Medium

CVE-2026-102564

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Control of Generation of Code ('Code Injection')

Medium

CVE-2026-103914

Dynific Addons for Elementor (formerly Anywhere Elementor) [anywhere-elementor] < 1.3.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Medium

CVE-2026-104337

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Exposure of Sensitive Information to an Unauthorized Actor

Low

CVE-2026-104338

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Missing Authorization

Medium

CVE-2026-104639

Razorpay for WooCommerce [woo-razorpay] < 4.8.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Medium

CVE-2026-120520

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] < 13.2.3

Exposure of Sensitive Information to an Unauthorized Actor

Medium

CVE-2026-122085

Event Tickets Manager for WooCommerce [event-tickets-manager-for-woocommerce] < 1.6.0

Authorization Bypass Through User-Controlled Key

High

CVE-2026-121764

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212

Medium

CVE-2026-120838

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

CVE

CVE-2026-120408

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-119259

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0

Missing Authorization

Medium

CVE-2026-119218

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] < 13.2.3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-120579

Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce] < 2.1.6

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High

CVE-2026-39744

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1

CVE

CVE-2026-12967

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1

Improper Privilege Management

High

CVE-2026-124250

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.203

CVE

CVE-2026-19256

All In One Login [change-wp-admin-login] >= 2.4.0 - < 2.5.0

Improper Privilege Management

CVE

CVE-2026-121873

Redirection for Contact Form 7 [wpcf7-redirect] >= 2.6.0 - < 3.2.16

Improper Access Control

CVE

CVE-2026-88814

YITH WooCommerce Gift Cards [yith-woocommerce-gift-cards] < 4.38.1

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Medium

CVE-2026-121575

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.10.5

CVE

CVE-2026-85570

Tutor LMS – eLearning and online course solution [tutor] >= 1.6.4 - < 4.2.0

Exposure of Sensitive Information to an Unauthorized Actor

Low

CVE-2026-107776

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

CVE

CVE-2026-107775

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

Incorrect Authorization

CVE

CVE-2026-107774

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.3.3

Authentication Bypass by Spoofing

High

CVE-2026-120513

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.6.3

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE

CVE-2026-123129

Event Tickets Manager for WooCommerce [event-tickets-manager-for-woocommerce] >= 1.5.4 - < 1.6.0

Improper Access Control

Low

CVE-2026-97192

Secure Custom Fields [secure-custom-fields] < 6.9.8

Improper Access Control

Low

CVE-2026-97193

Secure Custom Fields [secure-custom-fields] < 6.9.8

Authorization Bypass Through User-Controlled Key

CVE

CVE-2026-85351

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Server-Side Request Forgery (SSRF)

CVE

CVE-2026-85347

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-85346

FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212

Cross-Site Request Forgery (CSRF)

Medium

CVE-2026-119489

WP Recipe Maker [wp-recipe-maker] < 10.9.2

High

CVE-2026-109884

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

High

CVE-2026-109883

Elementor Website Builder – more than just a page builder [elementor] < 4.3.6

Medium

CVE-2026-27356

MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.15.0

Medium

CVE-2026-104812

Redux Framework [redux-framework] < 4.5.17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2026-120533

Redux Framework [redux-framework] < 4.5.17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE

CVE-2026-115243

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] >= 0.9.117 - < 0.9.137

Unrestricted Upload of File with Dangerous Type

CVE

CVE-2026-115242

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.137

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Medium

CVE-2026-125786

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2026-125786 is a Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the WordPress plugin qu…

Medium

CVE-2026-125787

Missing Authorization

CVE-2026-125787 is a Missing Authorization vulnerability in the WordPress plugin quiz-master-next (quiz-master-next). Versions before 11.3.…

Medium

CVE-2026-125785

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-125785 is a Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress pl…

High

CVE-2026-125836

Cross-Site Request Forgery (CSRF)

CVE-2026-125836 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin simple-jwt-login (simple-jwt-login). Versions …

Medium

CVE-2026-2982

Improper Neutralization of Input During Web Page Generation

CVE-2026-2982 is a Improper Neutralization of Input During Web Page Generation vulnerability in the WordPress plugin 3469639 (3469639). Ver…

High

CVE-2026-124018

Improper Neutralization of Formula Elements in a CSV File

CVE-2026-124018 is a Improper Neutralization of Formula Elements in a CSV File vulnerability in the WordPress plugin gutenverse-form (guten…

High

CVE-2026-127204

Insufficient Verification of Data Authenticity

CVE-2026-127204 is a Insufficient Verification of Data Authenticity vulnerability in the WordPress plugin woocommerce-paypal-pro-payment-ga…

Medium

CVE-2026-127207

Missing Authorization

CVE-2026-127207 is a Missing Authorization vulnerability in the WordPress plugin sendcloud-connected-shipping (sendcloud-connected-shipping…

High

CVE-2026-127211

Missing Authorization

CVE-2026-127211 is a Missing Authorization vulnerability in the WordPress plugin dc-woocommerce-multi-vendor (dc-woocommerce-multi-vendor).…

Medium

CVE-2026-125434

Missing Authorization

CVE-2026-125434 is a Missing Authorization vulnerability in the WordPress plugin computer-repair-shop (computer-repair-shop). Versions befo…

Medium

CVE-2026-125438

Missing Authorization

CVE-2026-125438 is a Missing Authorization vulnerability in the WordPress plugin computer-repair-shop (computer-repair-shop). Versions befo…

Medium

CVE-2026-125778

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2026-125778 is a Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the WordPress plugin my…

Medium

CVE-2026-125445

Cross-Site Request Forgery (CSRF)

CVE-2026-125445 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin vod-infomaniak (vod-infomaniak). Versions befo…

Medium

CVE-2026-124256

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-124256 is a Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress pl…

High

CVE-2026-124253

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-124253 is a Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress pl…

Critical

CVE-2026-78287

Improper Control of Generation of Code ('Code Injection')

CVE-2026-78287 is a Improper Control of Generation of Code ('Code Injection') vulnerability in the WordPress plugin staggs (staggs). Versio…

High

CVE-2026-103883

Improper Authentication

CVE-2026-103883 is a Improper Authentication vulnerability in the WordPress plugin 6storage-rentals (6storage-rentals). Versions up to and …

Medium

CVE-2026-119097

Improper Neutralization of Input During Web Page Generation

CVE-2026-119097 is a Improper Neutralization of Input During Web Page Generation vulnerability in the WordPress plugin sem-author-image (se…

High

CVE-2026-119615

Improper Privilege Management

CVE-2026-119615 is a Improper Privilege Management vulnerability in the WordPress plugin reset-database (reset-database). Versions up to an…

Medium

CVE-2026-122671

Missing Authorization

CVE-2026-122671 is a Missing Authorization vulnerability in the WordPress plugin e2pdf (e2pdf). Versions before 2.00.00 are affected. Fixed…

Medium

CVE-2026-125444

Missing Authorization

CVE-2026-125444 is a Missing Authorization vulnerability in the WordPress plugin king-addons (king-addons). Versions before 51.1.90 are aff…