High

CVE-2026-0974

Orderable – Restaurant & Food Ordering System [orderable] < 1.20.1

The Orderable plugin for WordPress lacks a crucial permission check in its installation process, allowing users with minimal privileges or …

Medium

CVE-2025-13738

Easy Table of Contents [easy-table-of-contents] < 2.0.79

The Easy Table of Contents plugin for WordPress contains a security flaw that allows malicious code injection through the `ez-toc` shortcod…

Medium

CVE-2025-11185

Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr] < 7.4.4

The Complianz plugin for WordPress has a security flaw in its cmplz-accept-link shortcode, which allows malicious users with sufficient per…

Medium

CVE-2025-12037

WP 404 Auto Redirect to Similar Post [wp-404-auto-redirect-to-similar-post] < 1.0.6

A WordPress plugin, WP 404 Auto Redirect to Similar Post, contains a security flaw that allows attackers to inject malicious code into the …

Medium

CVE-2025-14799

Brevo – Email, SMS, Web Push, Chat, and more. [mailin] < 3.3.1

A security flaw exists in the Brevo plugin for WordPress, affecting versions up to 3.3.0. The issue arises from a comparison function used …

Medium

CVE-2025-11737

VK All in One Expansion Unit [vk-all-in-one-expansion-unit] < 9.112.4

The VK All in One Expansion Unit plugin contains a security flaw affecting all versions up to 9.112.3, which allows malicious users with co…

CVE

CVE-2026-39659

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] <= 2.11.3 (unfixed)

A security flaw exists in the Ultimate Member plugin for WordPress, where insufficient permission checks allow unauthorized individuals to …

High

CVE-2026-22356

Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation [zero-bs-crm] < 6.7.1

The Jetpack CRM plugin for WordPress is susceptible to Local File Inclusion vulnerabilities up to version 6.7.0, enabling unauthenticated a…

High

CVE-2025-12062

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin] < 4.8.7

The WP Maps plugin for WordPress contains a security flaw that allows attackers with Subscriber-level access or higher to inject arbitrary …

Medium

CVE-2026-39647

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.12

The MP3 Audio Player plugin for WordPress has a security flaw that allows unauthorized users to initiate external network connections, pote…

High

CVE-2026-32358

Booking Calendar [booking] < 10.14.16

The Booking Calendar plugin for WordPress contains a security flaw in versions up to 10.14.15, allowing malicious users with at least edito…

Medium

CVE-2026-32356

Robo Gallery – Photo & Image Slider [robo-gallery] < 5.1.3

The Robo Gallery plugin for WordPress contains a security flaw in versions up to 5.1.2, allowing malicious users with contributor or higher…

High

CVE-2026-32355

JetEngine [jet-engine] < 3.8.4.1

A security flaw exists in JetEngine for WordPress versions prior to 3.8.4.1, allowing a contributor-level user and above to inject maliciou…

Medium

CVE-2026-32352

Elementor Website Builder – more than just a page builder [elementor] < 3.35.6

The Elementor Website Builder plugin for WordPress has a stored cross-site scripting vulnerability in versions 3.35.5 and earlier, caused b…

Medium

CVE-2025-14873

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.2.6

The LatePoint plugin for WordPress, used for scheduling appointments and events, has a security weakness in its routing system that affects…

Critical

CVE-2026-24956

Download Manager Addons for Elementor [wpdm-elementor] < 2.0.0

The Elementor Download Manager Addons plugin for WordPress has a security flaw in versions 1.3.0 and earlier, allowing malicious input to d…

High

CVE-2025-68495

JetEngine [jet-engine] < 3.8.1

The JetEngine plugin for WordPress contains a security flaw affecting versions 3.8.0 and earlier, which allows malicious code injection via…

Medium

CVE-2026-32343

Easy Table of Contents [easy-table-of-contents] < 2.0.81

The Easy Table of Contents plugin for WordPress contains a security flaw in versions up to 2.0.80, which allows malicious individuals to in…

Medium

CVE-2026-15286

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.0

A WordPress plugin called Gutenberg Blocks with AI by Kadence WP contains a security flaw that allows attackers with at least Contributor-l…

Medium

CVE-2026-39615

Download Manager [download-manager] < 3.3.54

The Download Manager plugin for WordPress contains a security flaw in versions 3.3.53 and earlier, which allows malicious users with elevat…

Medium

CVE-2026-24953

Simple File List [simple-file-list] < 6.1.16

A security flaw exists within the Simple File List plugin for WordPress, affecting versions prior to 6.1.16, allowing authorized users with…

High

CVE-2025-67994

YayCurrency – WooCommerce Multi-Currency Switcher [yaycurrency] < 3.3.1

A security flaw exists in the YayCurrency – WooCommerce Multi-Currency Switcher plugin for WordPress, allowing unauthorized access to modif…

Medium

CVE-2026-31919

Advanced Coupons for WooCommerce – BOGO, Store Credit & WooCommerce Coupons [advanced-coupons-for-woocommerce-free] < 4.7.1.1

A vulnerability exists in the Advanced Coupons for WooCommerce Coupons plugin for WordPress, where insufficient permission checks allow use…

High

CVE-2025-15386

Responsive Lightbox & Gallery [responsive-lightbox] < 2.6.1

The Responsive Lightbox & Gallery plugin for WordPress contains a security flaw affecting versions prior to 2.6.1, where inadequate filteri…

Medium

CVE-2026-24946

Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes] < 5.9.0

A security flaw exists in the Print Invoice & Delivery Notes for WooCommerce plugin, specifically in its access control mechanism, which ca…

Medium

CVE-2026-25024

ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin [thirstyaffiliates] < 3.11.10

The ThirstyAffiliates plugin for WordPress has a security weakness in versions up to 3.11.9, allowing malicious individuals to manipulate t…

Medium

CVE-2026-25325

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.7.9

A security flaw exists in the rtCamp rtMedia plugin for WordPress, which also supports BuddyPress and bbPress integrations. This vulnerabil…

Medium

CVE-2026-25420

MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms] < 1.7.19

A security flaw exists in the MailerLite – Signup forms (official) plugin for WordPress due to inadequate permission checks on a specific f…

High

CVE-2025-67974

Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 3.5.5

A security flaw exists in the WP Legal Pages plugin for WordPress, affecting all versions prior to 3.5.4. The issue arises from a lack of c…

High

CVE-2026-25316

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce [cartflows] < 2.2.0

The CartFlows plugin for WooCommerce has a security flaw that allows attackers with administrator-level access to inject malicious PHP obje…

Medium

CVE-2026-25313

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.1.15

The Fluent Forms plugin, used for creating various types of forms on WordPress sites, has a security flaw where missing capability checks i…

Medium

CVE-2026-24539

Protección de datos – RGPD [proteccion-datos-rgpd] < 0.69

A security flaw exists within the Protección de datos – RGPD plugin for WordPress, allowing malicious individuals to bypass authentication …

High

CVE-2025-68999

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons] < 3.20.6

The Happy Addons for Elementor plugin has a SQL Injection vulnerability in versions 3.20.4 and earlier, caused by inadequate escaping of us…

Medium

CVE-2025-14069

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.54.1

The Schema & Structured Data for WP & AMP plugin contains a security flaw in its handling of custom schema fields. In versions 1.54 and ear…

Medium

CVE-2025-14745

WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator] < 5.0.11

A WordPress plugin used for aggregating news feeds has a security flaw that allows malicious users with sufficient privileges to embed exec…

High

CVE-2025-68047

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] < 4.1.4

The Eventin WordPress plugin suffers from a PHP object injection flaw affecting versions 4.1.3 and earlier due to insecure deserialization …

High

CVE-2024-11976

BuddyPress [buddypress] < 14.3.4

BuddyPress versions before 14.3.4 contain a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. The plugin fa…

Medium

CVE-2025-15522

Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.0.0

A security flaw exists in WordPress plugins up to version 6.10.0.2 due to inadequate filtering of certain input parameters. Specifically, t…

High

CVE-2025-15380

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.2.1

The NotificationX plugin for WordPress contains a security flaw affecting all versions up to 3.2.0, allowing attackers to inject malicious …

Medium

CVE-2025-15043

The Events Calendar [the-events-calendar] < 6.15.13.1

The Events Calendar plugin for WordPress has a security flaw that allows unauthorized users with at least subscriber-level access to manipu…

Medium

CVE-2025-69315

Simply Schedule Appointments [simply-schedule-appointments] < 1.6.9.17

A security flaw exists in the Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin, affecting WordPress installations…

Critical

CVE-2025-67945

MailerLite – WooCommerce integration [woo-mailerlite] < 3.1.3

The MailerLite – WooCommerce integration plugin for WordPress contains a flaw in versions up to 3.1.2, allowing malicious input to be injec…

Critical

CVE-2025-14533

Advanced Custom Fields: Extended [acf-extended] < 0.9.2.2

A flaw in Advanced Custom Fields: Extended plugin for WordPress allows unauthorized users to register with elevated permissions, specifical…

Medium

CVE-2026-25453

Advanced iFrame [advanced-iframe] < 2026.0

The Advanced iFrame plugin for WordPress contains a security flaw that allows malicious users with contributor privileges or higher to embe…

Medium

CVE-2026-6742

Advanced iFrame [advanced-iframe] < 2026.2

The Advanced iFrame plugin for WordPress contains a security flaw that allows malicious users with contributor-level access or higher to in…

Medium

CVE-2026-24580

Ecwid by Lightspeed Ecommerce Shopping Cart [ecwid-shopping-cart] < 7.0.6

In the Ecwid Shopping Cart plugin for WordPress, a critical oversight has been discovered in versions prior to 7.0.6, where an essential se…

Critical

CVE-2025-69312

Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons] < 1.4.20

The Xpro Addons plugin for WordPress contains a security flaw that allows authorized users with elevated permissions to bypass normal file …

Medium

CVE-2026-25308

Simple Membership [simple-membership] < 4.7.0

A flaw in the Simple Membership plugin for WordPress allows users with Subscriber-level permissions or higher to execute an illicit operati…

Medium

CVE-2025-69300

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor] < 4.11.64

The Premium Addons for Elementor plugin, up to version 4.11.63, is susceptible to unauthorized access because it lacks proper capability ch…

Medium

CVE-2026-24982

Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.19.18

The Spectra Gutenberg Blocks plugin for WordPress contains a security flaw that allows unauthorized individuals to carry out certain action…

Medium

CVE-2025-12129

CubeWP Framework [cubewp-framework] < 1.1.28

The CubeWP plugin for WordPress has a security flaw that allows unauthorized access to sensitive post data. Specifically, attackers can use…

Medium

CVE-2025-12984

Advanced Ads – Ad Manager & AdSense [advanced-ads] < 2.0.16

The Advanced Ads – Ad Manager & AdSense plugin for WordPress has a security flaw in versions up to 2.0.15. This issue arises because user-s…

Medium

CVE-2025-12825

User Registration Using Contact Form 7 [user-registration-using-contact-form-7] < 2.6

The User Registration Using Contact Form 7 plugin has an error in its functionality. Specifically, in the 'get_cf7_form_data' function, a c…

Medium

CVE-2026-27042

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx] < 3.2.2

The NotificationX plugin, which includes features like FOMO notifications and WooCommerce popups, has a security flaw affecting all version…

Medium

CVE-2025-14384

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.3

A security flaw exists in All in One SEO plugin for WordPress, where a critical capability check is absent from the `/aioseo/v1/ai/credits`…

Medium

CVE-2026-25472

Fusion Builder [fusion-builder] < 3.14.2

The Avada Builder plugin for WordPress contains a security flaw affecting versions 3.14.1 and earlier, allowing malicious users with contri…

Medium

CVE-2025-14982

Booking Calendar [booking] < 10.14.12

A critical security flaw exists within the Booking Calendar plugin for WordPress, where authenticated users with minimal access privileges …

Medium

CVE-2025-15370

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10

A security flaw exists in Shield: Blocks Bots plugin versions prior to 21.0.9 that can be exploited by authenticated users with at least Su…

Medium

CVE-2026-24596

Related Posts Thumbnails [related-posts-thumbnails] < 4.3.3

A security flaw exists in the Related Posts Thumbnails Plugin for WordPress, affecting versions up to 4.3.2. The issue arises from inadequa…

Medium

CVE-2025-14375

WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator] < 5.0.11

The RSS Aggregator plugin for WordPress contains a security flaw affecting all versions up to 5.0.10, allowing malicious code injection thr…