Vendor CVEs

WordPress

All CVEs

40,071 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-108491	WordPress Everest Forms	Hig	0.46	7.1	0.00	Oct 15, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
CVE-2026-74920	WordPress Document Gallery	Hig	0.46	7.1	0.00	Oct 15, 2026	The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited…
CVE-2026-108484	WordPress Best Payments Plugin for WP	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
CVE-2026-108483	WordPress Hippoo Mobile App For Woocommerce	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
CVE-2026-105066	WordPress SimplyRETS Real Estate IDX	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
CVE-2026-107870	Crocoblock Jetengine	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
CVE-2026-107867	WordPress JetProductTables	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
CVE-2026-105874	WordPress Surecart	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-107428	VideoWhisper.com Paid Videochat Turnkey Site	Hig	0.46	7.1	0.00	Oct 14, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
CVE-2026-104909	WordPress Mang Board	Hig	0.46	8.1	0.01	Oct 14, 2026	The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on…
CVE-2026-103367	WordPress ShopMagic	Hig	0.46	8.1	0.01	Oct 14, 2026	The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and…
CVE-2026-104995	WordPress Bp Profile Search	Hig	0.46	8.1	0.01	Oct 14, 2026	The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax()…
CVE-2026-91829	WordPress Subscribe to Comments	Hig	0.46	7.1	0.00	Oct 11, 2026	The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including…
CVE-2026-78534	WordPress Educavo	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
CVE-2026-78532	WordPress Lms	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-62116	WordPress Barcode Scanner with Inventory & Order Manager	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62100	WordPress KuteShop	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
CVE-2026-62095	WordPress Biolife	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
CVE-2026-62093	WordPress TechOne	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.
CVE-2026-62091	WordPress Armania	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
CVE-2026-62082	WordPress Pin WP	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
CVE-2026-62064	WordPress Ambed	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
CVE-2026-62037	WordPress Document Embedder	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
CVE-2026-62034	WordPress Before After Image Comparison	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
CVE-2026-62027	WordPress Team Section Block	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
CVE-2026-57742	ThemeREX Group Kids Planet	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
CVE-2026-42715	WordPress Photo Gallery By 10web	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
CVE-2026-42711	WordPress Slider 10web	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
CVE-2026-42709	WordPress WooCommerce Food - Restaurant Menu & Food ordering	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
CVE-2026-42702	WordPress Tutor Lms	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
CVE-2026-42697	WordPress Social Share Icons \& Social Share Buttons	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through…
CVE-2026-42693	WordPress Jannah	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
CVE-2026-42632	WordPress Qode Real Estate	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
CVE-2026-42631	WordPress Qode Music	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
CVE-2026-40803	WordPress Jotform AI Chatbot	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
CVE-2026-39800	WordPress Additional Order Filters For Woocommerce	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
CVE-2026-39799	WordPress wp-file-download	Hig	0.46	7.1	0.00	Oct 10, 2026	Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
CVE-2026-57806	WordPress Martfury - WooCommerce Marketplace WordPress Theme	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through…
CVE-2026-94160	WordPress ThemeStek Extras for LabtechCO Theme	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.
CVE-2026-102388	WordPress Forminator	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
CVE-2026-93951	WordPress Zeinet	Hig	0.46	7.1	0.00	Oct 10, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
CVE-2026-93949	WordPress Grocery Shopping Store	Hig	0.46	7.1	0.00	Oct 10, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
CVE-2026-104759	WordPress WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION	Hig	0.46	8.1	0.01	Oct 10, 2026	The WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using…
CVE-2026-92975	Groundhogg Groundhogg	Hig	0.46	8.1	0.00	Oct 10, 2026	The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by…
CVE-2026-104899	WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory	Hig	0.46	8.1	0.01	Oct 10, 2026	The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated…
CVE-2026-108125	WordPress Wp Post Author	Hig	0.46	—	0.00	Oct 9, 2026	Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0.
CVE-2026-94066	WordPress Pond	Hig	0.46	7.1	0.00	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.
CVE-2026-94063	WordPress Education Center	Hig	0.46	7.1	0.00	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
CVE-2026-62026	WordPress Dashboard Notes	Hig	0.46	7.1	0.00	Oct 9, 2026	Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.
CVE-2026-94061	WordPress Whistle - Sports Club	Hig	0.46	7.1	0.00	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

CVE-2026-108491HigOct 15, 2026
WordPress
Everest Forms
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
CVE-2026-74920HigOct 15, 2026
WordPress
Document Gallery
risk 0.46cvss 7.1epss 0.00
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited…
CVE-2026-108484HigOct 14, 2026
WordPress
Best Payments Plugin for WP
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
CVE-2026-108483HigOct 14, 2026
WordPress
Hippoo Mobile App For Woocommerce
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
CVE-2026-105066HigOct 14, 2026
WordPress
SimplyRETS Real Estate IDX
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
CVE-2026-107870HigOct 14, 2026
Crocoblock
Jetengine
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
CVE-2026-107867HigOct 14, 2026
WordPress
JetProductTables
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
CVE-2026-105874HigOct 14, 2026
WordPress
Surecart
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-107428HigOct 14, 2026
VideoWhisper.com
Paid Videochat Turnkey Site
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
CVE-2026-104909HigOct 14, 2026
WordPress
Mang Board
risk 0.46cvss 8.1epss 0.01
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on…
CVE-2026-103367HigOct 14, 2026
WordPress
ShopMagic
risk 0.46cvss 8.1epss 0.01
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and…
CVE-2026-104995HigOct 14, 2026
WordPress
Bp Profile Search
risk 0.46cvss 8.1epss 0.01
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax()…
CVE-2026-91829HigOct 11, 2026
WordPress
Subscribe to Comments
risk 0.46cvss 7.1epss 0.00
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including…
CVE-2026-78534HigOct 10, 2026
WordPress
Educavo
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
CVE-2026-78532HigOct 10, 2026
WordPress
Lms
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-62116HigOct 10, 2026
WordPress
Barcode Scanner with Inventory & Order Manager
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62100HigOct 10, 2026
WordPress
KuteShop
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
CVE-2026-62095HigOct 10, 2026
WordPress
Biolife
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
CVE-2026-62093HigOct 10, 2026
WordPress
TechOne
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.
CVE-2026-62091HigOct 10, 2026
WordPress
Armania
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
CVE-2026-62082HigOct 10, 2026
WordPress
Pin WP
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
CVE-2026-62064HigOct 10, 2026
WordPress
Ambed
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
CVE-2026-62037HigOct 10, 2026
WordPress
Document Embedder
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
CVE-2026-62034HigOct 10, 2026
WordPress
Before After Image Comparison
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
CVE-2026-62027HigOct 10, 2026
WordPress
Team Section Block
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
CVE-2026-57742HigOct 10, 2026
ThemeREX Group
Kids Planet
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
CVE-2026-42715HigOct 10, 2026
WordPress
Photo Gallery By 10web
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
CVE-2026-42711HigOct 10, 2026
WordPress
Slider 10web
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
CVE-2026-42709HigOct 10, 2026
WordPress
WooCommerce Food - Restaurant Menu & Food ordering
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
CVE-2026-42702HigOct 10, 2026
WordPress
Tutor Lms
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
CVE-2026-42697HigOct 10, 2026
WordPress
Social Share Icons \& Social Share Buttons
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through…
CVE-2026-42693HigOct 10, 2026
WordPress
Jannah
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
CVE-2026-42632HigOct 10, 2026
WordPress
Qode Real Estate
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
CVE-2026-42631HigOct 10, 2026
WordPress
Qode Music
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
CVE-2026-40803HigOct 10, 2026
WordPress
Jotform AI Chatbot
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
CVE-2026-39800HigOct 10, 2026
WordPress
Additional Order Filters For Woocommerce
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
CVE-2026-39799HigOct 10, 2026
WordPress
wp-file-download
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
CVE-2026-57806HigOct 10, 2026
WordPress
Martfury - WooCommerce Marketplace WordPress Theme
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through…
CVE-2026-94160HigOct 10, 2026
WordPress
ThemeStek Extras for LabtechCO Theme
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.
CVE-2026-102388HigOct 10, 2026
WordPress
Forminator
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
CVE-2026-93951HigOct 10, 2026
WordPress
Zeinet
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
CVE-2026-93949HigOct 10, 2026
WordPress
Grocery Shopping Store
risk 0.46cvss 7.1epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
CVE-2026-104759HigOct 10, 2026
WordPress
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
risk 0.46cvss 8.1epss 0.01
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using…
CVE-2026-92975HigOct 10, 2026
Groundhogg
Groundhogg
risk 0.46cvss 8.1epss 0.00
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by…
CVE-2026-104899HigOct 10, 2026
WordPress
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
risk 0.46cvss 8.1epss 0.01
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated…
CVE-2026-108125HigOct 9, 2026
WordPress
Wp Post Author
risk 0.46cvss —epss 0.00
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0.
CVE-2026-94066HigOct 9, 2026
WordPress
Pond
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.
CVE-2026-94063HigOct 9, 2026
WordPress
Education Center
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
CVE-2026-62026HigOct 9, 2026
WordPress
Dashboard Notes
risk 0.46cvss 7.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.
CVE-2026-94061HigOct 9, 2026
WordPress
Whistle - Sports Club
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

Page 192 of 802