CVE

CVE-2026-119034

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.70

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-119033

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.70

Authorization Bypass Through User-Controlled Key

CVE

CVE-2026-119032

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.70

Missing Authorization

CVE

CVE-2026-110948

Download Manager [download-manager] < 3.3.73

Improper Access Control

CVE

CVE-2026-110949

Download Manager [download-manager] < 3.3.73

Improper Access Control

CVE

CVE-2026-88813

YITH WooCommerce Gift Cards [yith-woocommerce-gift-cards] <= 4.39.0 (unfixed)

Improper Access Control

Medium

CVE-2026-125776

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 4.0.7

CVE

CVE-2026-119529

Gravity Forms [gravityforms] < 3.2.2

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE

CVE-2026-111597

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] >= 1.58.0 - < 1.58.4

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-111579

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] >= 1.58.0 - < 1.58.4

Improper Privilege Management

Medium

CVE-2026-124752

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] < 10.0.4

Medium

CVE-2026-125708

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] < 10.0.5

CVE

CVE-2026-122061

Event Tickets and Registration [event-tickets] < 5.30.3.1

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-122087

Event Tickets and Registration [event-tickets] < 5.30.3.1

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-117521

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-117522

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-117523

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Access Control

CVE

CVE-2026-117524

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-123657

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] < 4.17.6

Missing Authorization

CVE

CVE-2026-123656

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] < 4.17.6

Improper Access Control

CVE

CVE-2026-123661

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] >= 4.16.13 - < 4.17.4

Missing Authorization

Medium

CVE-2026-123659

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] < 4.17.6

Incorrect Authorization

CVE

CVE-2026-115735

Somatic Framework [somatic-framework] <= 1.8.14 (unfixed)

External Control of File Name or Path

CVE

CVE-2026-118418

WP Directory Kit [wpdirectorykit] < 1.6.3

Exposure of Sensitive Information to an Unauthorized Actor

CVE

CVE-2026-118420

WP Directory Kit [wpdirectorykit] < 1.6.3

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE

CVE-2026-121862

Knowledge Building [knowledge-building] < 0.7.3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-121863

Knowledge Building [knowledge-building] < 0.7.3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-123666

Photo Engine (Media Organizer & Lightroom) [wplr-sync] < 6.6.2

Authorization Bypass Through User-Controlled Key

CVE

CVE-2026-123667

Photo Engine (Media Organizer & Lightroom) [wplr-sync] < 6.6.2

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-119171

Advanced Product Fields (Product Addons) for WooCommerce [advanced-product-fields-for-woocommerce] >= 1.6.22 - < 1.7.4

Improper Input Validation

Medium

CVE-2026-92408

WPS Bookings for WooCommerce [mwb-bookings-for-woocommerce] < 3.13.1

External Control of Assumed-Immutable Web Parameter

Medium

CVE-2026-115600

Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access] < 2.8.4

Medium

CVE-2026-124271

Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access] < 2.8.4

Medium

CVE-2026-125433

Futurio Extra [futurio-extra] < 2.0.26

Medium

CVE-2026-106007

FraudLabs Pro SMS Verification [fraudlabs-pro-sms-verification] <= 1.12.1 (unfixed)

Allocation of Resources Without Limits or Throttling

CVE

CVE-2026-118201

Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] >= 3.0.0 - < 3.4.1

Improper Authentication

CVE

CVE-2026-118202

Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.4.1

Improper Authentication

CVE

CVE-2026-123145

WooCommerce Stripe Payment Gateway [woocommerce-gateway-stripe] >= 10.9.0 - < 11.1.0

Exposure of Sensitive Information to an Unauthorized Actor

High

CVE-2026-123484

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

High

CVE-2026-115483

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] <= 3.6.3 (unfixed)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE

CVE-2026-121759

Fusion Page Builder [fusion] < 1.7.1

Authorization Bypass Through User-Controlled Key

Medium

CVE-2026-119503

Welcart e-Commerce [usc-e-shop] < 2.12.7

Medium

CVE-2026-106008

FraudLabs Pro SMS Verification [fraudlabs-pro-sms-verification] >= 1.11.2 - <= 1.12.1 (unfixed)

Missing Authorization

Critical

CVE-2026-115252

Confection WordPress Cable [confection] <= 0.4.0 (unfixed)

Improper Control of Generation of Code ('Code Injection')

CVE

CVE-2026-115204

AZEXO Store Locator [azexo-store-locator] <= 1.4 (unfixed)

Unrestricted Upload of File with Dangerous Type

CVE

CVE-2026-115212

mView 豆瓣电影 [mview] <= 1.0.3 (unfixed)

Unrestricted Upload of File with Dangerous Type

CVE

CVE-2026-115237

Grand Job [grand-job] <= 1.2.1 (unfixed)

Improper Authentication

CVE

CVE-2026-115256

Mail Debug for WooCommerce [mail-debug-for-woocommerce] <= 1.3.0 (unfixed)

Exposure of Sensitive Information to an Unauthorized Actor

Medium

CVE-2026-104307

BackUpWordPress [backupwordpress] < 3.15

External Control of File Name or Path

Medium

CVE-2026-122062

Pronamic Pay doneren met Mollie [pronamic-pay-doneren-met-mollie] < 1.7.1

Exposure of Sensitive Information to an Unauthorized Actor

Medium

CVE-2026-85344

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212

Missing Authorization

Low

CVE-2026-97194

Secure Custom Fields [secure-custom-fields] < 6.9.8

Exposure of Sensitive Information to an Unauthorized Actor

Low

CVE-2026-97195

Secure Custom Fields [secure-custom-fields] < 6.9.8

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-103375

Antom Payments [antom-payments] <= 2.0.11 (unfixed)

Authorization Bypass Through User-Controlled Key

High

CVE-2026-106015

Ecommerce Affiliate [ecommerce-affiliate] <= 1.0.0 (unfixed)

Improper Authentication

Medium

CVE-2026-120850

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

CVE

CVE-2026-104718

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-121777

Cool FormKit Lite – Advanced Form Builder for Elementor [extensions-for-elementor-form] < 2.7.11

Medium

CVE-2026-119507

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.3.7

CVE

CVE-2026-119303

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.3.7

Missing Authorization