Medium

CVE-2026-120852

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce [cartflows] < 3.3.1

Medium

CVE-2026-120853

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce [cartflows] < 3.3.1

Medium

CVE-2026-120836

Meta Box – A Framework for Dynamic Websites [meta-box] < 5.15.4

Medium

CVE-2026-119491

Media Library Assistant [media-library-assistant] < 3.44

Medium

CVE-2026-119496

Media Library Assistant [media-library-assistant] < 3.44

Medium

CVE-2026-123469

The Events Calendar [the-events-calendar] < 6.18.3.1

Medium

CVE-2026-123464

The Events Calendar [the-events-calendar] < 6.18.3.1

Medium

CVE-2026-119498

Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile] < 1.44.5

Medium

CVE-2026-124413

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.10.5

Medium

CVE-2026-119465

Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder] < 1.15.1

Medium

CVE-2026-125743

Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder] < 1.5.1

Medium

CVE-2026-123860

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

Medium

CVE-2026-123483

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

Medium

CVE-2026-121579

Unlimited Elements for Elementor [unlimited-elements-for-elementor] < 2.0.28

Medium

CVE-2026-119501

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] < 10.0.3

Medium

CVE-2026-118534

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Authorization Bypass Through User-Controlled Key

Medium

CVE-2026-118533

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Authorization Bypass Through User-Controlled Key

Medium

CVE-2026-118532

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

External Control of File Name or Path

Medium

CVE-2026-118530

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Incorrect Authorization

Low

CVE-2026-118529

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Incorrect Authorization

Medium

CVE-2026-118528

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Authorization Bypass Through User-Controlled Key

Medium

CVE-2026-122661

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.11

Medium

CVE-2026-119497

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.10.7

Medium

CVE-2026-125763

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.13.1

Medium

CVE-2026-120837

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.6.4

Medium

CVE-2026-122669

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.6.4

Medium

CVE-2026-52713

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.13

Medium

CVE-2026-114186

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Medium

CVE-2026-114188

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

High

CVE-2026-114189

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Medium

CVE-2026-119467

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Medium

CVE-2026-123183

Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce] < 2.1.7

Medium

CVE-2026-122060

WP Recipe Maker [wp-recipe-maker] < 10.9.2

Exposure of Sensitive Information to an Unauthorized Actor

Medium

CVE-2026-122265

Vanquish Upload Files for WooCommerce [vanquish-upload-files-for-woocommerce] < 2.8.0

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

High

CVE-2026-119505

Welcart e-Commerce [usc-e-shop] < 2.12.7

Medium

CVE-2026-39733

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] < 4.18.0

Medium

CVE-2026-119473

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content [wp-user-avatar] < 4.18.0

CVE

CVE-2026-120409

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.1

Exposure of Sensitive Information to an Unauthorized Actor

High

CVE-2026-117525

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-120849

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace] < 3.8.4

Medium

CVE-2026-120848

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace] < 3.8.4

CVE

CVE-2026-118167

MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.15.0

Incorrect Authorization

Medium

CVE-2026-118166

MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.15.0

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Medium

CVE-2026-119472

Redux Framework [redux-framework] < 4.5.17

Medium

CVE-2026-110705

Redux Framework [redux-framework] < 4.5.17

Missing Authorization

Medium

CVE-2026-110534

Redux Framework [redux-framework] < 4.5.17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-86606

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more [iubenda-cookie-law-solution] < 3.13.7

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-120854

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more [iubenda-cookie-law-solution] < 3.13.7

CVE

CVE-2026-121875

Post Duplicator [post-duplicator] < 3.0.18

Improper Privilege Management

High

CVE-2026-120537

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.3.9

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-121765

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.3.9

Critical

CVE-2026-118066

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.7.7

Improper Authentication

Medium

CVE-2026-104992

Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 9.9.2

Missing Authorization

High

CVE-2026-107616

Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 9.9.2

Missing Authorization

High

CVE-2026-119183

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-111317

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.7.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-121977

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-123482

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.6.8.1

Medium

CVE-2026-120845

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 4.3.6

CVE

CVE-2026-118241

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 4.3.6

Authorization Bypass Through User-Controlled Key