CVEs we hold for Wp
Records whose assigning authority named Wp as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9858Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings…wpexpertshub Partial Shipment for WooCommerce
CVE-2026-9822WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX HandlersUnknown WP Hotel Booking
CVE-2026-9731Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Updatewpkuf Wp Js Detect
CVE-2026-93031WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+)…WP Cloud Plugins - Dropbox (Out-of-the-Box)
CVE-2026-92967Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameterwppochipp Pochipp
CVE-2026-9290WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameterwpusermanager WP User Manager – User Profile Builder &…
CVE-2026-92622Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode…wpchill Strong Testimonials
CVE-2026-92619Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameterwpdevelop Booking Calendar
CVE-2026-92561Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameterwpdevelop Booking Calendar
CVE-2026-92229Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameterwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-92099WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias SquattingUnknown WPGraphQL Smart Cache
CVE-2026-9107Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components'…wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
CVE-2026-90887WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityWP Inventory Manager
CVE-2026-8935Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account CreationUnknown WP MAPS PRO
CVE-2026-89330EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameterswpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook…
CVE-2026-88795wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API TokenUnknown wpShopGermany IT-RECHT KANZLEI
CVE-2026-8840Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary…wpdevart Booking calendar, Appointment Booking System
CVE-2026-87918WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX ActionsUnknown WPBot
CVE-2026-87767WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via urlUnknown wp shortcut link and advertisement baner
CVE-2026-86812WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST APIUnknown WPCafe
CVE-2026-86790WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box ShortcodeUnknown WP Highlight Box
CVE-2026-8677Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settingswpmessiah Prime Elementor Addons – Lightweight Elementor…
CVE-2026-85681WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option UpdateUnknown WP Component
CVE-2026-85302WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerabilityWPKoi Templates for Elementor
CVE-2026-85133WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsUnknown WPLP Cookie Consent
CVE-2026-85132WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scanUnknown WPLP Cookie Consent
CVE-2026-85131WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRFUnknown WPLP Cookie Consent
CVE-2026-85130WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent LogsUnknown WPLP Cookie Consent
CVE-2026-84781WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityWP Chill Gallery PhotoBlocks
CVE-2026-84780WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerabilityWPGMaps WP Go Maps
CVE-2026-84772WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerabilityWPMU DEV Broken Link Checker
CVE-2026-84766WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerabilityWP Manage Ninja FluentBooking Pro
CVE-2026-84760WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerabilityWP Swings Ultimate Gift Cards For WooCommerce
CVE-2026-84755WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerabilityWPFunnels Mail Mint
CVE-2026-84753WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerabilityWPFunnels Mail Mint
CVE-2026-8457WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWTWPWeb WooCommerce - Social Login
CVE-2026-84171WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File UploadUnknown WP images upload on piclect
CVE-2026-84099IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.phpUnknown wpstorecart
CVE-2026-8386WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker IDUnknown WP Go Maps
CVE-2026-8385WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX FallbackUnknown WP Go Maps
CVE-2026-8382Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title'…wpengine Advanced Custom Fields (ACF®)
CVE-2026-83627Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via…wpmudev Hummingbird Performance – Cache & Page Speed…
CVE-2026-83537WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymentUnknown WP Express Checkout
CVE-2026-83533WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_paymentUnknown WP Express Checkout
CVE-2026-82970WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerabilityWP Cookie Notice for GDPR, CCPA & ePrivacy Consent
CVE-2026-82220WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerabilityWPMU DEV Forminator
CVE-2026-82194WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path TraversalUnknown WPvivid — Backup, Migration & Staging
CVE-2026-82193WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path TraversalUnknown WPvivid — Backup, Migration & Staging
CVE-2026-82186WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' ParameterUnknown WPLP Cookie Consent
CVE-2026-82185WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data ResetUnknown WPLP Cookie Consent
CVE-2026-82184WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option UpdateUnknown WPLP Cookie Consent
CVE-2026-82182WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner IsolationUnknown WPvivid — Backup, Migration & Staging
CVE-2026-81799WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerabilityWP Swings Return Refund and Exchange For WooCommerce
CVE-2026-81777WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerabilityWPDeveloper Essential Addons for Elementor
CVE-2026-81297WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerabilityWP Manage Ninja Fluent Forms Pro Add On Pack
CVE-2026-81296WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerabilityWP Manage Ninja Fluent Forms Pro Add On Pack
CVE-2026-81288WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerabilityWP Swings Upsell Order Bump Offer for WooCommerce
CVE-2026-81285WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerabilityWPMU DEV Smush Image Compression and Optimization
CVE-2026-81278WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerabilityWPExperts Post SMTP
CVE-2026-81276WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerabilityWP Chill Kali Forms
CVE-2026-81273WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerabilityWP Manage Ninja FluentBooking Pro
CVE-2026-81272WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerabilityWP Manage Ninja FluentPlayer Pro
CVE-2026-8118Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+)…wproyal Royal Addons for Elementor – Addons and Templates…
CVE-2026-80488WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import FieldsUnknown WP Ultimate CSV Importer
CVE-2026-79632WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submissionUnknown WPFunnels
CVE-2026-79631WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log FilesUnknown WPFunnels
CVE-2026-79630WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID SubstitutionUnknown WPFunnels
CVE-2026-7850WP Magnific Popup <= 1.0 - Author+ Stored XSS via href AttributeUnknown WP Magnific Popup
CVE-2026-78296WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerabilityWP ManageNinja LLC FluentAuth
CVE-2026-78279WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityWP ManageNinja LLC Fluent Support Pro
CVE-2026-78278WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerabilityWP ManageNinja LLC Fluent Boards Pro
CVE-2026-78277WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerabilityWP ManageNinja LLC FluentCRM Pro
CVE-2026-78276WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerabilityWP Manage Ninja Fluent Boards Pro
CVE-2026-78275WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerabilityWP Manage Ninja Fluent Boards Pro
CVE-2026-78274WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerabilityWP Manage Ninja Fluent Boards Pro
CVE-2026-78273WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerabilityWP Manage Ninja Fluent Boards Pro
CVE-2026-78272WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerabilityWP ManageNinja LLC Fluent Support Pro
CVE-2026-78271WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerabilityWP Manage Ninja FluentCRM Pro
CVE-2026-78270WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerabilityWP ManageNinja LLC FluentCRM Pro
CVE-2026-78259WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerabilityWP Legal Pages WPLegalPages
CVE-2026-7796EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attributewpdevteam EmbedPress – PDF Embedder, Embed PDF viewer…
CVE-2026-77824Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameterwpcreatix Media Sweep – WordPress Media Cleaner
CVE-2026-77194Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite…wpinsider-1 Simple Membership
CVE-2026-77000WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login FlowUnknown WP Social Media Login
CVE-2026-7665Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more'…wpdevteam Essential Addons for Elementor – Popular…
CVE-2026-76581WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusionwpmudev WPMU DEV Dashboard
CVE-2026-76559WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL HandlingUnknown WP Import Export Lite
CVE-2026-76558WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field NamesUnknown WP Import Export Lite
CVE-2026-76557WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import OptionsUnknown WP Import Export Lite
CVE-2026-76556WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter RulesUnknown WP Import Export Lite
CVE-2026-76555WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path TraversalUnknown WP Import Export Lite
CVE-2026-76554WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User ImportUnknown WP Import Export Lite
CVE-2026-76553WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path TraversalUnknown WP Import Export Lite
CVE-2026-76552WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image ImportUnknown WP Import Export Lite
CVE-2026-76551WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP FunctionUnknown WP Import Export Lite
CVE-2026-76550WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path TraversalUnknown WP Import Export Lite
CVE-2026-7651User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary…wpeverest User Registration & Membership – Free & Paid…
CVE-2026-75980BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post…wpdevteam BetterDocs – AI Documentation, Knowledge Base…
CVE-2026-75865WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpointwplegalpages WPLP Cookie Consent – Cookie Banner & Consent…
CVE-2026-75528Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Logwpmudev Broken Link Checker
CVE-2026-75017Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification /…wpblockart Magazine Blocks – Blog Designer, Magazine &…
CVE-2026-75016Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attributewpblockart Magazine Blocks – Blog Designer, Magazine &…
CVE-2026-74932WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningUnknown WP Fastest Cache
CVE-2026-74916WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersUnknown WP Fastest Cache
CVE-2026-7436WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text'…wpclever WPC Badge Management for WooCommerce
CVE-2026-74017WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilitywpeverest User Registration
CVE-2026-74006WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerabilityWP Table Builder
CVE-2026-74004WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control…wpmonks Gravity Booster – Styles &…
CVE-2026-74002WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerabilitywpdevelop Booking Calendar
CVE-2026-74001WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerabilityWPEverest User Registration & Membership Pro
CVE-2026-74000WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerabilitywp.insider Simple Membership
CVE-2026-73995WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerabilitywpeverest User Registration
CVE-2026-73533Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin BuildWPManageNinja Ninja Tables Pro
CVE-2026-73532Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin BuildWPManageNinja Fluent Forms Pro
CVE-2026-73403WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerabilitywpeverest User Registration
CVE-2026-73395WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR)…wpdevart Booking calendar, Appointment Booking System
CVE-2026-73364WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerabilitywpdesk Flexible Subscriptions
CVE-2026-73361WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerabilityWPZOOM Recipe Card Blocks for Gutenberg & Elementor
CVE-2026-73359WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerabilityWP Cookie Notice for GDPR, CCPA & ePrivacy Consent
CVE-2026-73358WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerabilitywp.insider Affiliates Manager
CVE-2026-73355WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerabilitywp.insider Affiliates Manager
CVE-2026-73185WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerabilitywpo-HR NGG Smart Image Search
CVE-2026-6962Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored…wpcodefactory Cost of Goods: Product Cost & Profit…
CVE-2026-68567WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityWP Grids Convert Pro
CVE-2026-6725WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode…wpclever WPC Smart Messages for WooCommerce
CVE-2026-66712WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerabilitywp.insider Simple Membership
CVE-2026-66683WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerabilityWP Zone Custom CSS and JavaScript
CVE-2026-66667WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Templately
CVE-2026-66645WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Table Of Contents Block
CVE-2026-66642WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerabilityWP Umbrella
CVE-2026-66639WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityWPZOOM Forms – Contact Form Plugin for Gutenberg
CVE-2026-66633WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent Forms Pro Add On Pack
CVE-2026-66628WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerabilityWP Lab WP-Lister Lite for eBay
CVE-2026-66587WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerabilityWPCafe WP Cafe Pro
CVE-2026-66585WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerabilityWPCafe WP Cafe Pro
CVE-2026-66583WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerabilityWPMU DEV Forminator
CVE-2026-66467WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja FluentCommunity
CVE-2026-66448WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityWP Chill Gallery PhotoBlocks
CVE-2026-65569WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerabilitywpjobportal WP Job Portal
CVE-2026-65562WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper BetterDocs
CVE-2026-65558WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerabilityWPCenter AffiliateX
CVE-2026-65550WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilitywpshopmart Tabs
CVE-2026-65509WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerabilitywpDataTables
CVE-2026-65475WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerabilityWP Chill Modula Image Gallery
CVE-2026-65474WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerabilityWPManageNinja Ninja Tables
CVE-2026-65470WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent Support
CVE-2026-65446WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerabilityWP Chill Kali Forms
CVE-2026-65443WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerabilityWP Media BackWPup
CVE-2026-6504Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'…wproyal Royal Addons for Elementor – Addons and Templates…
CVE-2026-6459Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget…wpdevteam Essential Addons for Elementor – Popular…
CVE-2026-6394Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameterwpdive Nexa Blocks – Gutenberg Blocks, Page Builder for…
CVE-2026-6393BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usagewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
CVE-2026-6379WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' ParameterUnknown WP Photo Album Plus
CVE-2026-6229Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameterwproyal Royal Addons for Elementor – Addons and Templates…
CVE-2026-6227BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameterwp_media BackWPup – WordPress Backup & Restore Plugin
CVE-2026-6222Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-6214Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-62136WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control…wpdesk Flexible Quantity – Measurement Price Calculator for…
CVE-2026-62114WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerabilityWP Chill Passster
CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerabilitywpeverest Everest Forms
CVE-2026-6203User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameterwpeverest User Registration & Membership – Free & Paid…
CVE-2026-61964WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Ninja Tables
CVE-2026-61961WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper EmbedPress
CVE-2026-61947WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityWPVibes Form Vibes – Database Manager for Forms
CVE-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action'…wpeverest User Registration & Membership – Free & Paid…
CVE-2026-59558WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerabilitywpdevelop Booking Calendar
CVE-2026-59543WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerabilityWPLake Advanced Views
CVE-2026-59542WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerabilityWP Chill Kali Forms
CVE-2026-59518WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerabilitywpWax Directorist
CVE-2026-5934WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon…WP Rocket
CVE-2026-57815WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2026-57814WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2026-57778WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerabilitywpdevart Booking calendar, Appointment Booking System
CVE-2026-57772WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerabilityWP Inventory Manager
CVE-2026-57721WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerabilityWP Reloaded ApplyOnline
CVE-2026-57715WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent CRM
CVE-2026-57712WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerabilityWPZOOM Portfolio
CVE-2026-57709WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerabilityWP Swings Membership For WooCommerce
CVE-2026-57686WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerabilityWPXPO WowAddons
CVE-2026-57654WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerabilitywp.insider Affiliates Manager
CVE-2026-57653WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerabilitywpjobportal WP Job Portal
CVE-2026-57638WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja LLC Fluent Booking
CVE-2026-57634WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerabilityWP Folio Team PPWP
CVE-2026-57425WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerabilitywpdesk Autopay dla WooCommerce
CVE-2026-57407WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityWP Swings PDF Generator for WordPress
CVE-2026-57402WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerabilitywpdesk Flexible Refund and Return Order for WooCommerce
CVE-2026-57400WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerabilityWP Swings Event Tickets Manager for WooCommerce
CVE-2026-57379WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerabilityWPPOOL FormyChat
CVE-2026-57377WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerabilityWPXPO WowAddons
CVE-2026-57367WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerabilityWP Booking System
CVE-2026-57364WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other…WPDeveloper Better Payment – Instant Payments, Donations…
CVE-2026-57332WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerabilityWP Swings Wallet System for WooCommerce
CVE-2026-57312WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilitywpeverest Everest Forms
200 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.