updated":"2026-10-08T16:26:23.878Z","title":"WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Green Invoice","product":"Morning for WooCommerce","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39599","published":"2026-10-06T05:14:47.563Z","updated":"2026-10-06T10:41:49.802Z","title":"WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wallstrdev","product":"WDS MCP Content Manager","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32582","published":"2026-10-06T05:14:46.484Z","updated":"2026-10-08T18:47:48.687Z","title":"WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"iatoai","product":"IATO MCP","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32576","published":"2026-10-06T05:14:45.697Z","updated":"2026-10-06T15:24:37.645Z","title":"WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ZWEISCHNEIDER","product":"Faktur Pro for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105072","published":"2026-10-06T05:14:44.960Z","updated":"2026-10-06T10:41:50.181Z","title":"WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103066","published":"2026-10-05T19:00:11.467Z","updated":"2026-10-06T10:41:50.315Z","title":"WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WP BASE","product":"WP BASE Booking","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100506","published":"2026-10-05T19:00:11.321Z","updated":"2026-10-06T10:41:50.448Z","title":"WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Spell Check","product":"WP Spell Check","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100511","published":"2026-10-05T19:00:11.317Z","updated":"2026-10-06T10:41:50.582Z","title":"WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Vektor Inc.","product":"VK Google Job Posting Manager","kev":false,"epss":0.00344,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97257","published":"2026-10-05T19:00:11.048Z","updated":"2026-10-06T10:41:50.714Z","title":"WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"PressTigers","product":"Simple Event Planner","kev":false,"epss":0.00344,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93617","published":"2026-10-05T19:00:10.929Z","updated":"2026-10-06T10:41:50.839Z","title":"WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Sunshine","product":"Sunshine Photo Cart","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103348","published":"2026-10-05T19:00:10.897Z","updated":"2026-10-06T10:41:50.968Z","title":"WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Smackcoders Inc.","product":"WP Ultimate Exporter","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103337","published":"2026-10-05T19:00:10.084Z","updated":"2026-10-06T10:41:51.102Z","title":"WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kirillbdev","product":"WC Ukraine Shipping","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103349","published":"2026-10-05T18:08:37.239Z","updated":"2026-10-06T10:41:51.225Z","title":"WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Rymera Web Co","product":"Product Feed PRO for WooCommerce","kev":false,"epss":0.00385,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97303","published":"2026-10-05T18:08:37.120Z","updated":"2026-10-06T10:41:51.386Z","title":"WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Scratch & Win – Giveaways and Contests","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103352","published":"2026-10-05T18:08:36.905Z","updated":"2026-10-05T18:43:01.668Z","title":"WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WP BASE","product":"WP BASE Booking","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97283","published":"2026-10-05T18:08:36.832Z","updated":"2026-10-05T18:46:38.457Z","title":"WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","kev":false,"epss":0.00345,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97275","published":"2026-10-05T18:08:36.781Z","updated":"2026-10-06T10:41:51.523Z","title":"WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"BuildKit – Product Builder for WooCommerce – Custom PC Builder","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97309","published":"2026-10-05T18:08:36.517Z","updated":"2026-10-06T10:41:51.642Z","title":"WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.1,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97070","published":"2026-10-05T18:08:36.385Z","updated":"2026-10-05T18:44:35.126Z","title":"WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.9,"vendor":"CozyThemes","product":"Cozy Blocks","kev":false,"epss":0.00258,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97305","published":"2026-10-05T18:08:36.362Z","updated":"2026-10-05T18:45:13.106Z","title":"WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Themeisle","product":"AI Chatbot for WordPress – Hyve Lite","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103334","published":"2026-10-05T18:08:36.164Z","updated":"2026-10-05T18:47:24.816Z","title":"WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Etoile Web Design Incorporated","product":"Five Star Restaurant Reservations","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97304","published":"2026-10-05T18:08:35.952Z","updated":"2026-10-05T18:42:34.010Z","title":"WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100515","published":"2026-10-05T18:08:35.913Z","updated":"2026-10-09T18:19:21.509Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103085","published":"2026-10-05T18:08:35.787Z","updated":"2026-10-05T18:45:32.266Z","title":"WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103086","published":"2026-10-05T18:08:35.529Z","updated":"2026-10-06T10:41:52.418Z","title":"WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stiofan","product":"UsersWP","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100509","published":"2026-10-05T18:08:35.500Z","updated":"2026-10-05T18:49:24.033Z","title":"WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102383","published":"2026-10-05T18:08:35.452Z","updated":"2026-10-05T18:42:11.214Z","title":"WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Lookzy","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2025-15643","published":"2026-10-05T17:24:53.975Z","updated":"2026-10-06T10:41:52.537Z","title":"WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jose Fernandez","product":"Adsmonetizer","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-42700","published":"2026-10-05T17:13:33.229Z","updated":"2026-10-05T17:44:52.388Z","title":"WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GhozyLab","product":"Image Slider Widget","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105421","published":"2026-10-05T14:17:16.609Z","updated":"2026-10-05T15:38:34.612Z","title":"WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit) for WooCommerce","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39783","published":"2026-10-05T11:28:18.780Z","updated":"2026-10-05T15:28:29.158Z","title":"WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103684","published":"2026-10-05T11:26:23.170Z","updated":"2026-10-05T14:55:00.213Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105073","published":"2026-10-05T11:22:42.540Z","updated":"2026-10-05T14:48:32.613Z","title":"WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"WP Event Solution","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94669","published":"2026-10-05T10:49:05.171Z","updated":"2026-10-05T11:22:42.637Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39763","published":"2026-10-05T10:23:12.204Z","updated":"2026-10-05T12:45:02.991Z","title":"WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Deepak Anand","product":"WP Dummy Content Generator","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39721","published":"2026-10-05T09:01:20.344Z","updated":"2026-10-05T15:28:52.287Z","title":"WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105064","published":"2026-10-05T08:59:15.782Z","updated":"2026-10-05T14:55:00.384Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103351","published":"2026-10-05T08:58:21.432Z","updated":"2026-10-05T12:49:49.460Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104389","published":"2026-10-05T08:57:16.886Z","updated":"2026-10-06T10:41:52.659Z","title":"WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Sirv","product":"Sirv","kev":false,"epss":0.00258,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104388","published":"2026-10-05T08:56:48.249Z","updated":"2026-10-05T12:12:48.342Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102393","published":"2026-10-05T08:55:31.033Z","updated":"2026-10-05T14:55:00.543Z","title":"WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103079","published":"2026-10-05T08:52:59.269Z","updated":"2026-10-05T15:29:12.356Z","title":"WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00182,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104396","published":"2026-10-05T08:51:37.187Z","updated":"2026-10-16T07:13:51.113Z","title":"WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeroen Peters","product":"Name Directory","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102914","published":"2026-10-05T08:51:11.546Z","updated":"2026-10-05T14:55:00.789Z","title":"WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Presto Player","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104675","published":"2026-10-05T08:50:46.064Z","updated":"2026-10-05T12:51:51.503Z","title":"WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00165,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103084","published":"2026-10-05T08:49:57.381Z","updated":"2026-10-05T12:56:19.984Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104397","published":"2026-10-05T08:49:32.355Z","updated":"2026-10-05T15:29:19.729Z","title":"WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jeroen Peters","product":"Name Directory","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105060","published":"2026-10-05T08:48:19.013Z","updated":"2026-10-05T14:55:00.913Z","title":"WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Logo Showcase","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104673","published":"2026-10-05T08:47:44.618Z","updated":"2026-10-05T15:29:27.109Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105056","published":"2026-10-05T08:46:55.611Z","updated":"2026-10-06T10:41:52.779Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104408","published":"2026-10-05T08:44:29.687Z","updated":"2026-10-05T14:55:01.062Z","title":"WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Groundhogg","product":"Groundhogg","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103335","published":"2026-10-05T08:44:05.054Z","updated":"2026-10-05T12:22:29.503Z","title":"WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105055","published":"2026-10-05T08:40:51.713Z","updated":"2026-10-05T12:25:37.241Z","title":"WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Mailster","product":"WP Mailster","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97071","published":"2026-10-05T08:40:20.638Z","updated":"2026-10-06T10:41:52.955Z","title":"WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105062","published":"2026-10-05T08:39:55.952Z","updated":"2026-10-05T15:29:34.053Z","title":"WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brandtoss","product":"WP Admin Audit","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103078","published":"2026-10-05T08:39:06.483Z","updated":"2026-10-05T15:29:40.419Z","title":"WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104407","published":"2026-10-05T08:35:02.776Z","updated":"2026-10-06T10:41:53.087Z","title":"WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00097,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104386","published":"2026-10-05T08:34:19.528Z","updated":"2026-10-06T10:41:53.221Z","title":"WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels Team","product":"WP VR","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105069","published":"2026-10-05T08:32:47.894Z","updated":"2026-10-05T12:49:38.131Z","title":"WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nikki Blight","product":"QR Redirector","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104404","published":"2026-10-05T08:31:24.755Z","updated":"2026-10-05T13:03:22.921Z","title":"WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-105068","published":"2026-10-05T08:26:46.416Z","updated":"2026-10-05T12:56:44.259Z","title":"WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Pixelite","product":"Events Manager","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104401","published":"2026-10-05T08:19:04.715Z","updated":"2026-10-05T12:57:37.874Z","title":"WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Memberful","product":"Memberful - Membership Plugin","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104400","published":"2026-10-05T08:07:32.702Z","updated":"2026-10-05T14:05:02.111Z","title":"WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104409","published":"2026-10-05T08:06:10.229Z","updated":"2026-10-08T10:23:24.752Z","title":"WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104402","published":"2026-10-04T15:08:43.541Z","updated":"2026-10-05T13:15:54.663Z","title":"WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"farvisun","product":"Mindio Magic MCP","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97307","published":"2026-10-04T09:08:23.508Z","updated":"2026-10-05T15:31:34.786Z","title":"WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"StylemixThemes","product":"Cost Calculator Builder","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103355","published":"2026-10-04T08:00:09.599Z","updated":"2026-10-06T10:41:53.484Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00382,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103344","published":"2026-10-04T08:00:09.427Z","updated":"2026-10-05T13:31:23.995Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103062","published":"2026-10-04T07:00:43.570Z","updated":"2026-10-05T15:31:49.116Z","title":"WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97276","published":"2026-10-04T07:00:43.091Z","updated":"2026-10-05T18:50:30.444Z","title":"WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103354","published":"2026-10-04T07:00:42.870Z","updated":"2026-10-05T16:22:32.586Z","title":"WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96451","published":"2026-10-03T15:08:13.855Z","updated":"2026-10-05T14:55:02.194Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103342","published":"2026-10-03T14:00:11.382Z","updated":"2026-10-03T15:12:23.526Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103065","published":"2026-10-03T14:00:11.348Z","updated":"2026-10-09T14:15:55.689Z","title":"WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability","severity":"HIGH","score":8.2,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39718","published":"2026-10-02T19:16:31.625Z","updated":"2026-10-02T20:13:21.126Z","title":"WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Webriti","product":"Wallstreet","kev":false,"epss":0.00143,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39717","published":"2026-10-02T14:49:50.614Z","updated":"2026-10-09T11:33:22.679Z","title":"WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39601","published":"2026-10-02T14:49:13.832Z","updated":"2026-10-05T07:01:17.773Z","title":"WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"WPdevelop","product":"Booking Calendar","kev":false,"epss":0.00151,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39600","published":"2026-10-02T14:47:33.805Z","updated":"2026-10-07T16:37:01.379Z","title":"WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability","severity":"MEDIUM","score":4.7,"vendor":"Mehul Gohil","product":"Aculect AI Companion","kev":false,"epss":0.00161,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39444","published":"2026-10-02T14:46:08.063Z","updated":"2026-10-02T16:48:56.046Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39439","published":"2026-10-02T14:43:15.849Z","updated":"2026-10-02T15:36:35.417Z","title":"WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kiera Howe","product":"WebSamurai","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32585","published":"2026-10-02T14:42:08.710Z","updated":"2026-10-03T15:12:23.899Z","title":"WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"airano","product":"Airano MCP Bridge","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32584","published":"2026-10-02T14:41:03.346Z","updated":"2026-10-02T15:07:45.249Z","title":"WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Chiranjit Hazarika","product":"Smart One Click Setup – Complete Demo Import &amp; Export","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102797","published":"2026-10-02T12:39:34.767Z","updated":"2026-10-02T13:57:00.976Z","title":"WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"ThemeREX Group","product":"ThemeREX Addons","kev":false,"epss":0.00134,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102798","published":"2026-10-02T12:38:28.411Z","updated":"2026-10-02T13:29:59.525Z","title":"WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeREX Group","product":"ThemeREX Addons","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104403","published":"2026-10-02T09:55:28.219Z","updated":"2026-10-03T15:12:24.142Z","title":"WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94180","published":"2026-10-02T09:39:20.551Z","updated":"2026-10-02T17:52:42.348Z","title":"WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Monetizemore","product":"Advanced Ads","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94405","published":"2026-10-02T09:31:18.985Z","updated":"2026-10-02T11:30:53.569Z","title":"WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shahjada","product":"Download Manager","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97280","published":"2026-10-01T14:52:03.158Z","updated":"2026-10-01T15:57:23.782Z","title":"WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Review Schema","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103347","published":"2026-10-01T14:34:07.750Z","updated":"2026-10-01T15:58:15.849Z","title":"WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"hcaptcha","product":"hCaptcha for WP","kev":false,"epss":0.00232,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103068","published":"2026-10-01T14:34:07.010Z","updated":"2026-10-01T16:19:55.947Z","title":"WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ByteCore Stack","product":"ByteCoreStack &#8211; MCP Connector for AI Tools","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102378","published":"2026-10-01T14:34:06.250Z","updated":"2026-10-01T14:57:37.004Z","title":"WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bPlugins","product":"Parallax Section block","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100517","published":"2026-10-01T14:34:05.498Z","updated":"2026-10-30T20:07:13.094Z","title":"WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","kev":false,"epss":0.00318,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100514","published":"2026-10-01T14:34:04.730Z","updated":"2026-10-01T15:59:33.462Z","title":"WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"Pete Nelson","product":"REST API Log","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97297","published":"2026-10-01T14:34:03.987Z","updated":"2026-10-01T16:21:10.765Z","title":"WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Gratisfaction","kev":false,"epss":0.00297,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97284","published":"2026-10-01T14:34:03.248Z","updated":"2026-10-01T14:58:31.778Z","title":"WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Icegram","product":"Icegram","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97281","published":"2026-10-01T14:34:02.504Z","updated":"2026-10-01T15:22:23.232Z","title":"WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97277","published":"2026-10-01T14:34:01.020Z","updated":"2026-10-01T16:01:47.829Z","title":"WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.6,"vendor":"Apps Mav","product":"Social Boost","kev":false,"epss":0.00297,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97273","published":"2026-10-01T14:34:00.261Z","updated":"2026-10-03T15:12:24.277Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97269","published":"2026-10-01T14:33:59.507Z","updated":"2026-10-01T15:00:07.930Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97268","published":"2026-10-01T14:33:58.737Z","updated":"2026-10-01T15:22:50.151Z","title":"WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Wishlist for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97260","published":"2026-10-01T14:33:57.980Z","updated":"2026-10-01T16:02:40.819Z","title":"WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"maxfoundry","product":"MaxGalleria","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97258","published":"2026-10-01T14:33:57.214Z","updated":"2026-10-03T15:12:24.403Z","title":"WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aruba.it","product":"Aruba Migration Tool","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97251","published":"2026-10-01T14:33:56.425Z","updated":"2026-10-01T15:02:09.768Z","title":"WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Bus Ticket Booking with Seat Reservation","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95588","published":"2026-10-01T14:33:55.650Z","updated":"2026-10-01T15:23:18.110Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94390","published":"2026-10-01T14:33:54.882Z","updated":"2026-10-01T16:03:56.330Z","title":"WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Dotstore","product":"Hide Shipping Method For WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62073","published":"2026-10-01T14:33:54.117Z","updated":"2026-10-03T15:12:24.535Z","title":"WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62071","published":"2026-10-01T14:33:53.363Z","updated":"2026-10-01T15:06:25.257Z","title":"WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"nickboss","product":"WordPress File Upload","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103752","published":"2026-10-01T14:33:52.557Z","updated":"2026-10-01T15:23:37.279Z","title":"WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Paul Ryan","product":"Authorizer","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62058","published":"2026-10-01T12:40:18.396Z","updated":"2026-10-01T13:38:59.450Z","title":"WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPExperts","product":"CF7 Apps","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62059","published":"2026-10-01T12:39:49.807Z","updated":"2026-10-01T13:57:56.421Z","title":"WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ultimate Member","product":"Ultimate Member","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62060","published":"2026-10-01T12:39:21.338Z","updated":"2026-10-01T13:12:51.056Z","title":"WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"captivateaudio","product":"Captivate Sync","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62061","published":"2026-10-01T12:38:50.904Z","updated":"2026-10-01T13:07:12.654Z","title":"WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Metagauss","product":"ProfileGrid","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62063","published":"2026-10-01T12:38:26.109Z","updated":"2026-10-01T13:17:34.846Z","title":"WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102394","published":"2026-10-01T12:35:39.808Z","updated":"2026-10-01T13:10:48.460Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103339","published":"2026-10-01T12:34:57.157Z","updated":"2026-10-01T13:12:11.502Z","title":"WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102379","published":"2026-10-01T12:34:14.535Z","updated":"2026-10-02T12:21:28.191Z","title":"WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"BuildKit – Product Builder for WooCommerce – Custom PC Builder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103063","published":"2026-10-01T12:33:43.897Z","updated":"2026-10-01T13:17:59.844Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103345","published":"2026-10-01T12:33:16.274Z","updated":"2026-10-05T06:34:05.575Z","title":"WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103064","published":"2026-10-01T12:32:30.325Z","updated":"2026-10-01T13:52:30.520Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102390","published":"2026-10-01T12:31:32.747Z","updated":"2026-10-01T13:18:20.919Z","title":"WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"AFFI – Affiliate Marketing for WooCommerce","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102382","published":"2026-10-01T12:31:11.263Z","updated":"2026-10-01T13:55:29.926Z","title":"WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102381","published":"2026-10-01T12:28:05.598Z","updated":"2026-10-01T13:40:01.350Z","title":"WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"Majestic Support","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103343","published":"2026-10-01T12:27:40.996Z","updated":"2026-10-01T13:18:56.897Z","title":"WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103341","published":"2026-10-01T12:26:42.885Z","updated":"2026-10-01T13:54:13.692Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103340","published":"2026-10-01T12:26:12.165Z","updated":"2026-10-01T16:28:07.573Z","title":"WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103338","published":"2026-10-01T12:24:10.898Z","updated":"2026-10-01T13:18:39.859Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103067","published":"2026-10-01T12:18:20.988Z","updated":"2026-10-01T13:19:52.849Z","title":"WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8,"vendor":"Memberful","product":"Memberful - Membership Plugin","kev":false,"epss":0.00124,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103336","published":"2026-10-01T11:43:56.597Z","updated":"2026-10-05T06:29:27.908Z","title":"WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Smackcoders Inc.","product":"WP Ultimate CSV Importer","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103353","published":"2026-10-01T10:48:43.088Z","updated":"2026-10-01T16:29:37.061Z","title":"WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-103082","published":"2026-10-01T10:40:12.139Z","updated":"2026-10-01T19:20:47.386Z","title":"WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"LA-Studio","product":"LA-Studio Element Kit for Elementor","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102392","published":"2026-09-30T17:39:08.197Z","updated":"2026-09-30T17:59:54.701Z","title":"WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"ThemeHigh","product":"Extra Product Options For WooCommerce | Custom Product Addons and Fields","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102391","published":"2026-09-30T17:39:07.431Z","updated":"2026-09-30T17:59:54.827Z","title":"WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"jetmonsters","product":"JetFormBuilder","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102377","published":"2026-09-30T17:39:06.666Z","updated":"2026-09-30T17:59:54.957Z","title":"WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"Photo Gallery by 10Web","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102376","published":"2026-09-30T17:39:05.910Z","updated":"2026-09-30T17:59:55.112Z","title":"WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPMU DEV","product":"Branda","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102375","published":"2026-09-30T17:39:05.158Z","updated":"2026-10-07T07:03:08.159Z","title":"WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Optimole","product":"Optimole","kev":false,"epss":0.00264,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100512","published":"2026-09-30T17:39:04.412Z","updated":"2026-09-30T17:59:55.366Z","title":"WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Hook & Filter","product":"Nested Pages","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100510","published":"2026-09-30T17:39:03.526Z","updated":"2026-09-30T17:59:55.497Z","title":"WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97291","published":"2026-09-30T17:39:02.780Z","updated":"2026-09-30T17:59:55.640Z","title":"WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Magazine3","product":"Schema & Structured Data for WP & AMP","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97290","published":"2026-09-30T17:39:02.029Z","updated":"2026-09-30T17:59:55.770Z","title":"WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Sayontan Sinha","product":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97265","published":"2026-09-30T17:39:01.284Z","updated":"2026-09-30T17:59:55.899Z","title":"WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97256","published":"2026-09-30T17:39:00.498Z","updated":"2026-09-30T17:59:56.028Z","title":"WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Greg – SiteOrigin","product":"Page Builder by SiteOrigin","kev":false,"epss":0.00291,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94171","published":"2026-09-30T17:38:59.725Z","updated":"2026-10-05T14:02:30.455Z","title":"WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102397","published":"2026-09-30T17:38:58.949Z","updated":"2026-09-30T17:59:56.305Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00159,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97259","published":"2026-09-30T14:10:24.653Z","updated":"2026-09-30T15:28:07.426Z","title":"WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","kev":false,"epss":0.00213,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62084","published":"2026-09-30T14:03:36.676Z","updated":"2026-09-30T15:28:07.560Z","title":"WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jeff Starr","product":"User Submitted Posts","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62097","published":"2026-09-30T14:02:22.503Z","updated":"2026-09-30T15:28:07.696Z","title":"WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WPTasty","product":"Business Directory","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102399","published":"2026-09-30T12:28:32.997Z","updated":"2026-09-30T13:37:20.578Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.00104,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102398","published":"2026-09-30T12:28:32.242Z","updated":"2026-09-30T13:17:02.812Z","title":"WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102396","published":"2026-09-30T12:28:31.363Z","updated":"2026-09-30T13:37:20.451Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102395","published":"2026-09-30T12:28:30.584Z","updated":"2026-09-30T13:37:20.312Z","title":"WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102386","published":"2026-09-30T12:28:29.823Z","updated":"2026-09-30T13:37:20.049Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102385","published":"2026-09-30T12:28:29.078Z","updated":"2026-09-30T13:37:20.188Z","title":"WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-102384","published":"2026-09-30T12:28:28.331Z","updated":"2026-09-30T13:37:19.911Z","title":"WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Supreme Modules","product":"Supreme Modules Lite","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100513","published":"2026-09-30T12:28:27.585Z","updated":"2026-09-30T13:37:19.781Z","title":"WordPress CF7 Views &#8211; Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100508","published":"2026-09-30T12:28:26.866Z","updated":"2026-09-30T13:37:19.654Z","title":"WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WordPress.org","product":"Two Factor","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-100507","published":"2026-09-30T12:28:26.112Z","updated":"2026-10-07T07:02:38.107Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97302","published":"2026-09-30T12:28:25.365Z","updated":"2026-09-30T13:27:16.701Z","title":"WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Themeisle","product":"MPG","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97301","published":"2026-09-30T12:28:24.611Z","updated":"2026-09-30T13:27:16.577Z","title":"WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cool Plugins","product":"Cool Formkit Lite","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97299","published":"2026-09-30T12:28:23.864Z","updated":"2026-09-30T13:27:16.449Z","title":"WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"KnitPay","product":"Razorpay Payment Links for WooCommerce","kev":false,"epss":0.00095,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97298","published":"2026-09-30T12:28:23.100Z","updated":"2026-09-30T13:27:16.320Z","title":"WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons","product":"King Addons for Elementor","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97293","published":"2026-09-30T12:28:22.351Z","updated":"2026-09-30T13:27:16.193Z","title":"WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97292","published":"2026-09-30T12:28:21.609Z","updated":"2026-09-30T13:27:16.062Z","title":"WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITHEMES","product":"YITH WooCommerce Tab Manager","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97289","published":"2026-09-30T12:28:20.861Z","updated":"2026-10-09T18:13:00.752Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97288","published":"2026-09-30T12:28:20.118Z","updated":"2026-09-30T13:37:19.266Z","title":"WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jayson T Cote","product":"OAuth Server","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97287","published":"2026-09-30T12:28:19.370Z","updated":"2026-10-14T23:27:10.906Z","title":"WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Liquid Web / StellarWP","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97286","published":"2026-09-30T12:28:18.648Z","updated":"2026-10-02T17:45:29.119Z","title":"WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97285","published":"2026-09-30T12:28:17.865Z","updated":"2026-09-30T13:37:18.887Z","title":"WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Nexcess","product":"The Events Calendar","kev":false,"epss":0.002,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97282","published":"2026-09-30T12:28:17.107Z","updated":"2026-09-30T13:37:18.756Z","title":"WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RadiusTheme","product":"Review Schema","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97279","published":"2026-09-30T12:28:16.360Z","updated":"2026-09-30T13:37:18.630Z","title":"WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Chouby","product":"Polylang","kev":false,"epss":0.00149,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97274","published":"2026-09-30T12:28:15.610Z","updated":"2026-09-30T13:37:18.333Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00292,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97272","published":"2026-09-30T12:28:14.868Z","updated":"2026-09-30T13:37:18.204Z","title":"WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premmerce","product":"Premmerce Permalink Manager for WooCommerce","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97271","published":"2026-09-30T12:28:14.127Z","updated":"2026-09-30T13:37:18.077Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97270","published":"2026-09-30T12:28:13.383Z","updated":"2026-09-30T13:27:15.930Z","title":"WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Justin Sternberg","product":"CMB2","kev":false,"epss":0.00166,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97267","published":"2026-09-30T12:28:12.615Z","updated":"2026-09-30T13:27:15.802Z","title":"WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"miniOrange","product":"Prevent files / folders access","kev":false,"epss":0.00213,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97266","published":"2026-09-30T12:28:11.854Z","updated":"2026-09-30T13:27:15.676Z","title":"WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"Virtue/Ascend/Pinnacle Toolkit","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97262","published":"2026-09-30T12:28:11.079Z","updated":"2026-09-30T13:27:15.543Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00127,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97261","published":"2026-09-30T12:28:10.327Z","updated":"2026-09-30T13:27:08.648Z","title":"WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"Notivo","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97253","published":"2026-09-30T12:28:08.717Z","updated":"2026-09-30T13:27:08.380Z","title":"WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kreatura","product":"LayerSlider","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97250","published":"2026-09-30T12:28:07.760Z","updated":"2026-09-30T13:37:17.941Z","title":"WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97249","published":"2026-09-30T12:28:06.973Z","updated":"2026-09-30T13:27:17.094Z","title":"WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00191,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97248","published":"2026-09-30T12:28:06.228Z","updated":"2026-09-30T13:27:16.950Z","title":"WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97247","published":"2026-09-30T12:28:05.461Z","updated":"2026-09-30T13:27:16.830Z","title":"WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Creative Themes","product":"Blocksy Companion","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97246","published":"2026-09-30T12:28:04.695Z","updated":"2026-10-20T13:59:39.610Z","title":"WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability","severity":"MEDIUM","score":4.9,"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","kev":false,"epss":0.00208,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97245","published":"2026-09-30T12:28:03.954Z","updated":"2026-09-30T13:27:08.243Z","title":"WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"SureCart","product":"SureCart","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97244","published":"2026-09-30T12:28:03.190Z","updated":"2026-09-30T13:27:08.110Z","title":"WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97243","published":"2026-09-30T12:28:02.395Z","updated":"2026-09-30T13:27:07.953Z","title":"WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"flexyma","product":"AllAble Connector","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97242","published":"2026-09-30T12:28:01.650Z","updated":"2026-09-30T13:27:15.413Z","title":"WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"phuongwebo","product":"WEBO MCP","kev":false,"epss":0.0035,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97241","published":"2026-09-30T12:28:00.895Z","updated":"2026-09-30T13:27:15.143Z","title":"WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"PrecisionWP","product":"BackupEase","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97240","published":"2026-09-30T12:28:00.148Z","updated":"2026-09-30T13:27:15.282Z","title":"WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Esteban","product":"StifLi Backup Tools","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97239","published":"2026-09-30T12:27:59.387Z","updated":"2026-09-30T13:27:15.004Z","title":"WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Jose Conti","product":"MCP Content Manager Lite","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97238","published":"2026-09-30T12:27:58.524Z","updated":"2026-09-30T13:27:14.865Z","title":"WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00164,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97237","published":"2026-09-30T12:27:57.787Z","updated":"2026-10-22T16:52:23.467Z","title":"WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97236","published":"2026-09-30T12:27:56.815Z","updated":"2026-09-30T13:27:14.608Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97235","published":"2026-09-30T12:27:55.821Z","updated":"2026-09-30T13:27:14.478Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97197","published":"2026-09-30T12:27:54.798Z","updated":"2026-09-30T13:27:14.350Z","title":"WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WebToffee","product":"WordPress Backup & Migration","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97079","published":"2026-09-30T12:27:54.052Z","updated":"2026-09-30T13:27:14.224Z","title":"WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Webba Appointment Booking","product":"Webba Booking","kev":false,"epss":0.00273,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97078","published":"2026-09-30T12:27:53.286Z","updated":"2026-09-30T13:27:07.807Z","title":"WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97077","published":"2026-09-30T12:27:52.515Z","updated":"2026-09-30T13:27:07.680Z","title":"WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Spacetime","product":"Ad Inserter","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97074","published":"2026-09-30T12:27:51.694Z","updated":"2026-09-30T13:27:07.547Z","title":"WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Omnisend","product":"Newsletters, Email Marketing, SMS and Popups by Omnisend","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97067","published":"2026-09-30T12:27:50.923Z","updated":"2026-09-30T13:27:07.418Z","title":"WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shane Bishop","product":"EWWW Image Optimizer","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97066","published":"2026-09-30T12:27:49.985Z","updated":"2026-09-30T13:27:05.026Z","title":"WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97065","published":"2026-09-30T12:27:49.261Z","updated":"2026-09-30T13:27:04.897Z","title":"WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Happyforms","product":"Happyforms","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96838","published":"2026-09-30T12:27:48.524Z","updated":"2026-09-30T13:17:04.399Z","title":"WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"YoOhw Studio","product":"Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification","kev":false,"epss":0.00139,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96837","published":"2026-09-30T12:27:47.787Z","updated":"2026-09-30T13:27:14.092Z","title":"WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":8.8,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00525,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96836","published":"2026-09-30T12:27:47.052Z","updated":"2026-09-30T13:27:13.962Z","title":"WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Morteza Geransayeh","product":"Parsi Date","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96835","published":"2026-09-30T12:27:46.298Z","updated":"2026-09-30T13:27:13.573Z","title":"WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96834","published":"2026-09-30T12:27:45.550Z","updated":"2026-09-30T13:27:13.706Z","title":"WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96833","published":"2026-09-30T12:27:44.788Z","updated":"2026-09-30T13:27:13.430Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00388,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96832","published":"2026-09-30T12:27:43.538Z","updated":"2026-09-30T13:27:13.298Z","title":"WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"keywordrush","product":"Content Egg","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96831","published":"2026-09-30T12:27:42.335Z","updated":"2026-09-30T13:27:13.155Z","title":"WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"themifyme","product":"Themify Builder","kev":false,"epss":0.00344,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96830","published":"2026-09-30T12:27:41.532Z","updated":"2026-09-30T13:27:13.017Z","title":"WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96829","published":"2026-09-30T12:27:40.717Z","updated":"2026-09-30T13:27:12.888Z","title":"WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96828","published":"2026-09-30T12:27:39.866Z","updated":"2026-09-30T13:27:12.757Z","title":"WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Vidish","product":"Category Discount Woocommerce","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96827","published":"2026-09-30T12:27:38.966Z","updated":"2026-09-30T13:17:04.260Z","title":"WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melapress","product":"Admin Notices Manager","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96825","published":"2026-09-30T12:27:38.067Z","updated":"2026-09-30T13:17:03.968Z","title":"WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.2,"vendor":"David Anderson / Team Updraft","product":"All In One WP Security & Firewall","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96824","published":"2026-09-30T12:27:37.224Z","updated":"2026-09-30T13:17:04.118Z","title":"WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"envato","product":"Template Kit – Import","kev":false,"epss":0.00378,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96823","published":"2026-09-30T12:27:36.403Z","updated":"2026-09-30T13:27:07.293Z","title":"WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.5,"vendor":"CusRev","product":"Customer Reviews for WooCommerce","kev":false,"epss":0.00314,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96822","published":"2026-09-30T12:27:35.569Z","updated":"2026-09-30T13:27:07.162Z","title":"WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Hossni Mubarak","product":"Books Gallery","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96821","published":"2026-09-30T12:27:34.720Z","updated":"2026-09-30T13:27:07.022Z","title":"WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96820","published":"2026-09-30T12:27:33.889Z","updated":"2026-09-30T13:27:12.633Z","title":"WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"awesomesupport","product":"Awesome Support","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96819","published":"2026-09-30T12:27:33.090Z","updated":"2026-09-30T13:27:12.502Z","title":"WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bobbingwide","product":"oik","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96818","published":"2026-09-30T12:27:32.267Z","updated":"2026-09-30T13:27:12.372Z","title":"WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"mra13 / Team Tips and Tricks HQ","product":"WP Express Checkout (Accept PayPal Payments)","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96817","published":"2026-09-30T12:27:31.463Z","updated":"2026-09-30T13:27:12.234Z","title":"WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.2,"vendor":"MakeCommerce.net","product":"MakeCommerce for WooCommerce","kev":false,"epss":0.00365,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96816","published":"2026-09-30T12:27:30.621Z","updated":"2026-09-30T13:27:12.097Z","title":"WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"vendidero","product":"Trusted Shops Easy Integration for WooCommerce","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96815","published":"2026-09-30T12:27:29.805Z","updated":"2026-09-30T13:27:11.963Z","title":"WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"appsbd","product":"Vitepos","kev":false,"epss":0.00307,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96814","published":"2026-09-30T12:27:28.946Z","updated":"2026-09-30T13:27:11.837Z","title":"WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Titan Labs","product":"WooCommerce Product Table Lite","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96450","published":"2026-09-30T12:27:28.155Z","updated":"2026-09-30T13:27:11.697Z","title":"WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"pixfort","product":"pixfort Core","kev":false,"epss":0.00157,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96352","published":"2026-09-30T12:27:27.335Z","updated":"2026-09-30T13:27:11.550Z","title":"WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"YITHEMES","product":"YITH WooCommerce Ajax Search","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96351","published":"2026-09-30T12:27:26.574Z","updated":"2026-09-30T13:27:11.423Z","title":"WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RadiusTheme","product":"Classified Listing","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96350","published":"2026-09-30T12:27:25.767Z","updated":"2026-09-30T13:27:06.899Z","title":"WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96349","published":"2026-09-30T12:27:24.923Z","updated":"2026-09-30T13:27:06.769Z","title":"WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00728,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96348","published":"2026-09-30T12:27:24.147Z","updated":"2026-09-30T13:27:06.638Z","title":"WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00258,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96347","published":"2026-09-30T12:27:23.350Z","updated":"2026-09-30T13:27:06.513Z","title":"WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bookly","product":"Bookly","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96346","published":"2026-09-30T12:27:22.510Z","updated":"2026-09-30T13:27:06.385Z","title":"WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96345","published":"2026-09-30T12:27:21.780Z","updated":"2026-09-30T13:27:11.293Z","title":"WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96344","published":"2026-09-30T12:27:19.627Z","updated":"2026-09-30T13:27:11.167Z","title":"WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"impleCode","product":"eCommerce Product Catalog","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96343","published":"2026-09-30T12:27:18.779Z","updated":"2026-09-30T13:27:11.041Z","title":"WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"weDevs","product":"WP ERP","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96338","published":"2026-09-30T12:27:17.984Z","updated":"2026-09-30T13:27:10.891Z","title":"WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95587","published":"2026-09-30T12:27:17.181Z","updated":"2026-09-30T13:27:10.763Z","title":"WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Hostinger","product":"Hostinger Migrator","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95531","published":"2026-09-30T12:27:16.378Z","updated":"2026-09-30T13:27:10.632Z","title":"WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","kev":false,"epss":0.00468,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94683","published":"2026-09-30T12:27:15.502Z","updated":"2026-09-30T13:27:10.504Z","title":"WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Justin Nealey","product":"DesignSetGo","kev":false,"epss":0.00344,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94681","published":"2026-09-30T12:27:14.658Z","updated":"2026-09-30T13:27:10.239Z","title":"WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Tijmen Smit","product":"WP Store Locator","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94678","published":"2026-09-30T12:27:13.854Z","updated":"2026-09-30T13:27:10.375Z","title":"WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Mat Lipe","product":"Go Live Update Urls","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94677","published":"2026-09-30T12:27:13.048Z","updated":"2026-09-30T13:27:09.970Z","title":"WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Nexcess","product":"Kadence WooCommerce Email Designer","kev":false,"epss":0.00388,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94674","published":"2026-09-30T12:27:12.235Z","updated":"2026-09-30T13:27:06.245Z","title":"WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SweetCode","product":"Pixel Manager for WooCommerce","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94673","published":"2026-09-30T12:27:11.419Z","updated":"2026-09-30T13:27:06.112Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94672","published":"2026-09-30T12:27:10.606Z","updated":"2026-09-30T13:17:03.818Z","title":"WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"10up","product":"Safe SVG","kev":false,"epss":0.00206,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94499","published":"2026-09-30T12:27:09.786Z","updated":"2026-09-30T13:17:03.532Z","title":"WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"wpWax","product":"FormGent","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94389","published":"2026-09-30T12:27:08.993Z","updated":"2026-09-30T13:17:03.665Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00448,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94178","published":"2026-09-30T12:27:08.189Z","updated":"2026-09-30T13:17:03.251Z","title":"WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability","severity":"HIGH","score":7.5,"vendor":"Javier Carazo","product":"Import and export users and customers","kev":false,"epss":0.00295,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94177","published":"2026-09-30T12:27:07.360Z","updated":"2026-10-17T08:26:28.978Z","title":"WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Ruben Garcia","product":"GamiPress","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94173","published":"2026-09-30T12:27:06.473Z","updated":"2026-09-30T13:17:02.231Z","title":"WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94123","published":"2026-09-30T12:27:05.399Z","updated":"2026-09-30T13:17:02.051Z","title":"WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"NextGEN Gallery","kev":false,"epss":0.00391,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94122","published":"2026-09-30T12:27:04.523Z","updated":"2026-09-30T13:27:05.961Z","title":"WordPress Responsive Slider Gallery  plugin <= 1.5.5 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"A WP Life","product":"Responsive Slider Gallery","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94121","published":"2026-09-30T12:27:03.753Z","updated":"2026-09-30T13:27:05.814Z","title":"WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"10Web","product":"10Web Booster – Website speed optimization, Cache & Page Speed optimizer","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94120","published":"2026-09-30T12:27:02.938Z","updated":"2026-09-30T13:27:05.684Z","title":"WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"GravityKit","product":"GravityExport Lite for Gravity Forms","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94115","published":"2026-09-30T12:27:02.147Z","updated":"2026-09-30T13:27:05.553Z","title":"WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Fatcatapps","product":"Easy Pricing Tables","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94082","published":"2026-09-30T12:27:01.383Z","updated":"2026-09-30T13:27:05.423Z","title":"WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Fatcatapps","product":"Quiz Cat","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94081","published":"2026-09-30T12:27:00.402Z","updated":"2026-09-30T13:27:10.108Z","title":"WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"lukeseager","product":"WordPress Persistent Login","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94078","published":"2026-09-30T12:26:59.634Z","updated":"2026-09-30T13:27:09.841Z","title":"WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94077","published":"2026-09-30T12:26:58.862Z","updated":"2026-09-30T13:27:09.698Z","title":"WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"10up","product":"Safe SVG","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94076","published":"2026-09-30T12:26:57.989Z","updated":"2026-09-30T13:27:09.558Z","title":"WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00344,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94074","published":"2026-09-30T12:26:57.128Z","updated":"2026-09-30T13:27:09.429Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93771","published":"2026-09-30T12:26:56.235Z","updated":"2026-09-30T13:27:09.303Z","title":"WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WPFactory","product":"Cost of Goods for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93770","published":"2026-09-30T12:26:55.398Z","updated":"2026-09-30T13:27:09.170Z","title":"WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93651","published":"2026-09-30T12:26:54.433Z","updated":"2026-09-30T13:27:09.037Z","title":"WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Dotstore","product":"Minimum and Maximum Quantity for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93624","published":"2026-09-30T12:26:53.638Z","updated":"2026-09-30T13:27:08.911Z","title":"WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"codepeople","product":"Music Player for WooCommerce","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93621","published":"2026-09-30T12:26:52.861Z","updated":"2026-09-30T13:27:08.774Z","title":"WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability","severity":"HIGH","score":8.2,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93514","published":"2026-09-30T12:26:52.122Z","updated":"2026-09-30T13:17:01.912Z","title":"WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rainafarai","product":"Notification for Telegram","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93512","published":"2026-09-30T12:26:51.372Z","updated":"2026-09-30T13:27:05.293Z","title":"WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ilGhera","product":"JW Player for WordPress","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62085","published":"2026-09-30T12:26:50.618Z","updated":"2026-09-30T13:17:01.772Z","title":"WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62083","published":"2026-09-30T12:26:49.874Z","updated":"2026-09-30T13:27:05.160Z","title":"WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPFunnels","product":"Creator LMS","kev":false,"epss":0.00233,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62081","published":"2026-09-30T12:26:49.127Z","updated":"2026-09-30T13:17:01.642Z","title":"WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpdesk","product":"Flexible PDF Coupons","kev":false,"epss":0.00209,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62080","published":"2026-09-30T12:26:48.383Z","updated":"2026-09-30T13:17:03.388Z","title":"WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leevio","product":"Happy Addons for Elementor","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62079","published":"2026-09-30T12:26:47.617Z","updated":"2026-09-30T13:17:03.111Z","title":"WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Qode","product":"Qi Addons For Elementor","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62078","published":"2026-09-30T12:26:46.872Z","updated":"2026-09-30T13:17:02.953Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27371","published":"2026-09-30T12:26:46.112Z","updated":"2026-09-30T13:17:02.664Z","title":"WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00175,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27085","published":"2026-09-30T12:26:45.369Z","updated":"2026-09-30T13:17:02.530Z","title":"WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability","severity":"LOW","score":2.7,"vendor":"Brainstorm Force","product":"Astra WordPress Theme","kev":false,"epss":0.00227,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96342","published":"2026-09-30T11:00:18.127Z","updated":"2026-09-30T13:37:20.706Z","title":"WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.9,"vendor":"Amauri.IO","product":"WPMobile.App","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-97196","published":"2026-09-30T06:55:06.819Z","updated":"2026-09-30T13:37:20.996Z","title":"WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.00441,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62062","published":"2026-09-25T06:29:47.521Z","updated":"2026-09-25T13:30:26.115Z","title":"WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00189,"kevAdded":null,"exploit":false},{"id":"CVE-2026-96826","published":"2026-09-23T19:28:55.531Z","updated":"2026-09-24T10:42:07.538Z","title":"WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Shazzad Hossain Khan","product":"W4 Post List","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95604","published":"2026-09-23T18:14:50.570Z","updated":"2026-09-23T18:46:50.844Z","title":"WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Tangible","product":"Loops & Logic","kev":false,"epss":0.00437,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95603","published":"2026-09-23T18:14:49.838Z","updated":"2026-09-23T19:27:12.535Z","title":"WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Victor Rodriguez","product":"Reycob Product Import Export","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95602","published":"2026-09-23T18:14:49.104Z","updated":"2026-09-23T18:46:50.982Z","title":"WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Request A Quote","kev":false,"epss":0.00363,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95601","published":"2026-09-23T18:14:48.373Z","updated":"2026-09-23T18:25:50.466Z","title":"WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW Plugins","product":"Product Filter by WBW","kev":false,"epss":0.00283,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95600","published":"2026-09-23T18:14:47.636Z","updated":"2026-09-23T19:42:21.963Z","title":"WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TrustedLogin","product":"TrustedLogin Connector","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95593","published":"2026-09-23T18:14:46.892Z","updated":"2026-09-23T18:46:51.132Z","title":"WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ben Roberts","product":"Ultimeter","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95592","published":"2026-09-23T18:14:46.168Z","updated":"2026-09-23T19:26:53.613Z","title":"WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Oleh RadiusTheme","product":"Team","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95590","published":"2026-09-23T18:14:45.310Z","updated":"2026-09-23T18:46:51.262Z","title":"WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"tainacan","product":"Tainacan","kev":false,"epss":0.00286,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95586","published":"2026-09-23T18:14:44.579Z","updated":"2026-09-23T18:34:23.855Z","title":"WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95530","published":"2026-09-23T18:14:43.846Z","updated":"2026-09-23T19:42:31.544Z","title":"WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PixelYourSite","product":"PixelYourSite – Your smart PIXEL (TAG) Manager","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95529","published":"2026-09-23T18:14:43.141Z","updated":"2026-09-23T18:46:51.417Z","title":"WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Calculated Fields Form","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95528","published":"2026-09-23T18:14:42.372Z","updated":"2026-09-23T19:26:39.019Z","title":"WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohammed Kaludi","product":"Core Web Vitals & PageSpeed Booster","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95527","published":"2026-09-23T18:14:41.354Z","updated":"2026-09-23T18:46:51.553Z","title":"WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Conekta Group","product":"Conekta Payment Gateway","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95525","published":"2026-09-23T18:14:40.636Z","updated":"2026-09-23T18:36:39.143Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.0047,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95524","published":"2026-09-23T18:14:39.894Z","updated":"2026-09-23T19:42:37.920Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00329,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95523","published":"2026-09-23T18:14:39.173Z","updated":"2026-09-23T18:46:51.704Z","title":"WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95522","published":"2026-09-23T18:14:38.436Z","updated":"2026-09-23T19:26:24.994Z","title":"WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Syed Balkhi","product":"Easy Digital Downloads","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95515","published":"2026-09-23T18:14:37.715Z","updated":"2026-09-23T18:46:51.847Z","title":"WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kevin Stover","product":"Ninja Forms","kev":false,"epss":0.00195,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95514","published":"2026-09-23T18:14:36.996Z","updated":"2026-09-23T18:39:02.472Z","title":"WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"netgsm","product":"Netgsm","kev":false,"epss":0.00329,"kevAdded":null,"exploit":false},{"id":"CVE-2026-95513","published":"2026-09-23T18:14:36.285Z","updated":"2026-09-23T19:42:44.139Z","title":"WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94682","published":"2026-09-23T18:14:34.839Z","updated":"2026-09-23T19:26:09.370Z","title":"WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"SecondLineThemes","product":"Podcast Importer SecondLine","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94680","published":"2026-09-23T18:14:34.115Z","updated":"2026-09-23T18:46:52.161Z","title":"WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"The Post Grid","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94679","published":"2026-09-23T18:14:33.387Z","updated":"2026-09-23T18:42:48.734Z","title":"WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPManageNinja","product":"Fluent Support","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94671","published":"2026-09-23T18:14:32.684Z","updated":"2026-09-23T19:42:51.020Z","title":"WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"The Post Grid","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94500","published":"2026-09-23T18:14:31.298Z","updated":"2026-09-23T18:46:52.294Z","title":"WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Roxnor","product":"ElementsKit Elementor addons Lite","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94498","published":"2026-09-23T18:14:30.567Z","updated":"2026-09-23T19:25:53.895Z","title":"WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AppMySite","product":"AppMySite","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94487","published":"2026-09-23T18:14:29.856Z","updated":"2026-09-23T18:46:52.418Z","title":"WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"PublishPress","product":"PublishPress Capabilities","kev":false,"epss":0.00132,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94461","published":"2026-09-23T18:14:28.137Z","updated":"2026-09-23T18:50:46.605Z","title":"WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94457","published":"2026-09-23T18:14:27.365Z","updated":"2026-09-23T19:43:23.776Z","title":"WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":4.8,"vendor":"WebFactory","product":"Captcha Code","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94391","published":"2026-09-23T18:14:26.644Z","updated":"2026-09-23T18:46:52.545Z","title":"WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Rustaurius","product":"Ultimate FAQ","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94179","published":"2026-09-23T18:14:25.872Z","updated":"2026-09-23T19:25:37.658Z","title":"WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Razorpay","product":"Razorpay Payment Button","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94176","published":"2026-09-23T18:14:25.127Z","updated":"2026-09-23T18:46:52.679Z","title":"WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94174","published":"2026-09-23T18:14:24.410Z","updated":"2026-09-23T18:54:11.830Z","title":"WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WebFactory","product":"Email Log","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94168","published":"2026-09-23T18:14:23.687Z","updated":"2026-09-23T19:43:29.758Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Addons for Elementor","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94124","published":"2026-09-23T18:14:22.961Z","updated":"2026-09-23T18:46:52.813Z","title":"WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"levelfourdevelopment","product":"WP EasyCart","kev":false,"epss":0.00222,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94118","published":"2026-09-23T18:14:22.243Z","updated":"2026-09-23T19:25:21.529Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Leap13","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94080","published":"2026-09-23T18:14:21.380Z","updated":"2026-09-23T18:46:52.934Z","title":"WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WebWizards","product":"MarketKing","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94079","published":"2026-09-23T18:14:20.664Z","updated":"2026-09-23T18:57:17.565Z","title":"WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93774","published":"2026-09-23T18:14:19.956Z","updated":"2026-09-23T19:43:35.854Z","title":"WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93773","published":"2026-09-23T18:14:19.241Z","updated":"2026-09-23T18:46:53.072Z","title":"WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Nick van Wobbie","product":"Mollie Forms","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93772","published":"2026-09-23T18:14:18.502Z","updated":"2026-09-23T19:25:06.505Z","title":"WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Tomdever","product":"wpForo Forum","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93623","published":"2026-09-23T18:14:17.778Z","updated":"2026-09-23T18:46:53.207Z","title":"WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Jordy Meow","product":"AI Engine","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93622","published":"2026-09-23T18:14:17.046Z","updated":"2026-09-23T18:59:56.937Z","title":"WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NicolasKulka","product":"WPS Limit Login","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93620","published":"2026-09-23T18:14:16.298Z","updated":"2026-09-23T19:43:43.342Z","title":"WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PayPlus Tech Team","product":"PayPlus Payment Gateway","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93618","published":"2026-09-23T18:14:15.577Z","updated":"2026-09-23T18:46:53.343Z","title":"WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetTricks","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93529","published":"2026-09-23T18:14:14.854Z","updated":"2026-09-23T19:24:50.495Z","title":"WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bilal Naseer","product":"WSP MCP &#8211; AI Agents Connector","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93527","published":"2026-09-23T18:14:14.113Z","updated":"2026-09-23T18:46:53.472Z","title":"WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"bdthemes","product":"Live Copy Paste for Elementor","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93526","published":"2026-09-23T18:14:13.387Z","updated":"2026-09-23T19:08:47.786Z","title":"WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93513","published":"2026-09-23T18:14:12.633Z","updated":"2026-09-23T19:43:49.626Z","title":"WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-94117","published":"2026-09-22T09:13:36.705Z","updated":"2026-09-22T10:15:28.375Z","title":"WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"DevItems","product":"HashBar – WordPress Notification Bar","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93928","published":"2026-09-22T08:42:37.147Z","updated":"2026-09-22T13:08:49.964Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00401,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93485","published":"2026-09-18T06:00:05.645Z","updated":"2026-10-17T08:25:50.124Z","title":"WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Automattic","product":"WordPress","kev":false,"epss":0.0076,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90887","published":"2026-09-17T13:24:58.522Z","updated":"2026-09-17T19:21:22.345Z","title":"WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Inventory","product":"WP Inventory Manager","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78528","published":"2026-09-17T13:24:57.875Z","updated":"2026-09-19T02:24:15.823Z","title":"WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BerqWP","product":"BerqWP","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78295","published":"2026-09-17T13:24:57.232Z","updated":"2026-09-17T14:07:07.641Z","title":"WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Xagio SEO","product":"Xagio SEO","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78294","published":"2026-09-17T13:24:56.581Z","updated":"2026-09-19T14:21:53.594Z","title":"WordPress  Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74017","published":"2026-09-17T13:24:55.939Z","updated":"2026-09-17T14:30:41.571Z","title":"WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74005","published":"2026-09-17T13:24:54.225Z","updated":"2026-09-17T19:21:28.548Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74002","published":"2026-09-17T13:24:53.587Z","updated":"2026-09-19T02:23:47.056Z","title":"WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74000","published":"2026-09-17T13:24:52.941Z","updated":"2026-09-17T14:06:46.131Z","title":"WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wp.insider","product":"Simple Membership","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73999","published":"2026-09-17T13:24:52.301Z","updated":"2026-09-19T14:21:53.749Z","title":"WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Gora Tech","product":"Cooked","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66676","published":"2026-09-17T13:24:51.602Z","updated":"2026-09-17T14:33:02.524Z","title":"WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"MatrixAddons","product":"Easy Invoice","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66631","published":"2026-09-17T13:24:50.942Z","updated":"2026-09-17T19:21:37.254Z","title":"WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Moreconvert Team","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66630","published":"2026-09-17T13:24:50.289Z","updated":"2026-09-19T02:23:16.128Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66628","published":"2026-09-17T13:24:49.626Z","updated":"2026-09-17T14:06:13.580Z","title":"WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WP Lab","product":"WP-Lister Lite for eBay","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66626","published":"2026-09-17T13:24:48.985Z","updated":"2026-09-19T14:21:53.896Z","title":"WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Sonal S Sinha","product":"SKT Addons for Elementor","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66625","published":"2026-09-17T13:24:48.331Z","updated":"2026-09-17T15:26:01.133Z","title":"WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WCVendors","product":"WC Vendors Marketplace","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66624","published":"2026-09-17T13:24:47.681Z","updated":"2026-09-17T19:21:47.942Z","title":"WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Ludwig You","product":"WPMasterToolKit","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66619","published":"2026-09-17T13:24:47.029Z","updated":"2026-09-19T02:22:48.512Z","title":"WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Tribulant Software","product":"Newsletters","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66618","published":"2026-09-17T13:24:46.386Z","updated":"2026-09-17T14:05:51.372Z","title":"WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Flipper Code","product":"WP Maps","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66617","published":"2026-09-17T13:24:45.744Z","updated":"2026-09-19T14:21:54.044Z","title":"WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66608","published":"2026-09-17T13:24:45.051Z","updated":"2026-09-17T14:33:50.066Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66580","published":"2026-09-17T13:24:44.347Z","updated":"2026-09-17T19:21:55.178Z","title":"WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"RexTheme","product":"Product Feed Manager","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66579","published":"2026-09-17T13:24:43.688Z","updated":"2026-09-19T02:22:13.087Z","title":"WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetElements For Elementor","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66578","published":"2026-09-17T13:24:43.035Z","updated":"2026-09-17T14:05:02.237Z","title":"WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Property Hive","product":"PropertyHive","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66577","published":"2026-09-17T13:24:42.357Z","updated":"2026-09-19T14:21:54.197Z","title":"WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetSearch","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66576","published":"2026-09-17T13:24:41.678Z","updated":"2026-09-17T14:39:34.318Z","title":"WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBlocks For Elementor","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66575","published":"2026-09-17T13:24:41.005Z","updated":"2026-09-17T19:22:10.042Z","title":"WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"KingAddons.com","product":"King Addons for Elementor","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66574","published":"2026-09-17T13:24:40.352Z","updated":"2026-09-19T02:21:38.543Z","title":"WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bdthemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66573","published":"2026-09-17T13:24:39.688Z","updated":"2026-09-17T14:04:42.971Z","title":"WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetTabs","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66572","published":"2026-09-17T13:24:39.046Z","updated":"2026-09-19T14:21:54.344Z","title":"WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetBlog","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66571","published":"2026-09-17T13:24:38.306Z","updated":"2026-09-17T14:41:12.773Z","title":"WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gabe Livan","product":"Asset CleanUp: Page Speed Booster","kev":false,"epss":0.00128,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62108","published":"2026-09-17T13:24:37.654Z","updated":"2026-09-17T19:22:16.573Z","title":"WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62104","published":"2026-09-17T13:24:37.003Z","updated":"2026-09-19T02:18:44.706Z","title":"WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"superweby","product":"Migratico Lite","kev":false,"epss":0.0086,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62101","published":"2026-09-17T13:24:36.362Z","updated":"2026-09-17T14:04:06.181Z","title":"WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Chris Åkerfeldt Wendel","product":"EduAdmin Booking","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90986","published":"2026-09-17T13:24:35.727Z","updated":"2026-09-17T14:42:47.713Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CODEPRESS IT Solutions LLC","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78296","published":"2026-09-17T11:05:56.771Z","updated":"2026-09-19T14:21:54.487Z","title":"WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"FluentAuth","kev":false,"epss":0.00158,"kevAdded":null,"exploit":false},{"id":"CVE-2026-92465","published":"2026-09-16T11:29:12.124Z","updated":"2026-09-16T15:52:52.488Z","title":"WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Themeum","product":"WP Mega Menu","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62088","published":"2026-09-11T18:26:40.927Z","updated":"2026-09-11T20:28:43.826Z","title":"WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"10up","product":"ElasticPress","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62089","published":"2026-09-11T18:16:57.519Z","updated":"2026-09-11T20:19:10.568Z","title":"WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Pixar Labs","product":"Master Addons for Elementor","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62139","published":"2026-09-11T18:12:14.315Z","updated":"2026-09-11T19:29:07.431Z","title":"WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Google","product":"Site Kit by Google","kev":false,"epss":0.00101,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62138","published":"2026-09-11T18:12:13.656Z","updated":"2026-09-11T19:40:26.682Z","title":"WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Visual Composer","product":"Visual Composer Website Builder","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62137","published":"2026-09-11T18:12:13.003Z","updated":"2026-09-11T20:19:10.766Z","title":"WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John James Jacoby","product":"bbPress","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62136","published":"2026-09-11T18:12:12.338Z","updated":"2026-09-11T20:28:51.630Z","title":"WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdesk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62135","published":"2026-09-11T18:12:11.688Z","updated":"2026-09-11T20:19:10.946Z","title":"WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62134","published":"2026-09-11T18:12:11.038Z","updated":"2026-09-11T19:29:50.563Z","title":"WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Brainstorm Force","product":"Starter Templates","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62133","published":"2026-09-11T18:12:10.385Z","updated":"2026-09-11T19:43:11.318Z","title":"WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62132","published":"2026-09-11T18:12:09.722Z","updated":"2026-09-11T20:19:11.115Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62114","published":"2026-09-11T18:12:09.075Z","updated":"2026-09-11T20:28:58.557Z","title":"WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62113","published":"2026-09-11T18:12:08.417Z","updated":"2026-09-11T20:19:11.274Z","title":"WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Anh Tran","product":"Slim SEO","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62112","published":"2026-09-11T18:12:07.755Z","updated":"2026-09-11T19:30:36.353Z","title":"WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Melograno Venture Studio","product":"Amelia","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62111","published":"2026-09-11T18:12:07.099Z","updated":"2026-09-11T19:45:17.374Z","title":"WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62110","published":"2026-09-11T18:12:06.441Z","updated":"2026-09-11T20:19:11.447Z","title":"WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"boldthemes","product":"Bold Page Builder","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62109","published":"2026-09-11T18:12:05.789Z","updated":"2026-09-11T20:29:07.154Z","title":"WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"wowDevs","product":"Sky Addons for Elementor","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62107","published":"2026-09-11T18:12:05.129Z","updated":"2026-09-11T20:19:11.606Z","title":"WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"masteriyo","product":"Masteriyo - LMS","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62106","published":"2026-09-11T18:12:04.468Z","updated":"2026-09-11T19:31:10.351Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62105","published":"2026-09-11T18:12:03.817Z","updated":"2026-09-11T19:46:19.109Z","title":"WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeRex","product":"ThemeREX Addons","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62103","published":"2026-09-11T18:12:03.157Z","updated":"2026-09-11T20:19:11.777Z","title":"WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpeverest","product":"Everest Forms","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62102","published":"2026-09-11T18:12:02.495Z","updated":"2026-09-11T20:29:14.133Z","title":"WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Gato GraphQL","product":"Gato GraphQL","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27378","published":"2026-09-11T18:12:01.830Z","updated":"2026-09-11T19:31:40.813Z","title":"WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"magepeopleteam","product":"Deposits and Partial Payments for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62140","published":"2026-09-11T18:12:01.178Z","updated":"2026-09-11T20:19:11.936Z","title":"WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ExpressTech Systems","product":"Quiz And Survey Master","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84821","published":"2026-09-10T14:23:52.549Z","updated":"2026-09-10T14:53:15.486Z","title":"WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Epsiloncool","product":"WP Fast Total Search","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84819","published":"2026-09-10T14:23:51.889Z","updated":"2026-09-10T17:46:49.586Z","title":"WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Greg Winiarski","product":"WPAdverts","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84816","published":"2026-09-10T14:23:51.226Z","updated":"2026-09-11T20:19:12.902Z","title":"WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"RealMag777","product":"WPCS","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81805","published":"2026-09-10T14:23:50.566Z","updated":"2026-09-10T15:10:00.876Z","title":"WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"SiteSkite","product":"SiteSkite","kev":false,"epss":0.00373,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81804","published":"2026-09-10T14:23:49.922Z","updated":"2026-09-10T21:00:25.193Z","title":"WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Zain Hassan","product":"ZHBackup – Backup, Restore &amp; Migration","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81803","published":"2026-09-10T14:23:49.263Z","updated":"2026-09-10T14:53:46.827Z","title":"WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.5,"vendor":"Ateeq Rafeeq","product":"RepairBuddy","kev":false,"epss":0.00582,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81801","published":"2026-09-10T14:23:48.615Z","updated":"2026-09-10T17:46:59.598Z","title":"WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability","severity":"HIGH","score":8.1,"vendor":"UDX Usability Dynamics","product":"WP-Stateless","kev":false,"epss":0.00378,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81800","published":"2026-09-10T14:23:47.971Z","updated":"2026-09-11T20:19:13.077Z","title":"WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Par avisverifies","product":"Verified Reviews (Avis Vérifiés)","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81799","published":"2026-09-10T14:23:47.342Z","updated":"2026-11-02T06:43:27.845Z","title":"WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Swings","product":"Return Refund and Exchange For WooCommerce","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81796","published":"2026-09-10T14:23:46.684Z","updated":"2026-09-21T10:58:40.731Z","title":"WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"WEN Solutions","product":"WP Travel","kev":false,"epss":0.00401,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81795","published":"2026-09-10T14:23:46.022Z","updated":"2026-09-10T14:54:53.546Z","title":"WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Denis Botić","product":"Page Visits Counter &#8211; Lite","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81794","published":"2026-09-10T14:23:45.369Z","updated":"2026-09-10T17:47:08.914Z","title":"WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"mlfactory","product":"Shirt Product Designer for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81793","published":"2026-09-10T14:23:44.728Z","updated":"2026-10-05T07:02:00.669Z","title":"WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81791","published":"2026-09-10T14:23:44.073Z","updated":"2026-09-10T15:08:51.334Z","title":"WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ashan Perera","product":"EventON","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81789","published":"2026-09-10T14:23:43.376Z","updated":"2026-09-11T13:55:46.684Z","title":"WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Studio Wombat","product":"Advanced Product Fields Extended for WooCommerce","kev":false,"epss":0.00533,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81788","published":"2026-09-10T14:23:42.741Z","updated":"2026-09-10T14:55:44.413Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81787","published":"2026-09-10T14:23:42.088Z","updated":"2026-09-10T17:47:18.318Z","title":"WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"IDX Broker","product":"IMPress for IDX Broker","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81786","published":"2026-09-10T14:23:41.439Z","updated":"2026-09-11T20:19:13.398Z","title":"WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"VillaTheme","product":"Thank You Page Customizer for WooCommerce","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81785","published":"2026-09-10T14:23:40.798Z","updated":"2026-09-10T15:08:25.400Z","title":"WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themekraft","product":"BuddyForms","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81784","published":"2026-09-10T14:23:40.119Z","updated":"2026-10-06T09:27:41.502Z","title":"WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00436,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81783","published":"2026-09-10T14:23:39.450Z","updated":"2026-09-10T14:56:26.055Z","title":"WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"mailmunch","product":"MailMunch – Grow your Email List","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81782","published":"2026-09-10T14:23:38.803Z","updated":"2026-09-10T17:47:27.891Z","title":"WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fahad Mahmood","product":"WP Docs","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81275","published":"2026-09-10T14:23:38.164Z","updated":"2026-09-11T20:19:13.564Z","title":"WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00443,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78536","published":"2026-09-10T14:23:37.516Z","updated":"2026-09-10T15:07:54.276Z","title":"WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"robokassa","product":"Robokassa payment gateway for Woocommerce","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66674","published":"2026-09-10T14:23:36.854Z","updated":"2026-09-10T21:00:25.882Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Elliot Sowers/ RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00252,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66632","published":"2026-09-10T14:23:36.222Z","updated":"2026-09-10T14:57:19.987Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elliot Sowers/ RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00281,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85310","published":"2026-09-10T14:23:35.573Z","updated":"2026-09-10T21:00:26.024Z","title":"WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Adrian Tobey","product":"Groundhogg","kev":false,"epss":0.00443,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81806","published":"2026-09-08T07:26:40.367Z","updated":"2026-09-08T10:34:56.294Z","title":"WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"John Darrel","product":"Hide My WP Ghost","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48888","published":"2026-09-08T07:25:20.910Z","updated":"2026-09-08T10:34:56.442Z","title":"WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81781","published":"2026-09-08T07:23:38.441Z","updated":"2026-09-08T10:34:56.591Z","title":"WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Unbounce","product":"Unbounce Landing Pages","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81790","published":"2026-09-08T07:20:46.294Z","updated":"2026-09-08T10:34:56.735Z","title":"WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Viszt Péter","product":"Csomagpontok és szállítási címkék WooCommerce-hez","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81798","published":"2026-09-08T07:18:21.779Z","updated":"2026-09-08T10:34:56.879Z","title":"WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Easy Appointments","product":"Easy Appointments","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84818","published":"2026-09-08T07:15:59.924Z","updated":"2026-09-08T10:34:57.022Z","title":"WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"100plugins","product":"Open User Map","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84817","published":"2026-09-08T07:15:59.268Z","updated":"2026-09-08T10:34:57.166Z","title":"WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81802","published":"2026-09-08T07:15:58.621Z","updated":"2026-09-08T10:34:57.313Z","title":"WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81792","published":"2026-09-08T07:15:57.963Z","updated":"2026-10-07T07:42:07.273Z","title":"WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"Product Catalog Enquiry for WooCommerce by MultiVendorX","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84820","published":"2026-09-08T07:15:57.318Z","updated":"2026-09-08T10:34:57.606Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27347","published":"2026-09-04T10:49:09.887Z","updated":"2026-09-04T18:25:10.542Z","title":"WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetPopup","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27086","published":"2026-09-04T09:22:57.652Z","updated":"2026-09-07T11:17:27.665Z","title":"WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Xtemos","product":"WoodMart","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27432","published":"2026-09-04T08:45:06.734Z","updated":"2026-09-04T18:14:33.316Z","title":"WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"sc Internet Vivoo","product":"WP Rentals","kev":false,"epss":0.00314,"kevAdded":null,"exploit":false},{"id":"CVE-2026-57777","published":"2026-09-04T08:12:00.611Z","updated":"2026-09-04T16:36:55.172Z","title":"WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Automattic","product":"WooCommerce","kev":false,"epss":0.00398,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85311","published":"2026-09-04T08:07:22.994Z","updated":"2026-09-07T11:17:27.901Z","title":"WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kings Plugins","product":"MarketKing","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32480","published":"2026-09-04T08:02:19.141Z","updated":"2026-09-04T18:25:21.366Z","title":"WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85304","published":"2026-09-03T16:56:12.611Z","updated":"2026-09-03T17:33:06.713Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85309","published":"2026-09-03T16:55:16.232Z","updated":"2026-09-05T01:58:51.687Z","title":"WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85308","published":"2026-09-03T16:54:38.155Z","updated":"2026-09-07T11:17:28.204Z","title":"WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00339,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85307","published":"2026-09-03T16:53:59.187Z","updated":"2026-09-03T17:20:16.325Z","title":"WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kevin Pirnie","product":"KP Agent Ready","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85306","published":"2026-09-03T16:53:00.347Z","updated":"2026-09-04T13:42:18.681Z","title":"WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Cascadia Web Services","product":"MountDev AI MCP Connector for WordPress","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85305","published":"2026-09-03T16:52:01.739Z","updated":"2026-09-05T01:54:03.387Z","title":"WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"SEOPress","product":"SEOPress","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85303","published":"2026-09-03T16:51:19.589Z","updated":"2026-09-03T17:33:24.213Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85302","published":"2026-09-03T16:42:40.995Z","updated":"2026-09-07T11:17:28.344Z","title":"WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPKoi WordPress Themes","product":"WPKoi Templates for Elementor","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84848","published":"2026-09-03T16:32:01.188Z","updated":"2026-09-04T13:42:26.012Z","title":"WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"brightvesseldev","product":"Quick Event Manager","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84847","published":"2026-09-03T16:32:00.540Z","updated":"2026-09-05T01:53:25.178Z","title":"WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"brightvesseldev","product":"Quick Event Manager","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84836","published":"2026-09-03T16:31:59.890Z","updated":"2026-09-03T17:33:42.493Z","title":"WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.1,"vendor":"kirillbdev","product":"WC Ukraine Shipping","kev":false,"epss":0.0029,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84834","published":"2026-09-03T16:31:59.240Z","updated":"2026-09-07T11:17:28.485Z","title":"WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"eyecix","product":"JobSearch","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84814","published":"2026-09-03T16:31:58.592Z","updated":"2026-09-03T17:25:47.898Z","title":"WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Bricksforge.","product":"Bricksforge","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84813","published":"2026-09-03T16:31:57.948Z","updated":"2026-09-04T13:42:33.658Z","title":"WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84812","published":"2026-09-03T16:31:57.216Z","updated":"2026-09-05T01:52:44.805Z","title":"WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84779","published":"2026-09-03T16:31:56.043Z","updated":"2026-09-03T17:34:02.104Z","title":"WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"Sheikh Heera","product":"Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents","kev":false,"epss":0.0035,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84778","published":"2026-09-03T16:31:55.358Z","updated":"2026-09-07T11:17:28.626Z","title":"WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"migrateguru","product":"Migrate Guru – Site Migration &amp; Cloning","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84777","published":"2026-09-03T16:31:54.706Z","updated":"2026-09-03T17:27:36.199Z","title":"WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability","severity":"HIGH","score":7.4,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.00387,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84776","published":"2026-09-03T16:31:54.057Z","updated":"2026-09-04T13:42:39.569Z","title":"WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"malcare","product":"MalCare Security","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84774","published":"2026-09-03T16:31:53.401Z","updated":"2026-09-05T01:52:15.766Z","title":"WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.1,"vendor":"VeronaLabs","product":"WP Statistics","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84773","published":"2026-09-03T16:31:52.758Z","updated":"2026-09-03T17:34:17.591Z","title":"WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.2,"vendor":"作者: Shane Bishop","product":"EWWW Image Optimizer","kev":false,"epss":0.00276,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84769","published":"2026-09-03T16:31:52.055Z","updated":"2026-09-07T11:17:28.766Z","title":"WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84768","published":"2026-09-03T16:31:51.409Z","updated":"2026-09-03T17:33:46.904Z","title":"WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"e4jvikwp","product":"VikAppointments Services Booking Calendar","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84767","published":"2026-09-03T16:31:50.759Z","updated":"2026-09-04T13:42:48.432Z","title":"WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"BookIt","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84766","published":"2026-09-03T16:31:50.113Z","updated":"2026-09-05T01:51:20.874Z","title":"WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.9,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84765","published":"2026-09-03T16:31:49.456Z","updated":"2026-09-03T17:34:30.862Z","title":"WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"John Havlik","product":"Breadcrumb NavXT","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84763","published":"2026-09-03T16:31:48.809Z","updated":"2026-09-07T11:17:28.908Z","title":"WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84762","published":"2026-09-03T16:31:48.165Z","updated":"2026-09-03T17:41:42.653Z","title":"WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saad Iqbal","product":"WP EasyPay","kev":false,"epss":0.00347,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84761","published":"2026-09-03T16:31:47.490Z","updated":"2026-09-04T13:42:54.385Z","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"LiteSpeed Technologies","product":"LiteSpeed Cache","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84758","published":"2026-09-03T16:31:46.832Z","updated":"2026-09-05T01:50:37.262Z","title":"WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84757","published":"2026-09-03T16:31:46.180Z","updated":"2026-09-03T17:35:28.197Z","title":"WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability","severity":"HIGH","score":8.2,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.00392,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84756","published":"2026-09-03T16:31:45.530Z","updated":"2026-09-07T11:17:29.055Z","title":"WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00278,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84755","published":"2026-09-03T16:31:44.890Z","updated":"2026-09-03T17:49:11.617Z","title":"WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84754","published":"2026-09-03T16:31:44.152Z","updated":"2026-09-04T13:43:01.270Z","title":"WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPFunnels","product":"WPFunnels","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84753","published":"2026-09-03T16:31:43.498Z","updated":"2026-09-05T01:49:00.634Z","title":"WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPFunnels","product":"Mail Mint","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84752","published":"2026-09-03T16:31:42.851Z","updated":"2026-09-03T17:35:53.825Z","title":"WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"rometheme","product":"RTMKit","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84238","published":"2026-09-03T16:31:42.196Z","updated":"2026-09-07T11:17:29.207Z","title":"WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"YITH","product":"YITH Request a Quote for WooCommerce Premium","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84215","published":"2026-09-03T16:31:41.541Z","updated":"2026-09-03T17:49:47.876Z","title":"WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"Timetics","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81776","published":"2026-09-03T16:31:40.864Z","updated":"2026-09-04T13:43:10.968Z","title":"WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"advanpix","product":"WP QuickLaTeX","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81773","published":"2026-09-03T16:31:40.114Z","updated":"2026-09-05T01:47:25.441Z","title":"WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Saturday Drive","product":"Ninja Forms File Uploads Extension","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81300","published":"2026-09-03T16:31:39.404Z","updated":"2026-09-03T17:36:50.943Z","title":"WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"silverplugins217","product":"Calculation For Contact Form 7","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81295","published":"2026-09-03T16:31:38.086Z","updated":"2026-09-07T11:17:29.350Z","title":"WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"UnderConstructionPage","product":"Under Construction","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81292","published":"2026-09-03T16:31:37.381Z","updated":"2026-09-03T17:50:49.763Z","title":"WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ido Kobelkowsky","product":"Simple Payment","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81282","published":"2026-09-03T16:31:36.707Z","updated":"2026-09-04T13:43:16.526Z","title":"WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"VillaTheme","product":"Product Variations Swatches for WooCommerce","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81281","published":"2026-09-03T16:31:36.053Z","updated":"2026-09-05T01:44:45.050Z","title":"WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"silverks","product":"Graphene","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84849","published":"2026-09-03T16:31:35.390Z","updated":"2026-09-03T17:51:33.797Z","title":"WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"brightvesseldev","product":"Pre-Orders for WooCommerce","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84815","published":"2026-09-03T13:37:57.078Z","updated":"2026-09-03T13:50:07.824Z","title":"WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.8,"vendor":"Kriesi","product":"Enfold","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84217","published":"2026-09-02T11:56:20.758Z","updated":"2026-09-23T08:53:29.505Z","title":"WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Mamunur Rashid","product":"Classified Listing","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84835","published":"2026-09-02T11:52:49.187Z","updated":"2026-09-23T08:50:36.357Z","title":"WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DimaFreund","product":"Rentsyst","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66652","published":"2026-09-02T11:50:02.775Z","updated":"2026-09-02T16:00:15.350Z","title":"WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThemeGoods","product":"Grand Tour","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84780","published":"2026-09-02T11:37:37.067Z","updated":"2026-09-04T02:31:25.096Z","title":"WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPGMaps","product":"WP Go Maps","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84775","published":"2026-09-02T11:37:36.419Z","updated":"2026-09-02T12:32:33.072Z","title":"WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Really Simple Plugins","product":"Really Simple SSL","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84772","published":"2026-09-02T11:37:35.760Z","updated":"2026-09-03T13:46:06.893Z","title":"WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.5,"vendor":"WPMU DEV","product":"Broken Link Checker","kev":false,"epss":0.00255,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84771","published":"2026-09-02T11:37:35.110Z","updated":"2026-09-02T12:45:52.518Z","title":"WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PublishPress","product":"PublishPress Permissions","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84770","published":"2026-09-02T11:37:34.455Z","updated":"2026-09-02T16:00:21.795Z","title":"WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84764","published":"2026-09-02T11:37:33.808Z","updated":"2026-09-04T02:30:44.429Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84760","published":"2026-09-02T11:37:33.154Z","updated":"2026-09-02T12:33:05.545Z","title":"WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Swings","product":"Ultimate Gift Cards For WooCommerce","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84759","published":"2026-09-02T11:37:32.506Z","updated":"2026-09-03T13:45:10.838Z","title":"WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Activity Log","kev":false,"epss":0.00128,"kevAdded":null,"exploit":false},{"id":"CVE-2026-83562","published":"2026-09-02T11:37:31.847Z","updated":"2026-09-02T13:04:21.566Z","title":"WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82223","published":"2026-09-02T11:37:31.194Z","updated":"2026-09-02T16:00:29.434Z","title":"WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81775","published":"2026-09-02T11:37:30.516Z","updated":"2026-09-04T02:30:08.130Z","title":"WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Estatik","product":"Estatik","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81774","published":"2026-09-02T11:37:29.866Z","updated":"2026-10-12T14:28:30.021Z","title":"WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Dotstore","product":"WooCommerce Product Attachment","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81772","published":"2026-09-02T11:37:29.218Z","updated":"2026-09-03T13:50:56.942Z","title":"WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Saturday Drive","product":"Ninja Forms - Layout & Styles","kev":false,"epss":0.00461,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81771","published":"2026-09-02T11:37:28.566Z","updated":"2026-09-02T13:07:14.632Z","title":"WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TrustedSite","product":"TrustedSite","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81770","published":"2026-09-02T11:37:27.917Z","updated":"2026-09-02T16:00:37.472Z","title":"WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"MapGeo","product":"Interactive Geo Maps","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81769","published":"2026-09-02T11:37:27.271Z","updated":"2026-09-04T02:29:32.673Z","title":"WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"Booking Hub","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81294","published":"2026-09-02T11:37:26.607Z","updated":"2026-09-02T12:35:11.886Z","title":"WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Paul Ryan","product":"Authorizer","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81289","published":"2026-09-02T11:37:25.950Z","updated":"2026-09-02T13:08:52.271Z","title":"WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81288","published":"2026-09-02T11:37:25.308Z","updated":"2026-09-02T16:00:43.097Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81286","published":"2026-09-02T11:37:24.650Z","updated":"2026-09-04T02:28:24.901Z","title":"WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81283","published":"2026-09-02T11:37:23.998Z","updated":"2026-09-02T12:35:46.826Z","title":"WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"weDevs","product":"WP User Frontend","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84781","published":"2026-09-02T11:37:23.339Z","updated":"2026-09-03T13:50:10.163Z","title":"WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Gallery PhotoBlocks","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82883","published":"2026-09-02T06:52:38.345Z","updated":"2026-09-03T13:49:13.696Z","title":"WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Marcus","product":"Login With Ajax","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81779","published":"2026-08-31T20:42:27.262Z","updated":"2026-09-01T13:48:21.018Z","title":"WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability","severity":"CRITICAL","score":10,"vendor":"Silk Themes","product":"Newspapers X","kev":false,"epss":0.00522,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81278","published":"2026-08-31T20:40:33.217Z","updated":"2026-09-01T14:58:13.959Z","title":"WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPExperts","product":"Post SMTP","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82229","published":"2026-08-31T20:30:56.269Z","updated":"2026-09-01T14:40:29.193Z","title":"WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82228","published":"2026-08-31T20:30:55.611Z","updated":"2026-09-01T18:08:35.434Z","title":"WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability","severity":"HIGH","score":8.1,"vendor":"SiteGround","product":"SiteGround Security","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82226","published":"2026-08-31T20:30:54.958Z","updated":"2026-09-01T13:51:19.582Z","title":"WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tickera","product":"Tickera","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82225","published":"2026-08-31T20:30:54.290Z","updated":"2026-09-01T14:58:28.324Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability","severity":"HIGH","score":7.4,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00387,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82224","published":"2026-08-31T20:30:53.635Z","updated":"2026-09-02T17:31:27.827Z","title":"WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"iova.mihai","product":"SliceWP","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82221","published":"2026-08-31T20:30:52.985Z","updated":"2026-09-01T14:40:50.144Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81780","published":"2026-08-31T20:30:52.324Z","updated":"2026-09-01T18:11:04.583Z","title":"WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"hashthemes","product":"Hash Form","kev":false,"epss":0.00522,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81778","published":"2026-08-31T20:30:51.644Z","updated":"2026-09-01T13:51:57.100Z","title":"WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"The4","product":"Kalles Addons","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81768","published":"2026-08-31T20:30:50.989Z","updated":"2026-09-01T14:58:34.761Z","title":"WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"highwarden","product":"Super Store Finder","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81765","published":"2026-08-31T20:30:50.339Z","updated":"2026-09-02T17:30:08.992Z","title":"WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tailored Media","product":"Tailored Tools","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81764","published":"2026-08-31T20:30:49.689Z","updated":"2026-09-01T14:41:34.019Z","title":"WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Acato","product":"Email Essentials","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81763","published":"2026-08-31T20:30:49.036Z","updated":"2026-09-01T18:12:24.672Z","title":"WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ウェブ屋のさとーさん","product":"Throws SPAM Away","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81762","published":"2026-08-31T20:30:48.385Z","updated":"2026-09-01T13:53:06.585Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81758","published":"2026-08-31T20:30:47.725Z","updated":"2026-09-01T14:58:43.508Z","title":"WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"OwnerRez","product":"OwnerRez API","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81756","published":"2026-08-31T20:30:47.073Z","updated":"2026-09-02T14:19:08.224Z","title":"WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Autorius E-goi","product":"Smart Marketing SMS and Newsletters Forms","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81298","published":"2026-08-31T20:30:46.414Z","updated":"2026-09-01T14:41:57.600Z","title":"WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"varunvairavanlc","product":"LeadConnector","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81297","published":"2026-08-31T20:30:45.760Z","updated":"2026-09-01T18:13:13.242Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81296","published":"2026-08-31T20:30:45.101Z","updated":"2026-09-01T13:54:20.076Z","title":"WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP Manage Ninja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81293","published":"2026-08-31T20:30:44.373Z","updated":"2026-09-01T14:58:50.742Z","title":"WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81291","published":"2026-08-31T20:30:43.716Z","updated":"2026-09-02T14:16:01.854Z","title":"WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Uncode","product":"Uncode","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81290","published":"2026-08-31T20:30:43.061Z","updated":"2026-09-01T14:42:28.753Z","title":"WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Icegram","product":"Email Subscribers & Newsletters","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81287","published":"2026-08-31T20:30:42.386Z","updated":"2026-09-01T18:09:55.563Z","title":"WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81280","published":"2026-08-31T20:30:41.734Z","updated":"2026-09-01T15:15:40.199Z","title":"WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"UKR Solution","product":"Print Barcode Labels for your WooCommerce products/orders","kev":false,"epss":0.00371,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82852","published":"2026-08-31T20:30:41.084Z","updated":"2026-09-02T14:13:37.274Z","title":"WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"MapSVG","product":"MapSVG","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82970","published":"2026-08-31T14:43:38.358Z","updated":"2026-08-31T18:51:27.733Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":10,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00522,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74010","published":"2026-08-31T12:07:43.112Z","updated":"2026-09-02T13:52:23.681Z","title":"WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John James Jacoby","product":"bbPress","kev":false,"epss":0.00314,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82220","published":"2026-08-28T14:33:37.550Z","updated":"2026-08-28T16:04:12.622Z","title":"WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81767","published":"2026-08-28T14:33:36.833Z","updated":"2026-08-28T16:04:28.368Z","title":"WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"yalla ya!","product":"Simple Payment","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81761","published":"2026-08-28T14:33:36.126Z","updated":"2026-08-28T15:52:16.879Z","title":"WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81760","published":"2026-08-28T14:33:35.404Z","updated":"2026-08-28T18:35:55.458Z","title":"WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81759","published":"2026-08-28T14:33:34.687Z","updated":"2026-08-28T16:08:16.510Z","title":"WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Magepeople inc.","product":"WpEvently","kev":false,"epss":0.00287,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81757","published":"2026-08-28T14:33:33.960Z","updated":"2026-08-28T16:03:21.825Z","title":"WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability","severity":"HIGH","score":7.2,"vendor":"Rank Math SEO","product":"Rank Math SEO","kev":false,"epss":0.00777,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81299","published":"2026-08-28T14:33:33.228Z","updated":"2026-08-28T16:06:39.220Z","title":"WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81285","published":"2026-08-28T14:33:32.509Z","updated":"2026-08-28T15:52:24.225Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81284","published":"2026-08-28T14:33:31.799Z","updated":"2026-08-28T18:35:55.627Z","title":"WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ACF Extended","product":"ACF Extended","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82227","published":"2026-08-28T14:33:31.083Z","updated":"2026-08-28T16:08:35.467Z","title":"WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"WPBulky","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-82222","published":"2026-08-28T10:46:14.315Z","updated":"2026-08-28T14:50:53.520Z","title":"WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Liquid Web / StellarWP","product":"GiveWP","kev":false,"epss":0.0225,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81777","published":"2026-08-28T09:42:11.752Z","updated":"2026-08-28T15:28:16.134Z","title":"WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"Essential Addons for Elementor","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81277","published":"2026-08-27T09:00:10.584Z","updated":"2026-08-27T14:31:08.991Z","title":"WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"VillaTheme","product":"Suggestion Engine for WooCommerce","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81276","published":"2026-08-27T09:00:09.884Z","updated":"2026-08-28T18:35:56.466Z","title":"WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Kali Forms","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81274","published":"2026-08-27T09:00:09.177Z","updated":"2026-08-27T12:31:07.802Z","title":"WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"metaphorcreations","product":"Ditty","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81273","published":"2026-08-27T09:00:08.436Z","updated":"2026-08-27T15:00:53.378Z","title":"WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.1,"vendor":"WP Manage Ninja","product":"FluentBooking Pro","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81272","published":"2026-08-27T09:00:07.759Z","updated":"2026-08-27T12:16:35.326Z","title":"WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WP Manage Ninja","product":"FluentPlayer Pro","kev":false,"epss":0.00331,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81271","published":"2026-08-27T09:00:07.037Z","updated":"2026-08-27T14:31:22.769Z","title":"WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-80433","published":"2026-08-27T09:00:06.310Z","updated":"2026-08-28T18:35:56.613Z","title":"WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Brainstorm Force","product":"SureFeedback Client Site","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78293","published":"2026-08-27T09:00:05.589Z","updated":"2026-08-27T12:34:46.504Z","title":"WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78292","published":"2026-08-27T09:00:04.876Z","updated":"2026-08-27T15:01:46.688Z","title":"WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"hashthemes","product":"Hash Form","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78289","published":"2026-08-27T09:00:04.174Z","updated":"2026-08-27T12:17:17.638Z","title":"WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LoftOcean","product":"CozyStay","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78288","published":"2026-08-27T09:00:03.442Z","updated":"2026-08-27T14:31:34.403Z","title":"WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Jonathan de Jong","product":"Beautiful Taxonomy Filters","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78286","published":"2026-08-27T09:00:02.731Z","updated":"2026-08-28T18:35:56.758Z","title":"WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"INFINITUM FORM","product":"Geo Controller","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78285","published":"2026-08-27T09:00:02.000Z","updated":"2026-08-27T12:35:27.910Z","title":"WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"LikeBtn","product":"Like Button Rating","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78283","published":"2026-08-27T09:00:01.262Z","updated":"2026-08-27T14:57:20.125Z","title":"WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Music Player for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78281","published":"2026-08-27T09:00:00.322Z","updated":"2026-08-27T12:17:56.974Z","title":"WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"CP Media Player","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78276","published":"2026-08-27T08:59:59.412Z","updated":"2026-08-27T14:31:45.079Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78275","published":"2026-08-27T08:59:58.666Z","updated":"2026-08-28T18:35:56.902Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability","severity":"MEDIUM","score":6.8,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00503,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78274","published":"2026-08-27T08:59:57.951Z","updated":"2026-08-27T12:35:47.806Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00499,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78273","published":"2026-08-27T08:59:57.217Z","updated":"2026-08-27T14:58:28.038Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Manage Ninja","product":"Fluent Boards Pro","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78271","published":"2026-08-27T08:59:56.487Z","updated":"2026-08-27T12:18:28.265Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability","severity":"HIGH","score":7.2,"vendor":"WP Manage Ninja","product":"FluentCRM Pro","kev":false,"epss":0.00462,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78261","published":"2026-08-27T08:59:55.779Z","updated":"2026-08-27T14:31:54.357Z","title":"WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Realtyna","product":"Realtyna Organic IDX plugin","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78260","published":"2026-08-27T08:59:55.061Z","updated":"2026-08-28T18:35:57.056Z","title":"WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ePayco","product":"Epayco","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78257","published":"2026-08-27T08:59:54.300Z","updated":"2026-08-27T12:36:34.010Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"magepeopleteam","product":"Booking and Rental Manager","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32566","published":"2026-08-27T08:59:53.588Z","updated":"2026-08-27T14:59:23.882Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ACPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32564","published":"2026-08-27T08:59:52.862Z","updated":"2026-08-27T12:37:19.730Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ACPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32550","published":"2026-08-27T08:59:52.137Z","updated":"2026-08-27T14:32:04.233Z","title":"WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Liquid Web, LLC","product":"Kadence Shop Kit","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32479","published":"2026-08-27T08:59:51.431Z","updated":"2026-08-28T18:35:57.204Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CODEPRESS IT Solutions LLC","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27330","published":"2026-08-27T08:59:50.734Z","updated":"2026-08-27T12:30:46.259Z","title":"WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability","severity":"HIGH","score":8.6,"vendor":"Weptile","product":"Mobile App for WooCommerce","kev":false,"epss":0.00358,"kevAdded":null,"exploit":false},{"id":"CVE-2026-81279","published":"2026-08-27T08:59:49.996Z","updated":"2026-08-27T13:02:36.447Z","title":"WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Murali","product":"Push Notification for Post and BuddyPress","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78282","published":"2026-08-24T21:31:35.725Z","updated":"2026-08-25T19:05:40.876Z","title":"WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"mra13","product":"Stripe Payments","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78268","published":"2026-08-24T21:31:34.955Z","updated":"2026-08-25T19:22:54.673Z","title":"WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Extend Themes","product":"Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78267","published":"2026-08-24T21:31:34.248Z","updated":"2026-08-27T14:26:13.797Z","title":"WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78266","published":"2026-08-24T21:31:33.520Z","updated":"2026-08-25T19:02:39.587Z","title":"WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Ruben Garcia","product":"AutomatorWP","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78265","published":"2026-08-24T21:31:32.805Z","updated":"2026-08-25T14:40:53.886Z","title":"WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Nexcess","product":"The Events Calendar","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78264","published":"2026-08-24T21:31:32.102Z","updated":"2026-08-25T19:06:19.855Z","title":"WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Site Building with Toolset","product":"Toolset Blocks","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78263","published":"2026-08-24T21:31:31.391Z","updated":"2026-08-25T19:23:05.855Z","title":"WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nexcess","product":"Event Tickets","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78262","published":"2026-08-24T21:31:30.692Z","updated":"2026-08-27T14:25:00.255Z","title":"WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"weDevs","product":"WP Project Manager","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78259","published":"2026-08-24T21:31:29.978Z","updated":"2026-08-25T19:03:02.064Z","title":"WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability","severity":"HIGH","score":7.3,"vendor":"WP Legal Pages","product":"WPLegalPages","kev":false,"epss":0.00378,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32563","published":"2026-08-24T21:31:29.268Z","updated":"2026-08-25T14:44:09.356Z","title":"WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"A CPT","product":"ACPT (Pro) - Custom Post Types Plugin for WordPress","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32561","published":"2026-08-24T21:31:28.568Z","updated":"2026-08-25T19:17:36.940Z","title":"WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"Booking Hub","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32560","published":"2026-08-24T21:31:27.848Z","updated":"2026-08-25T19:23:15.522Z","title":"WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"LiquidThemes","product":"MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator","kev":false,"epss":0.00456,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32559","published":"2026-08-24T21:31:27.138Z","updated":"2026-08-27T14:19:57.548Z","title":"WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"tophive","product":"UltimateAI","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32556","published":"2026-08-24T21:31:26.430Z","updated":"2026-08-25T19:03:29.234Z","title":"WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PixelYourSite Professional","product":"Boost","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32555","published":"2026-08-24T21:31:25.718Z","updated":"2026-08-25T14:43:17.674Z","title":"WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"PixelYourSite Professional","product":"Boost","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32554","published":"2026-08-24T21:31:25.000Z","updated":"2026-08-25T19:12:24.665Z","title":"WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WBW","product":"WooBeWoo Product Filter Pro","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27364","published":"2026-08-24T21:31:24.274Z","updated":"2026-08-25T19:23:25.508Z","title":"WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AnalogWP","product":"Style Kits","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78284","published":"2026-08-24T21:31:23.567Z","updated":"2026-08-25T14:42:01.677Z","title":"WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.00533,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66670","published":"2026-08-24T11:54:58.853Z","updated":"2026-08-24T12:51:05.899Z","title":"WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Måne","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66650","published":"2026-08-24T11:54:58.146Z","updated":"2026-08-24T12:51:06.094Z","title":"WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Theme-Rex","product":"FreightCo","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66648","published":"2026-08-24T11:54:57.395Z","updated":"2026-08-24T12:51:06.281Z","title":"WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"MVPThemes","product":"Jawn","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66610","published":"2026-08-24T11:54:56.693Z","updated":"2026-08-24T12:51:06.469Z","title":"WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"thembay","product":"Urna","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66587","published":"2026-08-24T11:54:55.860Z","updated":"2026-08-24T12:51:06.656Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPCafe","product":"WP Cafe Pro","kev":false,"epss":0.00497,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66585","published":"2026-08-24T11:54:55.162Z","updated":"2026-08-24T12:51:06.823Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"WPCafe","product":"WP Cafe Pro","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32558","published":"2026-08-24T11:54:54.444Z","updated":"2026-08-24T12:51:07.003Z","title":"WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"RedefiningTheWeb","product":"Affiliate Pro - Affiliate Program for WooCommerce & WordPress","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32551","published":"2026-08-24T11:54:53.749Z","updated":"2026-09-21T10:20:52.856Z","title":"WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"DiviNext","product":"Woo Essential","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32478","published":"2026-08-24T11:54:52.862Z","updated":"2026-08-24T12:51:07.396Z","title":"WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"weDevs Pte. Ltd","product":"WP Project Manager Pro","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32477","published":"2026-08-24T11:54:52.156Z","updated":"2026-08-24T12:51:07.579Z","title":"WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"RadiusTheme, LLC","product":"ShopBuilder Pro – Elementor WooCommerce Builder Addons","kev":false,"epss":0.00533,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32476","published":"2026-08-24T11:54:51.439Z","updated":"2026-08-24T12:51:07.774Z","title":"WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AmpleByte Pvt Limited","product":"Brave Conversion Engine (PRO)","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32471","published":"2026-08-24T11:54:50.606Z","updated":"2026-08-24T12:51:07.961Z","title":"WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"ThemeBing","product":"ProLancer Element","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28190","published":"2026-08-24T11:54:49.905Z","updated":"2026-08-24T12:51:08.157Z","title":"WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeBing","product":"ProLancer Element","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28171","published":"2026-08-24T11:54:49.194Z","updated":"2026-08-24T12:51:08.368Z","title":"WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":8.6,"vendor":"vanquish","product":"WooCommerce File Approval","kev":false,"epss":0.00533,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28167","published":"2026-08-24T11:54:48.479Z","updated":"2026-10-27T14:46:39.454Z","title":"WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"WebRehab","product":"Super Forms","kev":false,"epss":0.00503,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28166","published":"2026-08-24T11:54:47.762Z","updated":"2026-08-24T12:51:08.754Z","title":"WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"GoodLayers","product":"Tourmaster","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28165","published":"2026-08-24T11:54:47.057Z","updated":"2026-08-24T12:51:08.931Z","title":"WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"UnitedOver, LLC","product":"Digits","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28162","published":"2026-08-24T11:54:46.330Z","updated":"2026-08-24T12:51:09.122Z","title":"WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Franky","product":"Events Made Easy","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28153","published":"2026-08-24T11:54:45.622Z","updated":"2026-08-24T12:51:09.284Z","title":"WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Notification Master","product":"Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More","kev":false,"epss":0.00428,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28152","published":"2026-08-24T11:54:44.900Z","updated":"2026-08-24T12:51:09.441Z","title":"WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Tonda Core","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28151","published":"2026-08-24T11:54:44.199Z","updated":"2026-08-24T12:51:09.610Z","title":"WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Select-Themes","product":"Tonda","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66671","published":"2026-08-24T11:54:43.488Z","updated":"2026-08-24T12:51:09.760Z","title":"WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Elated-Themes","product":"Verdure Core","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78290","published":"2026-08-24T11:39:41.909Z","updated":"2026-08-24T12:51:09.915Z","title":"WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGrill","product":"Magazine Blocks","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78280","published":"2026-08-24T11:39:41.194Z","updated":"2026-08-24T12:51:10.074Z","title":"WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HashThemes","product":"Hash Form","kev":false,"epss":0.00142,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78279","published":"2026-08-24T11:39:40.482Z","updated":"2026-08-24T12:51:10.228Z","title":"WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Support Pro","kev":false,"epss":0.00132,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78278","published":"2026-08-24T11:39:39.768Z","updated":"2026-08-24T12:51:10.381Z","title":"WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Boards Pro","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78277","published":"2026-08-24T11:39:39.066Z","updated":"2026-08-24T12:51:10.534Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WP ManageNinja LLC","product":"FluentCRM Pro","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78272","published":"2026-08-24T11:39:38.361Z","updated":"2026-08-24T12:51:10.682Z","title":"WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Support Pro","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78270","published":"2026-08-24T11:39:37.644Z","updated":"2026-08-24T12:51:10.833Z","title":"WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"WP ManageNinja LLC","product":"FluentCRM Pro","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78269","published":"2026-08-24T11:39:36.942Z","updated":"2026-08-24T13:01:26.354Z","title":"WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"Tammersoft","product":"Shared Files","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78258","published":"2026-08-24T11:39:36.234Z","updated":"2026-08-24T13:01:26.505Z","title":"WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Booking and Rental Manager","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66623","published":"2026-08-24T11:39:35.516Z","updated":"2026-08-24T13:01:26.659Z","title":"WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Inisev","product":"Social Media & Share Icons","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66599","published":"2026-08-24T11:39:34.813Z","updated":"2026-08-24T13:01:26.816Z","title":"WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Liquid Web / StellarWP","product":"WPComplete","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66584","published":"2026-08-24T11:39:34.110Z","updated":"2026-08-24T12:51:11.006Z","title":"WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Code for Recovery","product":"12 Step Meeting List","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78291","published":"2026-08-24T11:39:33.406Z","updated":"2026-08-24T12:51:11.182Z","title":"WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28164","published":"2026-08-20T12:38:06.554Z","updated":"2026-08-20T14:36:17.293Z","title":"WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"CRITICAL","score":9.6,"vendor":"HashThemes","product":"Easy Elementor Addons","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28163","published":"2026-08-20T12:36:33.135Z","updated":"2026-08-20T16:27:27.038Z","title":"WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"New User Approve","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74011","published":"2026-08-20T12:32:27.873Z","updated":"2026-08-20T16:27:27.196Z","title":"WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"revmakx","product":"InfiniteWP Client","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74020","published":"2026-08-20T12:07:27.001Z","updated":"2026-08-20T15:18:25.615Z","title":"WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Anders Norén","product":"Koji","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74019","published":"2026-08-20T12:07:26.307Z","updated":"2026-08-24T13:01:25.744Z","title":"WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"paulepro2019","product":"EPROLO Dropshipping","kev":false,"epss":0.0029,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74018","published":"2026-08-20T12:07:25.611Z","updated":"2026-08-20T14:35:42.597Z","title":"WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Warehouse Cargo","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74016","published":"2026-08-20T12:07:24.899Z","updated":"2026-08-20T18:43:11.871Z","title":"WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"themagnifico52","product":"Smart Cleaning","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74014","published":"2026-08-20T12:07:24.174Z","updated":"2026-08-20T16:27:27.358Z","title":"WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"indithemes","product":"IT Residence","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74013","published":"2026-08-20T12:07:23.437Z","updated":"2026-08-20T15:18:31.158Z","title":"WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WordPress.com","product":"eShipper Commerce","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74001","published":"2026-08-20T12:07:22.716Z","updated":"2026-08-20T16:27:27.512Z","title":"WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPEverest","product":"User Registration & Membership Pro","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73998","published":"2026-08-20T12:07:22.022Z","updated":"2026-08-20T14:35:21.404Z","title":"WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"axew3","product":"WP w3all phpBB","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73993","published":"2026-08-20T12:07:21.318Z","updated":"2026-08-20T16:27:27.661Z","title":"WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73992","published":"2026-08-20T12:07:20.613Z","updated":"2026-08-20T16:27:27.808Z","title":"WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Jonathan Daggerhart","product":"Query Wrangler","kev":false,"epss":0.00789,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73402","published":"2026-08-20T12:07:19.931Z","updated":"2026-08-20T15:18:40.359Z","title":"WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-68566","published":"2026-08-20T12:07:19.235Z","updated":"2026-08-20T16:27:27.956Z","title":"WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Repute Infosystems","product":"BookingPress Appointment Booking Pro","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-68564","published":"2026-08-20T12:07:18.510Z","updated":"2026-08-20T14:34:48.448Z","title":"WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"NotificationX","product":"NotificationX Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66682","published":"2026-08-20T12:07:17.801Z","updated":"2026-08-20T16:27:28.117Z","title":"WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Tyche Softwares.","product":"Abandoned Cart Pro for WooCommerce","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66680","published":"2026-08-20T12:07:17.098Z","updated":"2026-08-20T15:58:57.133Z","title":"WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"plainware","product":"Locatoraid Store Locator","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66677","published":"2026-08-20T12:07:16.399Z","updated":"2026-08-20T15:18:49.424Z","title":"WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability","severity":"HIGH","score":7.6,"vendor":"VaultDweller","product":"Leyka","kev":false,"epss":0.00389,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66673","published":"2026-08-20T12:07:15.672Z","updated":"2026-08-20T16:27:28.265Z","title":"WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Monkeysan","product":"Flatastic","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66672","published":"2026-08-20T12:07:14.963Z","updated":"2026-08-20T14:34:23.631Z","title":"WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Monkeysan","product":"Flatastic","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66649","published":"2026-08-20T12:07:14.263Z","updated":"2026-08-20T16:27:28.433Z","title":"WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"e-plugins","product":"Directory Pro","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66647","published":"2026-08-20T12:07:13.567Z","updated":"2026-08-20T15:54:40.158Z","title":"WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"RadiusTheme","product":"Homlisti","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66616","published":"2026-08-20T12:07:12.870Z","updated":"2026-10-06T15:24:44.920Z","title":"WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Form Maker by 10Web","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66615","published":"2026-08-20T12:07:12.178Z","updated":"2026-08-20T16:27:28.587Z","title":"WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Eric Teubert","product":"Podlove Podcast Publisher","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66614","published":"2026-08-20T12:07:11.471Z","updated":"2026-08-20T14:33:59.957Z","title":"WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66612","published":"2026-08-20T12:07:10.767Z","updated":"2026-08-20T18:42:34.799Z","title":"WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"thembay","product":"Aora","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66611","published":"2026-08-20T12:07:10.069Z","updated":"2026-08-20T15:51:26.201Z","title":"WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Paymob","product":"Paymob for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66609","published":"2026-08-20T12:07:09.369Z","updated":"2026-08-20T15:19:03.296Z","title":"WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CodexThemes","product":"TheGem (Elementor)","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66607","published":"2026-08-20T12:07:08.665Z","updated":"2026-08-24T13:01:25.890Z","title":"WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeHunk","product":"Advance Product Search","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66606","published":"2026-08-20T12:07:07.969Z","updated":"2026-08-20T14:32:54.395Z","title":"WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ThemeGrill","product":"SmartSMTP","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66605","published":"2026-08-20T12:07:07.274Z","updated":"2026-08-20T16:27:28.745Z","title":"WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"HasThemes","product":"Swatchly – WooCommerce Variation Swatches for Products","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66604","published":"2026-08-20T12:07:06.562Z","updated":"2026-08-20T16:01:18.671Z","title":"WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66601","published":"2026-08-20T12:07:05.865Z","updated":"2026-08-20T15:19:09.602Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66600","published":"2026-08-20T12:07:05.035Z","updated":"2026-08-20T16:27:28.888Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.1,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00499,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66598","published":"2026-08-20T12:07:04.198Z","updated":"2026-08-20T14:32:12.128Z","title":"WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kingtech LLC.","product":"B2BKing Premium","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66597","published":"2026-08-20T12:07:03.495Z","updated":"2026-08-20T16:27:29.052Z","title":"WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Melograno Venture Studio","product":"wpDataTables","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66595","published":"2026-08-20T12:07:02.785Z","updated":"2026-08-20T15:45:14.902Z","title":"WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00315,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66594","published":"2026-08-20T12:07:02.089Z","updated":"2026-08-20T15:19:16.202Z","title":"WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"lukeseager","product":"WordPress Persistent Login","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66593","published":"2026-08-20T12:07:01.372Z","updated":"2026-08-20T16:27:29.203Z","title":"WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"CleanTalk Inc","product":"Security & Malware scan by CleanTalk","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66592","published":"2026-08-20T12:07:00.502Z","updated":"2026-10-26T06:52:32.426Z","title":"WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"rtCamp Inc.","product":"rtMedia for WordPress, BuddyPress and bbPress","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66590","published":"2026-08-20T12:06:59.788Z","updated":"2026-08-20T16:27:29.351Z","title":"WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Tagembed","product":"Tagembed","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66586","published":"2026-08-20T12:06:59.091Z","updated":"2026-08-20T15:44:24.366Z","title":"WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability","severity":"MEDIUM","score":6.6,"vendor":"Themewinter","product":"WP Cafe Pro","kev":false,"epss":0.00447,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66583","published":"2026-08-20T12:06:58.385Z","updated":"2026-08-20T15:19:23.111Z","title":"WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66582","published":"2026-08-20T12:06:57.691Z","updated":"2026-08-20T16:27:29.501Z","title":"WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66581","published":"2026-08-20T12:06:56.990Z","updated":"2026-08-20T14:31:02.807Z","title":"WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28150","published":"2026-08-20T12:06:56.279Z","updated":"2026-08-20T16:27:29.655Z","title":"WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"uxper","product":"Golo Framework","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2025-53999","published":"2026-08-20T12:06:55.577Z","updated":"2026-08-20T15:43:51.353Z","title":"WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"ThemeGoods","product":"Altair","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2025-15689","published":"2026-08-20T12:06:54.759Z","updated":"2026-08-20T15:19:28.954Z","title":"WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGoods","product":"Capella","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2025-15688","published":"2026-08-20T12:06:54.063Z","updated":"2026-08-20T16:27:29.806Z","title":"WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThemeGoods","product":"Capella","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2025-15637","published":"2026-08-20T12:06:53.364Z","updated":"2026-08-20T14:30:35.621Z","title":"WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge Themes","product":"Shuffle","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74021","published":"2026-08-20T12:06:52.666Z","updated":"2026-08-20T15:43:14.059Z","title":"WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Anders Norén","product":"Chaplin","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32475","published":"2026-08-19T17:24:55.906Z","updated":"2026-08-20T18:28:10.957Z","title":"WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9,"vendor":"Elementor","product":"Elementor Pro","kev":false,"epss":0.01995,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73391","published":"2026-08-19T12:38:57.462Z","updated":"2026-08-19T14:39:09.830Z","title":"WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73390","published":"2026-08-19T12:38:56.746Z","updated":"2026-08-20T15:57:12.626Z","title":"WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"KlbTheme","product":"Total Donations","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73389","published":"2026-08-19T12:38:56.047Z","updated":"2026-08-20T15:57:12.782Z","title":"WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"The4","product":"Kalles Addons","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73388","published":"2026-08-19T12:38:55.331Z","updated":"2026-08-19T19:53:03.144Z","title":"WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"TeconceTheme","product":"Nikstore Core","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73387","published":"2026-08-19T12:38:54.622Z","updated":"2026-08-19T15:34:24.261Z","title":"WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SmartDataSoft","product":"Resido","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73386","published":"2026-08-19T12:38:53.910Z","updated":"2026-08-19T14:39:15.284Z","title":"WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"ZealousWeb","product":"Track Geolocation Of Users Using Contact Form 7","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73385","published":"2026-08-19T12:38:53.203Z","updated":"2026-08-20T15:57:12.951Z","title":"WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Outanking Team","product":"Outranking Plugin Options","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73384","published":"2026-08-19T12:38:52.472Z","updated":"2026-08-20T15:57:13.136Z","title":"WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"cmsMinds","product":"Pay with Contact Form 7","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73364","published":"2026-08-19T12:38:51.770Z","updated":"2026-08-19T19:29:12.770Z","title":"WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"wpdesk","product":"Flexible Subscriptions","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73363","published":"2026-08-19T12:38:51.062Z","updated":"2026-08-19T15:35:25.996Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73354","published":"2026-08-19T12:38:50.350Z","updated":"2026-08-19T14:39:20.792Z","title":"WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ReichertBrothers","product":"SimplyRETS Real Estate IDX","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73347","published":"2026-08-19T12:38:49.650Z","updated":"2026-08-20T15:57:13.300Z","title":"WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemetechMount","product":"TrueBooker","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73185","published":"2026-08-19T12:38:48.929Z","updated":"2026-08-20T15:57:13.462Z","title":"WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wpo-HR","product":"NGG Smart Image Search","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73184","published":"2026-08-19T12:38:48.218Z","updated":"2026-08-19T19:36:39.221Z","title":"WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"LCweb","product":"Global Gallery","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73183","published":"2026-08-19T12:38:47.503Z","updated":"2026-08-19T15:36:07.932Z","title":"WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Get Maps Marker Pro","product":"Maps Marker Pro","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73182","published":"2026-08-19T12:38:46.814Z","updated":"2026-08-19T14:39:26.160Z","title":"WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Jeff Starr","product":"BBQ Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66668","published":"2026-08-19T12:38:46.116Z","updated":"2026-08-20T15:57:13.624Z","title":"WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"PeepSo","product":"Community by PeepSo","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66613","published":"2026-08-19T12:38:45.424Z","updated":"2026-08-20T15:57:13.783Z","title":"WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","kev":false,"epss":0.0086,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66596","published":"2026-08-19T12:38:44.706Z","updated":"2026-08-19T19:38:36.483Z","title":"WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Stefano Lissa","product":"Newsletter","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61986","published":"2026-08-19T12:38:43.997Z","updated":"2026-08-19T15:37:14.491Z","title":"WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Wasiliy Strecker","product":"Contest Gallery","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32552","published":"2026-08-19T12:38:43.301Z","updated":"2026-08-19T14:39:31.750Z","title":"WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"YITH","product":"YITH WooCommerce Membership Premium","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73394","published":"2026-08-19T12:38:42.578Z","updated":"2026-08-19T15:38:15.797Z","title":"WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Stitchexpress","product":"Stitch Express","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27365","published":"2026-08-18T22:19:15.926Z","updated":"2026-08-19T19:28:14.918Z","title":"WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"PublishPress","product":"PublishPress Series","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66589","published":"2026-08-18T22:17:42.065Z","updated":"2026-08-21T16:19:15.553Z","title":"WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Kings Plugins","product":"B2BKing","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66591","published":"2026-08-18T22:15:08.546Z","updated":"2026-08-21T16:19:32.960Z","title":"WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66602","published":"2026-08-18T22:03:24.596Z","updated":"2026-08-19T15:50:36.779Z","title":"WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"DevItems","product":"HashBar – WordPress Notification Bar","kev":false,"epss":0.00201,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66603","published":"2026-08-18T22:02:00.833Z","updated":"2026-08-19T14:39:48.484Z","title":"WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Artiss","product":"Draft List","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74015","published":"2026-08-18T14:00:52.479Z","updated":"2026-08-18T21:25:55.065Z","title":"WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"merkulove","product":"Readabler","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74012","published":"2026-08-18T14:00:49.610Z","updated":"2026-08-20T18:20:01.309Z","title":"WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"TaxoPress","product":"TaxoPress","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74009","published":"2026-08-18T14:00:47.602Z","updated":"2026-08-18T19:48:18.126Z","title":"WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Razorpay","product":"Razorpay for WooCommerce","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74008","published":"2026-08-18T14:00:46.192Z","updated":"2026-10-07T14:58:55.901Z","title":"WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Averta LTD","product":"Shortcodes and extra features for Phlox theme","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74007","published":"2026-08-18T14:00:45.367Z","updated":"2026-08-18T15:10:51.007Z","title":"WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"iberezansky","product":"3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74006","published":"2026-08-18T14:00:44.284Z","updated":"2026-08-18T19:48:18.310Z","title":"WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Table Builder","product":"WP Table Builder","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74004","published":"2026-08-18T14:00:43.489Z","updated":"2026-08-18T14:40:50.332Z","title":"WordPress Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpmonks","product":"Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74003","published":"2026-08-18T14:00:42.686Z","updated":"2026-08-18T19:48:18.485Z","title":"WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"rometheme","product":"RomethemeForm For Elementor","kev":false,"epss":0.00254,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73997","published":"2026-08-18T14:00:41.883Z","updated":"2026-08-18T14:35:29.908Z","title":"WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"Nexcess","product":"Starter Templates by Kadence WP","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73996","published":"2026-08-18T14:00:41.020Z","updated":"2026-11-05T08:13:58.378Z","title":"WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.8,"vendor":"ThemeGrill","product":"Masteriyo - LMS","kev":false,"epss":0.00522,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73995","published":"2026-08-18T14:00:40.199Z","updated":"2026-08-18T19:48:18.671Z","title":"WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.4,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00361,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73994","published":"2026-08-18T14:00:38.317Z","updated":"2026-08-18T14:40:32.132Z","title":"WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Syed Balkhi","product":"Charitable","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73404","published":"2026-08-18T14:00:37.489Z","updated":"2026-08-18T19:48:18.853Z","title":"WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.0034,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73400","published":"2026-08-18T14:00:36.638Z","updated":"2026-08-18T14:40:51.422Z","title":"WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"jetmonsters","product":"Restaurant Menu by MotoPress","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73399","published":"2026-08-18T14:00:35.830Z","updated":"2026-08-18T15:11:03.118Z","title":"WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"flutterwave","product":"Flutterwave WooCommerce","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73398","published":"2026-08-18T14:00:35.014Z","updated":"2026-08-18T19:48:19.040Z","title":"WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Papaki (Enartia S.A.)","product":"Piraeus Bank WooCommerce Payment Gateway","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73397","published":"2026-08-18T14:00:33.995Z","updated":"2026-08-18T14:40:10.639Z","title":"WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Youzify","product":"Youzify","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73396","published":"2026-08-18T14:00:33.150Z","updated":"2026-08-18T19:48:19.224Z","title":"WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability","severity":"HIGH","score":7.1,"vendor":"MakeWebBetter","product":"MWB HubSpot for WooCommerce","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73395","published":"2026-08-18T14:00:32.204Z","updated":"2026-08-18T14:41:12.982Z","title":"WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevart","product":"Booking calendar, Appointment Booking System","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73393","published":"2026-08-18T14:00:31.391Z","updated":"2026-08-18T15:11:14.154Z","title":"WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"weDevs","product":"Subscribe2","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73383","published":"2026-08-18T14:00:29.602Z","updated":"2026-08-18T14:39:14.588Z","title":"WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability","severity":"MEDIUM","score":4.9,"vendor":"WebAppick","product":"CTX Feed","kev":false,"epss":0.00474,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73382","published":"2026-08-18T14:00:28.735Z","updated":"2026-10-02T06:16:53.717Z","title":"WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73381","published":"2026-08-18T14:00:27.906Z","updated":"2026-08-18T14:42:57.901Z","title":"WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.1,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00549,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73380","published":"2026-08-18T14:00:27.070Z","updated":"2026-08-18T15:11:20.172Z","title":"WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73379","published":"2026-08-18T14:00:26.212Z","updated":"2026-08-18T19:48:19.778Z","title":"WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00289,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73378","published":"2026-08-18T14:00:25.346Z","updated":"2026-08-18T14:38:51.830Z","title":"WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Contact Form by Supsystic","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73377","published":"2026-08-18T14:00:24.523Z","updated":"2026-08-18T19:48:19.960Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73376","published":"2026-08-18T14:00:23.686Z","updated":"2026-08-18T14:44:47.150Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73375","published":"2026-08-18T14:00:22.860Z","updated":"2026-08-18T15:11:25.615Z","title":"WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"supsystic","product":"Ultimate Maps by Supsystic","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73367","published":"2026-08-18T14:00:22.050Z","updated":"2026-08-18T19:48:20.165Z","title":"WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability","severity":"HIGH","score":7.2,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00333,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73366","published":"2026-08-18T14:00:21.209Z","updated":"2026-08-18T14:38:24.758Z","title":"WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"supsystic","product":"Easy Google Maps","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73365","published":"2026-08-18T14:00:20.366Z","updated":"2026-08-18T21:25:57.589Z","title":"WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Crocoblock. Jetimpex Inc.","product":"JetAppointment","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73362","published":"2026-08-18T14:00:19.573Z","updated":"2026-08-18T14:48:46.405Z","title":"WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"KaizenCoders","product":"URL Shortify","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73361","published":"2026-08-18T14:00:18.724Z","updated":"2026-08-18T15:11:31.391Z","title":"WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPZOOM","product":"Recipe Card Blocks for Gutenberg & Elementor","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73360","published":"2026-08-18T14:00:17.897Z","updated":"2026-08-18T21:25:56.345Z","title":"WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Premio","product":"Chaty Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73359","published":"2026-08-18T14:00:17.072Z","updated":"2026-08-18T14:38:06.056Z","title":"WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73358","published":"2026-08-18T14:00:16.166Z","updated":"2026-08-18T19:48:20.715Z","title":"WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73356","published":"2026-08-18T14:00:15.318Z","updated":"2026-08-18T14:51:00.213Z","title":"WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":8.2,"vendor":"Cloudways","product":"Breeze","kev":false,"epss":0.00371,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73355","published":"2026-08-18T14:00:14.469Z","updated":"2026-08-18T15:11:36.750Z","title":"WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"wp.insider","product":"Affiliates Manager","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73352","published":"2026-08-18T14:00:13.661Z","updated":"2026-08-18T19:48:20.899Z","title":"WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73351","published":"2026-08-18T14:00:12.783Z","updated":"2026-08-18T14:37:41.572Z","title":"WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"miniOrange","product":"WordPress Social Login and Register","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73350","published":"2026-08-18T14:00:11.942Z","updated":"2026-08-18T19:48:21.085Z","title":"WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability","severity":"HIGH","score":8.2,"vendor":"PSM Plugins","product":"SupportCandy","kev":false,"epss":0.00413,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73348","published":"2026-08-18T14:00:11.121Z","updated":"2026-08-18T14:54:51.577Z","title":"WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73345","published":"2026-08-18T14:00:10.294Z","updated":"2026-08-18T15:11:43.790Z","title":"WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability","severity":"HIGH","score":7.1,"vendor":"Saad Iqbal","product":"License Manager for WooCommerce","kev":false,"epss":0.00286,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73343","published":"2026-08-18T14:00:09.450Z","updated":"2026-08-18T19:48:21.270Z","title":"WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"AresIT","product":"WP Compress","kev":false,"epss":0.0086,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73342","published":"2026-08-18T14:00:08.590Z","updated":"2026-08-18T14:37:12.251Z","title":"WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Magazine3","product":"WP Multilang","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73341","published":"2026-08-18T14:00:07.757Z","updated":"2026-08-18T19:48:21.449Z","title":"WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Metagauss","product":"RegistrationMagic","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73339","published":"2026-08-18T14:00:06.883Z","updated":"2026-08-18T21:25:52.497Z","title":"WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Webnus Inc.","product":"Modern Events Calendar","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73338","published":"2026-08-18T14:00:05.818Z","updated":"2026-08-18T15:11:59.072Z","title":"WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Autopay","product":"Autopay","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73190","published":"2026-08-18T14:00:04.591Z","updated":"2026-10-14T17:16:14.522Z","title":"WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"W3 Eden","product":"WPDM – Premium Packages","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73187","published":"2026-08-18T14:00:01.763Z","updated":"2026-08-18T19:48:21.814Z","title":"WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"gingerplugins","product":"Sticky Chat Widget","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73181","published":"2026-08-18T14:00:00.719Z","updated":"2026-08-18T21:25:50.062Z","title":"WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"ThemeComplete","product":"Extra Product Options & Add-Ons for WooCommerce","kev":false,"epss":0.00503,"kevAdded":null,"exploit":false},{"id":"CVE-2026-68568","published":"2026-08-18T13:59:59.318Z","updated":"2026-08-18T15:12:08.143Z","title":"WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Stylemix","product":"MasterStudy LMS","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-68567","published":"2026-08-18T13:59:58.296Z","updated":"2026-10-28T13:40:15.891Z","title":"WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Grids","product":"EasyTest – Simplify A/B Testing","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-68565","published":"2026-08-18T13:59:57.213Z","updated":"2026-08-18T14:28:10.031Z","title":"WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Paolo","product":"GeoDirectory","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66679","published":"2026-08-18T13:59:56.075Z","updated":"2026-08-18T19:48:22.173Z","title":"WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"codepeople","product":"Appointment Hour Booking","kev":false,"epss":0.00351,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66667","published":"2026-08-18T13:59:55.063Z","updated":"2026-08-18T15:03:18.743Z","title":"WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPDeveloper","product":"Templately","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66651","published":"2026-08-18T13:59:53.620Z","updated":"2026-10-13T06:13:44.698Z","title":"WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66646","published":"2026-08-18T13:59:52.544Z","updated":"2026-08-18T19:48:22.350Z","title":"WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"MyThemeShop","product":"WP Tab Widget","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66645","published":"2026-08-18T13:59:51.492Z","updated":"2026-08-18T14:27:51.121Z","title":"WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPDeveloper","product":"Table Of Contents Block","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66644","published":"2026-08-18T13:59:50.449Z","updated":"2026-08-18T19:48:22.530Z","title":"WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"93digital","product":"Typing Effect","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66643","published":"2026-08-18T13:59:49.434Z","updated":"2026-08-18T15:11:45.300Z","title":"WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wronganswersonly","product":"Wufoo Shortcode","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66641","published":"2026-08-18T13:59:48.310Z","updated":"2026-08-18T15:12:20.582Z","title":"WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66640","published":"2026-08-18T13:59:47.233Z","updated":"2026-08-18T19:48:22.715Z","title":"WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marcus (aka @msykes)","product":"Login With Ajax","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66639","published":"2026-08-18T13:59:45.983Z","updated":"2026-08-18T14:27:29.922Z","title":"WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPZOOM","product":"WPZOOM Forms – Contact Form Plugin for Gutenberg","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66638","published":"2026-08-18T13:59:44.886Z","updated":"2026-08-18T19:48:22.894Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66637","published":"2026-08-18T13:59:43.817Z","updated":"2026-08-18T15:24:33.414Z","title":"WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Alex","product":"Featured Video Plus","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66636","published":"2026-08-18T13:59:42.791Z","updated":"2026-10-07T14:58:51.805Z","title":"WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Marcin","product":"Wise Chat","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66635","published":"2026-08-18T13:59:41.813Z","updated":"2026-10-06T15:24:48.514Z","title":"WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":7.4,"vendor":"10Web","product":"Slider by 10Web","kev":false,"epss":0.00174,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66634","published":"2026-08-18T13:59:40.889Z","updated":"2026-08-18T21:25:53.749Z","title":"WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Pantherius","product":"Modal Survey","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66633","published":"2026-08-18T13:59:40.046Z","updated":"2026-08-18T21:25:51.292Z","title":"WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WPManageNinja","product":"Fluent Forms Pro Add On Pack","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66629","published":"2026-08-18T13:59:39.209Z","updated":"2026-08-18T15:26:03.452Z","title":"WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeum","product":"Kirki","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66627","published":"2026-08-18T13:59:38.145Z","updated":"2026-09-07T23:48:11.365Z","title":"WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"EDGE22 Studios Ltd.","product":"GP Premium","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66622","published":"2026-08-18T13:59:36.834Z","updated":"2026-08-18T19:48:23.446Z","title":"WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"averta","product":"Depicter Slider","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66621","published":"2026-08-18T13:59:35.306Z","updated":"2026-10-05T10:45:22.510Z","title":"WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Ultimate Dashboard","product":"Ultimate Dashboard Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66620","published":"2026-08-18T13:59:32.986Z","updated":"2026-08-18T19:48:23.621Z","title":"WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"Derek Herman","product":"OptionTree","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32553","published":"2026-08-18T13:59:31.882Z","updated":"2026-08-18T15:27:44.520Z","title":"WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Brainstorm Force","product":"OttoKit","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32549","published":"2026-08-18T13:59:30.694Z","updated":"2026-08-18T15:12:43.305Z","title":"WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Codexpert, Inc","product":"ThumbPress","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32547","published":"2026-08-18T13:59:29.548Z","updated":"2026-08-18T19:48:23.801Z","title":"WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32481","published":"2026-08-18T13:59:28.326Z","updated":"2026-08-18T14:21:08.222Z","title":"WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability","severity":"HIGH","score":7.5,"vendor":"ezoic","product":"Ezoic","kev":false,"epss":0.00485,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32474","published":"2026-08-18T13:59:27.293Z","updated":"2026-08-18T19:48:23.980Z","title":"WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"wpWax","product":"Templatiq","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32473","published":"2026-08-18T13:59:26.158Z","updated":"2026-08-18T15:28:35.106Z","title":"WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"DeKnows","product":"PDF Smart Viewer for Elementor","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32472","published":"2026-08-18T13:59:25.220Z","updated":"2026-08-18T15:12:49.658Z","title":"WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"wbolt.com","product":"Online Contact Widget","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32470","published":"2026-08-18T13:59:24.334Z","updated":"2026-08-18T19:48:24.165Z","title":"WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Roxnor","product":"FundEngine","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32468","published":"2026-08-18T13:59:23.182Z","updated":"2026-08-18T14:19:13.853Z","title":"WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"rayhanduitku","product":"Duitku Payment Gateway","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32467","published":"2026-08-18T13:59:21.835Z","updated":"2026-08-18T19:48:24.345Z","title":"WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6,"vendor":"apoyl","product":"[Aotuman] Grab WeChat Articles","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32466","published":"2026-08-18T13:59:20.788Z","updated":"2026-08-18T21:25:44.835Z","title":"WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WPExperts","product":"Gravity Forms Bookings premium","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32465","published":"2026-08-18T13:59:14.771Z","updated":"2026-08-18T15:12:55.780Z","title":"WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"g5theme","product":"Essential Real Estate","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32464","published":"2026-08-18T13:59:13.815Z","updated":"2026-08-18T19:48:24.526Z","title":"WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Vladimir Prelovac","product":"Theme Test Drive","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32463","published":"2026-08-18T13:59:12.665Z","updated":"2026-08-18T14:19:42.781Z","title":"WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Kamlesh Parmar","product":"Sync Post With Other Site","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32444","published":"2026-08-18T13:59:11.395Z","updated":"2026-08-18T21:25:43.571Z","title":"WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.9,"vendor":"Cwicly","product":"Cwicly","kev":false,"epss":0.00789,"kevAdded":null,"exploit":false},{"id":"CVE-2026-32333","published":"2026-08-18T13:59:09.867Z","updated":"2026-08-18T21:25:42.317Z","title":"WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"TeconceTheme","product":"Mayosis Core","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28571","published":"2026-08-18T13:59:08.557Z","updated":"2026-08-18T15:13:01.801Z","title":"WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WPPOOL","product":"FormyChat","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28570","published":"2026-08-18T13:59:07.041Z","updated":"2026-08-18T21:25:41.022Z","title":"WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"SpabRice","product":"Vavo Core","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28569","published":"2026-08-18T13:59:05.826Z","updated":"2026-08-18T14:20:08.241Z","title":"WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"SSL Zen","product":"SSL Zen","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28568","published":"2026-08-18T13:59:04.592Z","updated":"2026-08-18T19:48:25.076Z","title":"WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mohamed Magdy","product":"Quill Forms","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28567","published":"2026-08-18T13:59:03.244Z","updated":"2026-08-18T18:04:17.996Z","title":"WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Fahad Mahmood","product":"WP Sort Order","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28192","published":"2026-08-18T13:59:02.104Z","updated":"2026-08-18T21:25:39.735Z","title":"WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Piotnet","product":"Piotnet Addons For Elementor Pro","kev":false,"epss":0.00427,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28191","published":"2026-08-18T13:59:00.946Z","updated":"2026-09-01T14:41:15.534Z","title":"WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"ThemeOne","product":"The Grid","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28154","published":"2026-08-13T14:25:55.401Z","updated":"2026-08-14T15:38:40.881Z","title":"WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"snstheme","product":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28002","published":"2026-08-13T13:42:09.081Z","updated":"2026-08-13T15:33:53.641Z","title":"WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Arraytics","product":"Booktics","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73403","published":"2026-08-13T13:37:25.760Z","updated":"2026-08-13T15:33:35.336Z","title":"WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpeverest","product":"User Registration","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73401","published":"2026-08-13T13:37:25.109Z","updated":"2026-08-13T15:45:36.002Z","title":"WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"InstaWP","product":"InstaWP Connect","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73357","published":"2026-08-13T13:37:24.466Z","updated":"2026-08-13T15:33:21.755Z","title":"WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73353","published":"2026-08-13T13:37:23.829Z","updated":"2026-08-13T15:33:08.182Z","title":"WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"revolutbusiness","product":"Revolut Gateway for WooCommerce","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73349","published":"2026-08-13T13:37:23.200Z","updated":"2026-08-13T15:32:54.081Z","title":"WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Nexcess","product":"GiveWP","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73346","published":"2026-08-13T13:37:22.568Z","updated":"2026-08-13T15:47:13.176Z","title":"WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Mailchimp","product":"MailChimp For WooCommerce","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73344","published":"2026-08-13T13:37:21.936Z","updated":"2026-08-13T15:32:23.285Z","title":"WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-73340","published":"2026-08-13T13:37:21.296Z","updated":"2026-08-13T15:32:39.087Z","title":"WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66704","published":"2026-08-13T13:37:19.999Z","updated":"2026-08-13T15:47:16.363Z","title":"WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability","severity":"HIGH","score":7.2,"vendor":"Jegstudio","product":"Gutenverse Companion","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66700","published":"2026-08-13T13:37:19.362Z","updated":"2026-08-13T15:31:54.857Z","title":"WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ZAYTECH","product":"Smart Online Order for Clover","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66698","published":"2026-08-13T13:37:18.719Z","updated":"2026-08-13T15:31:41.324Z","title":"WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Brainstorm Force","product":"SureDash","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66697","published":"2026-08-13T13:37:18.059Z","updated":"2026-08-13T15:21:39.897Z","title":"WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Colissimo","product":"Colissimo Officiel : Méthodes de livraison pour WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66693","published":"2026-08-13T13:37:17.420Z","updated":"2026-08-13T15:47:19.753Z","title":"WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Stylemix","product":"Motors","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66691","published":"2026-08-13T13:37:16.786Z","updated":"2026-08-13T15:21:26.541Z","title":"WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Nokri","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66689","published":"2026-08-13T13:37:16.143Z","updated":"2026-08-13T15:20:59.484Z","title":"WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.3,"vendor":"AcyMailing Newsletter Team","product":"Anti Spam and list cleaner &#8211; AcyChecker","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66687","published":"2026-08-13T13:37:15.506Z","updated":"2026-08-13T15:21:13.231Z","title":"WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"magepeopleteam","product":"WpBookingly","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66661","published":"2026-08-13T13:37:14.866Z","updated":"2026-08-13T15:47:23.054Z","title":"WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability","severity":"HIGH","score":7.7,"vendor":"Onokazu","product":"Directories Pro","kev":false,"epss":0.00334,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66660","published":"2026-08-13T13:37:14.229Z","updated":"2026-08-13T15:20:29.255Z","title":"WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Scott Paterson","product":"Contact Form 7 – PayPal & Stripe Add-on","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66658","published":"2026-08-13T13:37:13.580Z","updated":"2026-08-13T15:20:09.307Z","title":"WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"MVPThemes","product":"Reviewer","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66657","published":"2026-08-13T13:37:12.967Z","updated":"2026-08-13T15:20:44.619Z","title":"WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Biagiotti Core","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66656","published":"2026-08-13T13:37:12.331Z","updated":"2026-08-13T15:47:27.895Z","title":"WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Mikado-Themes","product":"Foton Core","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66655","published":"2026-08-13T13:37:11.692Z","updated":"2026-08-13T15:19:36.757Z","title":"WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"multiparcels","product":"MultiParcels Shipping For WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66654","published":"2026-08-13T13:37:11.048Z","updated":"2026-08-13T15:19:50.154Z","title":"WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6,"vendor":"TangibleWP","product":"Vehica Core","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66653","published":"2026-08-13T13:37:10.397Z","updated":"2026-08-13T15:31:27.425Z","title":"WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Edge-Themes","product":"Barista","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66478","published":"2026-08-13T13:37:09.733Z","updated":"2026-08-13T15:47:31.186Z","title":"WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"andy_moyle","product":"Church Admin","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66472","published":"2026-08-13T13:37:09.069Z","updated":"2026-08-13T15:31:12.733Z","title":"WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"everestthemes","product":"Everest Backup","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66471","published":"2026-08-13T13:37:08.421Z","updated":"2026-08-13T15:30:45.164Z","title":"WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Themepoints","product":"Accordion","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66469","published":"2026-08-13T13:37:07.274Z","updated":"2026-08-13T15:30:59.316Z","title":"WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Afonso Matos","product":"Arvow AI SEO Writer","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66468","published":"2026-08-13T13:37:06.613Z","updated":"2026-08-13T15:47:34.247Z","title":"WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"powerfulwp","product":"Local Delivery Drivers for WooCommerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66467","published":"2026-08-13T13:37:05.957Z","updated":"2026-08-13T15:30:31.805Z","title":"WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPManageNinja","product":"FluentCommunity","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66466","published":"2026-08-13T13:37:05.302Z","updated":"2026-08-13T15:30:01.799Z","title":"WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"weDevs","product":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66465","published":"2026-08-13T13:37:04.631Z","updated":"2026-08-13T15:30:16.995Z","title":"WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability","severity":"CRITICAL","score":9.8,"vendor":"AgniHD","product":"Cartify","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66464","published":"2026-08-13T13:37:03.988Z","updated":"2026-08-13T15:47:37.888Z","title":"WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Toast Plugins","product":"Internal Link Optimiser","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66463","published":"2026-08-13T13:37:03.342Z","updated":"2026-08-13T15:29:32.291Z","title":"WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Hassan Fakih","product":"iCARRY","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66462","published":"2026-08-13T13:37:02.702Z","updated":"2026-08-13T15:29:47.048Z","title":"WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BookingWP","product":"WooCommerce Appointments","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66461","published":"2026-08-13T13:37:02.062Z","updated":"2026-08-13T15:29:18.027Z","title":"WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability","severity":"HIGH","score":7.5,"vendor":"smepay","product":"SMEPay: UPI Gateway for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66460","published":"2026-08-13T13:37:01.431Z","updated":"2026-08-13T15:47:41.681Z","title":"WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AfterShip & Automizely","product":"AfterShip Tracking","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66459","published":"2026-08-13T13:37:00.782Z","updated":"2026-08-13T15:28:49.306Z","title":"WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Space Codes","product":"AI for SEO","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66458","published":"2026-08-13T13:37:00.133Z","updated":"2026-08-13T15:29:04.079Z","title":"WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"ThimPress","product":"RealPress","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66456","published":"2026-08-13T13:36:59.479Z","updated":"2026-08-13T15:28:34.023Z","title":"WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bestwebsoft","product":"Profile Extra Fields by BestWebSoft","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66455","published":"2026-08-13T13:36:58.835Z","updated":"2026-08-13T15:47:46.427Z","title":"WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6,"vendor":"rockiger","product":"ReactPress","kev":false,"epss":0.00205,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66454","published":"2026-08-13T13:36:58.195Z","updated":"2026-08-13T15:28:17.516Z","title":"WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Maruti Mohanty","product":"WP Social Avatar","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66453","published":"2026-08-13T13:36:57.556Z","updated":"2026-08-13T15:28:01.477Z","title":"WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Dimitri Grassi","product":"Salon booking system","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66450","published":"2026-08-13T13:36:56.917Z","updated":"2026-08-13T15:27:45.822Z","title":"WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66449","published":"2026-08-13T13:36:56.276Z","updated":"2026-08-13T15:47:51.925Z","title":"WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Dylan Kuhn","product":"Geo Mashup","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66446","published":"2026-08-13T13:36:55.631Z","updated":"2026-08-13T15:27:30.653Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66444","published":"2026-08-13T13:36:54.994Z","updated":"2026-08-13T15:27:15.486Z","title":"WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"kendysond","product":"Payment Forms for Paystack","kev":false,"epss":0.00371,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66443","published":"2026-08-13T13:36:54.357Z","updated":"2026-08-13T15:26:46.847Z","title":"WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"Pete Nelson","product":"REST API Log","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66441","published":"2026-08-13T13:36:53.716Z","updated":"2026-08-13T15:47:56.330Z","title":"WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"MultiVendorX","product":"MultiVendorX","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66436","published":"2026-08-13T13:36:53.079Z","updated":"2026-08-13T15:27:01.129Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"RealMag777","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66432","published":"2026-08-13T13:36:52.427Z","updated":"2026-08-13T15:19:23.383Z","title":"WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66431","published":"2026-08-13T13:36:51.787Z","updated":"2026-08-13T15:16:42.357Z","title":"WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WoompaLoompa","product":"Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66430","published":"2026-08-13T13:36:51.135Z","updated":"2026-08-13T15:48:00.930Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"CODEPRESS","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66429","published":"2026-08-13T13:36:50.491Z","updated":"2026-08-13T15:16:13.812Z","title":"WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"CODEPRESS","product":"Visitor Traffic Real Time Statistics Pro","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66426","published":"2026-08-13T13:36:49.849Z","updated":"2026-08-13T15:16:27.605Z","title":"WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lester Chan","product":"WP-Stats","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66424","published":"2026-08-13T13:36:49.196Z","updated":"2026-08-13T15:15:43.691Z","title":"WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65582","published":"2026-08-13T13:36:48.550Z","updated":"2026-08-13T15:48:05.979Z","title":"WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.7,"vendor":"LiquidThemes","product":"AI Hub","kev":false,"epss":0.00443,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65580","published":"2026-08-13T13:36:47.921Z","updated":"2026-08-13T15:15:58.501Z","title":"WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"bracketweb","product":"Agrion","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61984","published":"2026-08-13T13:36:47.269Z","updated":"2026-08-13T15:14:58.173Z","title":"WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"Amauri","product":"WPMobile.App","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61980","published":"2026-08-13T13:36:46.624Z","updated":"2026-08-13T15:15:28.274Z","title":"WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability","severity":"HIGH","score":7.5,"vendor":"Daan.dev","product":"OMGF Pro","kev":false,"epss":0.00503,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61979","published":"2026-08-13T13:36:45.984Z","updated":"2026-08-13T15:48:09.599Z","title":"WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"miniOrange","product":"SAML SP Single Sign On","kev":false,"epss":0.00424,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61978","published":"2026-08-13T13:36:45.342Z","updated":"2026-08-13T15:15:14.927Z","title":"WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"webhosting4ugr","product":"Secure Card Gateway for ePay Paycenter (Piraeus Bank)","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61974","published":"2026-08-13T13:36:44.693Z","updated":"2026-08-13T15:14:41.657Z","title":"WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61969","published":"2026-08-13T13:36:44.056Z","updated":"2026-08-13T15:18:53.854Z","title":"WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Webilia Inc.","product":"Listdom","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61967","published":"2026-08-13T13:36:43.416Z","updated":"2026-08-13T15:26:31.351Z","title":"WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"miniorange otp verification","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61966","published":"2026-08-13T13:36:42.774Z","updated":"2026-08-13T15:26:17.531Z","title":"WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"denishua","product":"WPJAM Basic","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61965","published":"2026-08-13T13:36:42.137Z","updated":"2026-08-13T15:25:50.432Z","title":"WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"ahmadgb","product":"GeekyBot","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61962","published":"2026-08-13T13:36:41.487Z","updated":"2026-08-13T15:26:03.760Z","title":"WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability","severity":"CRITICAL","score":10,"vendor":"Hakan Ozevin","product":"WP BASE Booking","kev":false,"epss":0.00695,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61960","published":"2026-08-13T13:36:40.839Z","updated":"2026-08-13T15:48:12.794Z","title":"WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Themeisle","product":"WP Full Stripe Free","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28189","published":"2026-08-13T13:36:40.207Z","updated":"2026-08-13T15:25:23.043Z","title":"WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability","severity":"HIGH","score":7.4,"vendor":"Roland Barker","product":"Participants Database","kev":false,"epss":0.00426,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28188","published":"2026-08-13T13:36:39.551Z","updated":"2026-08-13T15:25:36.506Z","title":"WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability","severity":"HIGH","score":7.3,"vendor":"themefic","product":"Hydra Booking","kev":false,"epss":0.00301,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28187","published":"2026-08-13T13:36:38.921Z","updated":"2026-08-13T15:25:09.378Z","title":"WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"echoplugins","product":"Knowledge Base for Documentation, FAQs with AI Assistance","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28186","published":"2026-08-13T13:36:38.282Z","updated":"2026-08-13T15:48:16.393Z","title":"WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"HIGH","score":8.1,"vendor":"themefic","product":"Travelfic Toolkit","kev":false,"epss":0.00378,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28185","published":"2026-08-13T13:36:37.635Z","updated":"2026-08-13T15:24:39.735Z","title":"WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"rtCamp","product":"Log in with Google","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28182","published":"2026-08-13T13:36:36.350Z","updated":"2026-08-13T15:22:55.730Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28181","published":"2026-08-13T13:36:35.708Z","updated":"2026-08-13T15:48:20.320Z","title":"WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","kev":false,"epss":0.0034,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28176","published":"2026-08-13T13:36:35.072Z","updated":"2026-08-13T15:19:08.760Z","title":"WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Booking Activities Team","product":"Booking Activities","kev":false,"epss":0.00461,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28175","published":"2026-08-13T13:36:34.433Z","updated":"2026-08-13T15:18:23.966Z","title":"WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wp-buy","product":"Visitors Traffic Real Time Statistics","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28174","published":"2026-08-13T13:36:33.789Z","updated":"2026-08-13T15:18:37.853Z","title":"WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00371,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28173","published":"2026-08-13T13:36:33.153Z","updated":"2026-08-13T15:48:23.293Z","title":"WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability","severity":"HIGH","score":7.1,"vendor":"Arraytics","product":"WP Event SOlution","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28170","published":"2026-08-13T13:36:32.516Z","updated":"2026-08-13T15:18:10.484Z","title":"WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"1meril","product":"Blog Floating Button","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28168","published":"2026-08-13T13:36:31.879Z","updated":"2026-08-13T15:17:55.990Z","title":"WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Imran Tauqeer","product":"CubeWP","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28161","published":"2026-08-13T13:36:31.238Z","updated":"2026-08-13T15:17:25.499Z","title":"WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Aonetheme","product":"Service Finder Booking","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28159","published":"2026-08-13T13:36:30.596Z","updated":"2026-08-13T15:48:27.905Z","title":"WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aonetheme","product":"Service Finder Booking","kev":false,"epss":0.00368,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28158","published":"2026-08-13T13:36:29.953Z","updated":"2026-08-13T15:17:41.003Z","title":"WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28157","published":"2026-08-13T13:36:29.313Z","updated":"2026-08-13T15:23:10.611Z","title":"WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability","severity":"HIGH","score":7.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00409,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28156","published":"2026-08-13T13:36:28.665Z","updated":"2026-08-13T15:23:59.092Z","title":"WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00357,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28155","published":"2026-08-13T13:36:28.021Z","updated":"2026-08-13T15:48:34.121Z","title":"WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Lasso Analytics, Inc.","product":"Do Lasso","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28149","published":"2026-08-13T13:36:27.374Z","updated":"2026-08-13T15:23:45.729Z","title":"WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00564,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28148","published":"2026-08-13T13:36:26.722Z","updated":"2026-08-13T15:24:12.774Z","title":"WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"Headless Single Sign On","kev":false,"epss":0.00345,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28142","published":"2026-08-13T13:36:26.081Z","updated":"2026-08-13T15:23:29.723Z","title":"WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Shamalli","product":"Web Directory Free","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28008","published":"2026-08-13T13:36:25.434Z","updated":"2026-08-13T15:24:26.180Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28004","published":"2026-08-13T13:36:24.786Z","updated":"2026-08-13T15:22:41.117Z","title":"WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Strategy11 Team","product":"Business Directory","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28003","published":"2026-08-13T13:36:24.132Z","updated":"2026-08-13T15:22:11.649Z","title":"WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"yonifre","product":"Maspik – Spam blacklist","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28001","published":"2026-08-13T13:36:22.881Z","updated":"2026-08-13T15:48:37.247Z","title":"WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"WPDirectoryKit","product":"WP Directory Kit","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27999","published":"2026-08-13T13:36:22.230Z","updated":"2026-08-13T15:21:55.751Z","title":"WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"themefic","product":"Tourfic","kev":false,"epss":0.0034,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27544","published":"2026-08-13T13:36:21.589Z","updated":"2026-08-13T15:22:25.666Z","title":"WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"QuarkA","product":"QA Analytics","kev":false,"epss":0.0086,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27543","published":"2026-08-13T13:36:20.946Z","updated":"2026-08-13T15:16:56.080Z","title":"WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability","severity":"HIGH","score":8.1,"vendor":"FluxBuilder","product":"MStore API","kev":false,"epss":0.00373,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27539","published":"2026-08-13T13:36:20.297Z","updated":"2026-08-13T15:48:40.879Z","title":"WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27538","published":"2026-08-13T13:36:19.648Z","updated":"2026-08-13T15:17:11.006Z","title":"WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability","severity":"HIGH","score":7.5,"vendor":"WPDirectoryKit","product":"WP Directory Kit","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27537","published":"2026-08-13T13:36:19.014Z","updated":"2026-08-13T15:14:28.269Z","title":"WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"supsystic","product":"Popup by Supsystic","kev":false,"epss":0.00224,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27536","published":"2026-08-13T13:36:18.376Z","updated":"2026-08-13T15:14:14.614Z","title":"WordPress MailChimp Subscribe Forms  plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"PluginOps","product":"MailChimp Subscribe Forms","kev":false,"epss":0.00251,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27535","published":"2026-08-13T13:36:17.727Z","updated":"2026-08-13T15:48:48.703Z","title":"WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"solacewp","product":"Solace Extra","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27380","published":"2026-08-13T13:36:17.082Z","updated":"2026-08-13T15:13:43.676Z","title":"WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability","severity":"HIGH","score":7.2,"vendor":"magepeopleteam","product":"Car Rental Manager","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27345","published":"2026-08-13T13:36:16.436Z","updated":"2026-08-13T15:13:59.416Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"magepeopleteam","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66659","published":"2026-08-12T06:01:41.295Z","updated":"2026-08-12T16:57:13.035Z","title":"WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability","severity":"CRITICAL","score":9.3,"vendor":"Essekia","product":"Tablesome Table","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66642","published":"2026-08-10T10:07:24.916Z","updated":"2026-08-10T11:30:44.610Z","title":"WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP Umbrella","product":"WP Umbrella","kev":false,"epss":0.00143,"kevAdded":null,"exploit":false}]}