High

CVE-2026-32542

Fusion Builder [fusion-builder] < 3.15.0

The Avada Builder plugin, used with WordPress, contains a flaw in versions prior to 3.15.0 where input is not properly cleaned before being…

High

CVE-2026-32540

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 26.8

The Bookly plugin for WordPress contains a security flaw that allows malicious code injection through URLs, putting users at risk of cross-…

High

CVE-2026-25317

Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes] < 6.0.0

A security flaw exists in the Print Invoice & Delivery Notes for WooCommerce plugin, specifically due to a lack of proper authorization che…

Medium

CVE-2026-32565

Contextual Related Posts [contextual-related-posts] < 4.2.2

A security flaw exists within the Contextual Related Posts plugin, allowing malicious individuals to bypass authentication checks and execu…

Medium

CVE-2025-15363

Get Use APIs – JSON Content Importer [json-content-importer] < 2.0.10

The JSON Content Importer plugin for WordPress contains a security flaw that allows malicious users with contributor or higher permissions …

Medium

CVE-2026-42643

Image Widget [image-widget] < 4.4.12

The Image Widget plugin for WordPress is susceptible to stored cross-site scripting (XSS) attacks in versions 4.4.11 and earlier. Authentic…

Medium

CVE-2026-39464

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.19.9

The SeedProd plugin for WordPress contains a flaw that allows malicious users with elevated permissions to trick the website into making un…

Medium

CVE-2026-32461

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl] < 9.5.8

A security flaw exists in Really Simple Security – Simple and Performant Security plugin for WordPress, which allows users with a minimum o…

Medium

CVE-2026-22215

Comments – wpDiscuz [wpdiscuz] < 7.6.47

wpDiscuz versions prior to 7.6.47 are susceptible to a cross-site request forgery vulnerability within the getFollowsPage() function, allow…

Medium

CVE-2026-22210

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A vulnerability exists in wpDiscuz versions prior to 7.6.47, which permits attackers to introduce malicious scripts via unfiltered attachme…

Medium

CVE-2026-22216

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A missing security check in WordPress plugin wpDiscuz prior to version 7.6.47 enables unverified individuals to register any email address …

Medium

CVE-2026-22204

Comments – wpDiscuz [wpdiscuz] < 7.6.47

wpDiscuz versions prior to 7.6.47 are susceptible to an email header injection vulnerability. Malicious data inserted into the comment_auth…

Medium

CVE-2026-22203

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A critical security flaw exists in wpDiscuz versions prior to 7.6.47, where administrators can unknowingly leak sensitive OAuth information…

Medium

CVE-2026-22202

Comments – wpDiscuz [wpdiscuz] < 7.6.47

wpDiscuz versions prior to 7.6.47 are susceptible to cross-site request forgery, enabling attackers to delete all comments linked to an ema…

High

CVE-2026-22182

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A flaw in wpDiscuz versions prior to 7.6.47 allows unauthenticated users to cause a denial of service by triggering excessive notification …

Medium

CVE-2026-22191

Comments – wpDiscuz [wpdiscuz] < 7.6.47

Beghelli Sicuro24 SicuroWeb is vulnerable to a template injection flaw that lets attackers inject malicious AngularJS expressions by exploi…

Medium

CVE-2026-22183

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A stored cross-site scripting vulnerability exists within the inline comment preview functionality of wpDiscuz, a plugin that allows authen…

Critical

CVE-2026-22192

Comments – wpDiscuz [wpdiscuz] < 7.6.47

Version 1.1 of the Voltronic Power SNMP Web Pro plugin has a flaw that enables unauthenticated users to exploit an authentication bypass vu…

High

CVE-2026-22193

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A critical security flaw exists in earlier versions of wpDiscuz, specifically in the way it handles certain function calls. The getAllSubsc…

High

CVE-2026-22199

Comments – wpDiscuz [wpdiscuz] < 7.6.47

Voltronic Power SNMP Web Pro 1.1 has a security flaw where unauthenticated users can traverse paths via the params parameter in the upload.…

Medium

CVE-2026-22201

Comments – wpDiscuz [wpdiscuz] < 7.6.47

A flaw in wpDiscuz versions prior to 7.6.47 allows malicious users to manipulate their apparent IP address, thereby evading rate limiting m…

Medium

CVE-2026-39595

W3 Total Cache [w3-total-cache] < 2.9.2

A flaw exists in W3 Total Cache plugin for WordPress, specifically affecting versions prior to or equal to 2.9.1. In these affected iterati…

Medium

CVE-2026-39469

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer] < 2.0.9

The Pagelayer page builder plugin for WordPress contains a security flaw that allows authorized users with contributor privileges or higher…

Critical

CVE-2026-27071

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe] < 3.0.8

The WPCafe plugin for WordPress has a security flaw that allows unauthorized users to bypass certain restrictions, enabling them to execute…

Medium

CVE-2026-32456

Admin Menu Editor [admin-menu-editor] < 1.15

The Admin Menu Editor plugin for WordPress, up to and including version 1.14.1, is susceptible to Cross-Site Request Forgery due to inadequ…

Medium

CVE-2026-32452

Fusion Builder [fusion-builder] < 3.15.0

A security flaw exists within the Avada Builder plugin, which allows unverified users to carry out an illicit operation without being prope…

Medium

CVE-2026-32451

Fusion Builder [fusion-builder] < 3.15.0

A security flaw exists within the Avada Builder plugin for WordPress, specifically affecting versions prior to 3.15.1. The issue stems from…

Medium

CVE-2026-32453

Fusion Core [fusion-core] < 5.15.0

A flaw exists in the Avada Core plugin, enabling unverified individuals to bypass security checks and execute an illicit operation. The iss…

Medium

CVE-2026-32454

Fusion Core [fusion-core] < 5.15.0

The Avada Core plugin for WordPress contains a security flaw affecting versions prior to 5.15.0, allowing malicious users with at least con…

Low

CVE-2026-32445

Elementor Website Builder – more than just a page builder [elementor] < 3.35.6

A security flaw exists in the Elementor Website Builder plugin for WordPress, allowing malicious users with elevated permissions to bypass …

Medium

CVE-2026-32446

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.9.4

The Contact Form by WPForms plugin has a security flaw that allows certain users with elevated permissions to bypass intended access contro…

High

CVE-2025-14675

Meta Box – A Framework for Dynamic Websites [meta-box] < 5.11.2

Authenticated users with contributor level permissions or higher in WordPress installations using Meta Box plugin versions 5.11.1 and earli…

Medium

CVE-2026-40730

Starter Templates & Sites Pack by ThemeGrill [themegrill-demo-importer] < 2.0.0.7

A security flaw has been identified in the ThemeGrill Demo Importer plugin for WordPress, affecting versions prior to 2.0.1. The issue stem…

High

CVE-2026-24963

Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 2.0

The Amelia plugin for WordPress, used for scheduling appointments and events, contains a vulnerability that allows authorized users with el…

High

CVE-2026-28039

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.0.2

The wpDataTables Premium plugin for WordPress contains a security flaw that enables unverified users to inject arbitrary server-side files …

Critical

CVE-2026-27984

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options] < 4.2.0

The Widget Options plugin has a critical vulnerability that allows malicious users with contributor or higher permissions to inject arbitra…

Medium

CVE-2026-32419

List category posts [list-category-posts] < 0.94.0

The List category posts plugin for WordPress contains a vulnerability affecting versions prior to 0.93.1, where inadequate filtering of inp…

Medium

CVE-2026-39694

Simply Schedule Appointments [simply-schedule-appointments] < 1.6.11.1

A security flaw exists in the Simply Schedule Appointments plugin for WordPress, allowing unverified users to execute an unauthorized opera…

Medium

CVE-2025-14149

Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons] < 1.4.25

The Xpro Addons plugin for WordPress contains a security flaw affecting all versions up to 1.4.24. Specifically, the Image Scroller widget …

High

CVE-2026-28134

JetEngine [jet-engine] < 3.8.1.2

A security flaw exists within the JetEngine plugin for WordPress, allowing malicious users with elevated permissions to inject arbitrary co…

Critical

CVE-2026-23802

AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine] < 3.3.3

The AI Engine plugin for WordPress has a security flaw that allows authorized users with elevated permissions to upload any type of file wi…

Medium

CVE-2026-32416

PDF Poster – Let visitors read PDF’s without leaving the page [pdf-poster] < 2.4.1

A flaw exists in the PDF Poster plugin for WordPress, allowing users with contributor or higher permissions to bypass necessary security ch…

Medium

CVE-2026-32417

Pochipp [pochipp] < 1.18.9

A security flaw exists in the Pochipp plugin for WordPress, affecting users with elevated permissions. In versions prior to 1.19, a critica…

High

CVE-2026-27370

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty [chaty] < 3.5.2

The Chaty plugin for WordPress contains a flaw that allows unauthorized access to confidential user information across multiple chat platfo…

Critical

CVE-2026-27384

W3 Total Cache [w3-total-cache] < 2.9.2

A flaw exists in the input validation mechanism of BoldGrid's W3 Total Cache plugin, specifically concerning the handling of specified quan…

Critical

CVE-2026-23693

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite] < 3.7.9

The ElementsKit Elementor Addons plugin for versions before 3.7.9 allows unauthenticated access to its REST endpoint /wp-json/elementskit/v…

Medium

CVE-2026-27411

SiteGuard WP Plugin [siteguard] <= 1.7.9 (unfixed)

The SiteGuard WP Plugin, up to version 1.7.9, lacks proper capability checks in certain functions, allowing unauthenticated users to execut…

Medium

CVE-2026-32409

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.50.3

A security flaw exists within the Forminator plugin for WordPress, where insufficient permission checks allow malicious individuals to exec…

High

CVE-2026-32399

Media Library Assistant [media-library-assistant] < 3.33

The Media Library Assistant plugin for WordPress contains a security flaw in versions prior to 3.33, allowing malicious users with contribu…

Medium

CVE-2026-25386

Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget [pojo-accessibility] < 4.0.3

The Ally plugin for WordPress has a security flaw that allows unauthenticated users to execute unauthorized actions because the necessary c…

Medium

CVE-2026-39676

Download Manager [download-manager] < 3.3.53

A security flaw exists in the Download Manager plugin for WordPress, allowing malicious individuals without authentication to execute an un…

Medium

CVE-2026-25385

URL Shortify – Simple and Easy URL Shortener [url-shortify] < 1.12.4

The URL Shortify plugin for WordPress contains a flaw in versions prior to 1.12.4 that allows authorized users with elevated permissions to…

Medium

CVE-2026-25387

Image Optimizer – Compress Images and Convert to WebP or AVIF [image-optimization] < 1.7.2

Authenticated users with access levels of at least subscriber can exploit a security flaw in the Image Optimizer by Elementor plugin for Wo…

Medium

CVE-2025-13842

Breadcrumb NavXT [breadcrumb-navxt] < 7.5.1

The Breadcrumb NavXT plugin versions 7.5.0 and earlier are susceptible to an authorization bypass vulnerability when user-controlled input …

Medium

CVE-2025-14983

Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome] < 5.0.2

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Medium

CVE-2025-12500

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.8.2

The Checkout Field Manager plugin for WooCommerce has a security flaw in versions 7.8.1 and earlier that allows unauthorized users to uploa…

Medium

CVE-2025-13930

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.8.6

The WooCommerce Checkout Field Manager plugin has a security issue affecting versions up to 7.8.5, allowing unauthorized users to remove fi…

Medium

CVE-2025-12884

Advanced Ads – Ad Manager & AdSense [advanced-ads] < 2.0.15

The Advanced Ads – Ad Manager & AdSense plugin for WordPress contains a security flaw that allows unauthorized users to manipulate ad place…

Medium

CVE-2025-14427

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10

A security flaw exists within the Shield Security plugin for WordPress, affecting versions up to 21.0.9. Specifically, an omission of capab…

Medium

CVE-2026-32386

Envo Extra [envo-extra] < 1.9.14

A security flaw exists in the Envo Extra plugin for WordPress, where a critical oversight in permission checks allows users with elevated r…