Medium

CVE-2026-102564

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Control of Generation of Code ('Code Injection')

Medium

CVE-2026-103914

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Medium

CVE-2026-104337

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Exposure of Sensitive Information to an Unauthorized Actor

Low

CVE-2026-104338

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Missing Authorization

Medium

CVE-2026-104639

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Medium

CVE-2026-120520

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] < 13.2.3

Exposure of Sensitive Information to an Unauthorized Actor

Medium

CVE-2026-122085

Event Tickets Manager for WooCommerce [event-tickets-manager-for-woocommerce] < 1.6.0

Authorization Bypass Through User-Controlled Key

High

CVE-2026-121764

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212

Medium

CVE-2026-120838

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

CVE

CVE-2026-120408

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-119259

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

Missing Authorization

Medium

CVE-2026-119218

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] < 13.2.3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-120579

Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce] < 2.1.6

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-39744

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1

CVE

CVE-2026-12967

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1

Improper Privilege Management

High

CVE-2026-124250

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.203

CVE

CVE-2026-19256

All In One Login [change-wp-admin-login] >= 2.4.0 - < 2.5.0

Improper Privilege Management

CVE

CVE-2026-121873

Redirection for Contact Form 7 [wpcf7-redirect] >= 2.6.0 - < 3.2.16

Improper Access Control

CVE

CVE-2026-88814

YITH WooCommerce Gift Cards [yith-woocommerce-gift-cards] < 4.38.1

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Medium

CVE-2026-121575

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.10.5

CVE

CVE-2026-85570

Tutor LMS – eLearning and online course solution [tutor] >= 1.6.4 - < 4.2.0

Exposure of Sensitive Information to an Unauthorized Actor

Low

CVE-2026-107776

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

CVE

CVE-2026-107775

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

Incorrect Authorization

CVE

CVE-2026-107774

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

Authentication Bypass by Spoofing

High

CVE-2026-120513

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.6.3

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE

CVE-2026-123129

Event Tickets Manager for WooCommerce [event-tickets-manager-for-woocommerce] >= 1.5.4 - < 1.6.0

Improper Access Control

Low

CVE-2026-97192

Secure Custom Fields [secure-custom-fields] < 6.9.8

Improper Access Control

Low

CVE-2026-97193

Secure Custom Fields [secure-custom-fields] < 6.9.8

Authorization Bypass Through User-Controlled Key

CVE

CVE-2026-85351

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Server-Side Request Forgery (SSRF)

CVE

CVE-2026-85347

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-85346

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Cross-Site Request Forgery (CSRF)

Medium

CVE-2026-119489

WP Recipe Maker [wp-recipe-maker] < 10.9.2

High

CVE-2026-109884

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

High

CVE-2026-109883

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

Medium

CVE-2026-27356

MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.15.0

Medium

CVE-2026-104812

Redux Framework [redux-framework] < 4.5.17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-120533

Redux Framework [redux-framework] < 4.5.17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-115243

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] >= 0.9.117 - < 0.9.137

Unrestricted Upload of File with Dangerous Type

CVE

CVE-2026-115242

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.137

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Medium

CVE-2026-125786

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2026-125786 es una vulnerabilidad de tipo Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS b…

Medium

CVE-2026-125787

Missing Authorization

CVE-2026-125787 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress quiz-master-next (quiz-master-next…

Medium

CVE-2026-125785

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-125785 es una vulnerabilidad de tipo Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)…

High

CVE-2026-125836

Cross-Site Request Forgery (CSRF)

CVE-2026-125836 es una vulnerabilidad de tipo Falsificación de petición en sitios cruzados (CSRF) en el plugin de WordPress simple-jwt-logi…

Medium

CVE-2026-2982

Improper Neutralization of Input During Web Page Generation

CVE-2026-2982 es una vulnerabilidad de tipo Improper Neutralization of Input During Web Page Generation en el plugin de WordPress 3469639 (…

High

CVE-2026-124018

Improper Neutralization of Formula Elements in a CSV File

CVE-2026-124018 es una vulnerabilidad de tipo Neutralización incorrecta de elementos de fórmula en un archivo CSV (CSV Injection) en el plu…

High

CVE-2026-127204

Insufficient Verification of Data Authenticity

CVE-2026-127204 es una vulnerabilidad de tipo Verificación insuficiente de la autenticidad de los datos en el plugin de WordPress woocommer…

Medium

CVE-2026-127207

Missing Authorization

CVE-2026-127207 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress sendcloud-connected-shipping (send…

High

CVE-2026-127211

Missing Authorization

CVE-2026-127211 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress dc-woocommerce-multi-vendor (dc-wo…

Medium

CVE-2026-125434

Missing Authorization

CVE-2026-125434 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress computer-repair-shop (computer-rep…

Medium

CVE-2026-125438

Missing Authorization

CVE-2026-125438 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress computer-repair-shop (computer-rep…

Medium

CVE-2026-125778

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2026-125778 es una vulnerabilidad de tipo Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS b…

Medium

CVE-2026-125445

Cross-Site Request Forgery (CSRF)

CVE-2026-125445 es una vulnerabilidad de tipo Falsificación de petición en sitios cruzados (CSRF) en el plugin de WordPress vod-infomaniak …

Medium

CVE-2026-124256

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-124256 es una vulnerabilidad de tipo Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)…

High

CVE-2026-124253

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-124253 es una vulnerabilidad de tipo Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)…

Critical

CVE-2026-78287

Improper Control of Generation of Code ('Code Injection')

CVE-2026-78287 es una vulnerabilidad de tipo Control incorrecto de la generación de código (inyección de código) en el plugin de WordPress …

High

CVE-2026-103883

Improper Authentication

CVE-2026-103883 es una vulnerabilidad de tipo Autenticación indebida en el plugin de WordPress 6storage-rentals (6storage-rentals). Las ver…

Medium

CVE-2026-119097

Improper Neutralization of Input During Web Page Generation

CVE-2026-119097 es una vulnerabilidad de tipo Improper Neutralization of Input During Web Page Generation en el plugin de WordPress sem-aut…

High

CVE-2026-119615

Improper Privilege Management

CVE-2026-119615 es una vulnerabilidad de tipo Gestión incorrecta de privilegios en el plugin de WordPress reset-database (reset-database). …

Medium

CVE-2026-122671

Missing Authorization

CVE-2026-122671 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress e2pdf (e2pdf). Las versiones anter…

Medium

CVE-2026-125444

Missing Authorization

CVE-2026-125444 es una vulnerabilidad de tipo Falta de control de autorización en el plugin de WordPress king-addons (king-addons). Las ver…