Vendor CVEs

WordPress

All CVEs

40,071 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-94060	WordPress Voldor	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.
CVE-2026-94059	WordPress Ogency	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.
CVE-2026-94058	WordPress Treck	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.
CVE-2026-105883	WordPress Th Shop Mania	Hig	0.46	7.1	Oct 9, 2026	Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
CVE-2026-105870	Delight Star Inc. WP Associate Post R2	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
CVE-2026-105318	WordPress AcyMailing SMTP Newsletter	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
CVE-2026-96761	WordPress Welcart eCommerce	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
CVE-2026-96607	WordPress NEX-Forms	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.
CVE-2026-96553	WordPress Ajax Search For Woocommerce	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
CVE-2026-96332	WordPress Simple Payment	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
CVE-2026-95609	WordPress Media Library Assistant	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
CVE-2026-95608	Pluginus Woocommerce Products Filter	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
CVE-2026-95598	WordPress Search in Place	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
CVE-2026-95596	WordPress Shopbuilder	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons:…
CVE-2026-95591	WordPress Vikbooking Hotel Booking Engine \& Pms	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.
CVE-2026-94668	Dimitri Grassi Salon booking system	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
CVE-2026-94661	WordPress JetBlog	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
CVE-2026-94415	WordPress Betheme	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
CVE-2026-94170	WordPress Sassy Social Share	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.
CVE-2026-94167	WordPress Kubio AI Page Builder	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.
CVE-2026-94166	Upsolution UpSolution Core	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.
CVE-2026-94161	WordPress Grand Restaurant	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.
CVE-2026-94159	WordPress Total Donations	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.
CVE-2026-94158	WordPress Gloria Admin Panel	Hig	0.46	7.1	Oct 9, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.
CVE-2026-40804	WordPress Ablocks	Hig	0.46	7.1	Oct 8, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
CVE-2026-66479	WordPress Wpcomplete	Hig	0.46	7.1	Oct 8, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
CVE-2026-106611	WordPress Forminator	Hig	0.46	7.1	Oct 8, 2026	Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
CVE-2026-95595	WordPress Disable and Remove Google Fonts	Hig	0.46	7.1	Oct 7, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts \| GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts \| GDPR…
CVE-2026-94670	WordPress Everest Forms	Hig	0.46	7.1	Oct 7, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
CVE-2026-87971	WordPress If-So Dynamic Content	Hig	0.46	7.1	Oct 7, 2026	The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted…
CVE-2026-105316	WordPress Magee Shortcodes	Hig	0.46	7.1	Oct 7, 2026	The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
CVE-2026-94675	WordPress Fluent Forms Pro Add On Pack	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
CVE-2026-42636	WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
CVE-2026-42635	WordPress WooCommerce Simple Auctions	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
CVE-2026-42634	WordPress Video Background	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
CVE-2026-42418	WordPress Social Rocket	Hig	0.46	7.1	Oct 6, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
CVE-2026-40807	WordPress CF7 Views	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
CVE-2026-40806	WordPress Blog Posts And Category For Elementor	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
CVE-2026-39790	WordPress Vikrentcar	Hig	0.46	7.1	Oct 6, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.
CVE-2026-39784	WordPress Hotel Booking	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
CVE-2026-39781	WordPress Document Gallery	Hig	0.46	7.1	Oct 6, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
CVE-2026-39780	WordPress Youzify	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
CVE-2026-39778	WordPress Ansar Import	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
CVE-2026-39766	WordPress Arforms	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVE-2026-39758	WordPress Midtrans-WooCommerce	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
CVE-2026-39750	WordPress StoreGrowth: Smart Sales Booster for WooCommerce	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
CVE-2026-39748	WordPress Edumall	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
CVE-2026-39745	WordPress Contact Form to DB by BestWebSoft	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
CVE-2026-39731	WordPress Database For Cf7	Hig	0.46	7.1	Oct 6, 2026	Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
CVE-2026-39730	WordPress Wise Chat	Hig	0.46	7.1	Oct 6, 2026	Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

CVE-2026-94060HigOct 9, 2026
WordPress
Voldor
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.
CVE-2026-94059HigOct 9, 2026
WordPress
Ogency
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.
CVE-2026-94058HigOct 9, 2026
WordPress
Treck
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.
CVE-2026-105883HigOct 9, 2026
WordPress
Th Shop Mania
risk 0.46cvss 7.1epss 0.00
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
CVE-2026-105870HigOct 9, 2026
Delight Star Inc.
WP Associate Post R2
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
CVE-2026-105318HigOct 9, 2026
WordPress
AcyMailing SMTP Newsletter
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
CVE-2026-96761HigOct 9, 2026
WordPress
Welcart eCommerce
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
CVE-2026-96607HigOct 9, 2026
WordPress
NEX-Forms
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.
CVE-2026-96553HigOct 9, 2026
WordPress
Ajax Search For Woocommerce
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
CVE-2026-96332HigOct 9, 2026
WordPress
Simple Payment
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
CVE-2026-95609HigOct 9, 2026
WordPress
Media Library Assistant
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
CVE-2026-95608HigOct 9, 2026
Pluginus
Woocommerce Products Filter
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
CVE-2026-95598HigOct 9, 2026
WordPress
Search in Place
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
CVE-2026-95596HigOct 9, 2026
WordPress
Shopbuilder
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons:…
CVE-2026-95591HigOct 9, 2026
WordPress
Vikbooking Hotel Booking Engine \& Pms
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.
CVE-2026-94668HigOct 9, 2026
Dimitri Grassi
Salon booking system
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
CVE-2026-94661HigOct 9, 2026
WordPress
JetBlog
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
CVE-2026-94415HigOct 9, 2026
WordPress
Betheme
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
CVE-2026-94170HigOct 9, 2026
WordPress
Sassy Social Share
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.
CVE-2026-94167HigOct 9, 2026
WordPress
Kubio AI Page Builder
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.
CVE-2026-94166HigOct 9, 2026
Upsolution
UpSolution Core
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.
CVE-2026-94161HigOct 9, 2026
WordPress
Grand Restaurant
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.
CVE-2026-94159HigOct 9, 2026
WordPress
Total Donations
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.
CVE-2026-94158HigOct 9, 2026
WordPress
Gloria Admin Panel
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.
CVE-2026-40804HigOct 8, 2026
WordPress
Ablocks
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
CVE-2026-66479HigOct 8, 2026
WordPress
Wpcomplete
risk 0.46cvss 7.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
CVE-2026-106611HigOct 8, 2026
WordPress
Forminator
risk 0.46cvss 7.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
CVE-2026-95595HigOct 7, 2026
WordPress
Disable and Remove Google Fonts
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR…
CVE-2026-94670HigOct 7, 2026
WordPress
Everest Forms
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
CVE-2026-87971HigOct 7, 2026
WordPress
If-So Dynamic Content
risk 0.46cvss 7.1epss 0.00
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted…
CVE-2026-105316HigOct 7, 2026
WordPress
Magee Shortcodes
risk 0.46cvss 7.1epss 0.00
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
CVE-2026-94675HigOct 6, 2026
WordPress
Fluent Forms Pro Add On Pack
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
CVE-2026-42636HigOct 6, 2026
WordPress
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
CVE-2026-42635HigOct 6, 2026
WordPress
WooCommerce Simple Auctions
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
CVE-2026-42634HigOct 6, 2026
WordPress
Video Background
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
CVE-2026-42418HigOct 6, 2026
WordPress
Social Rocket
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
CVE-2026-40807HigOct 6, 2026
WordPress
CF7 Views
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
CVE-2026-40806HigOct 6, 2026
WordPress
Blog Posts And Category For Elementor
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
CVE-2026-39790HigOct 6, 2026
WordPress
Vikrentcar
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.
CVE-2026-39784HigOct 6, 2026
WordPress
Hotel Booking
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
CVE-2026-39781HigOct 6, 2026
WordPress
Document Gallery
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
CVE-2026-39780HigOct 6, 2026
WordPress
Youzify
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
CVE-2026-39778HigOct 6, 2026
WordPress
Ansar Import
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
CVE-2026-39766HigOct 6, 2026
WordPress
Arforms
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVE-2026-39758HigOct 6, 2026
WordPress
Midtrans-WooCommerce
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
CVE-2026-39750HigOct 6, 2026
WordPress
StoreGrowth: Smart Sales Booster for WooCommerce
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
CVE-2026-39748HigOct 6, 2026
WordPress
Edumall
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
CVE-2026-39745HigOct 6, 2026
WordPress
Contact Form to DB by BestWebSoft
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
CVE-2026-39731HigOct 6, 2026
WordPress
Database For Cf7
risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
CVE-2026-39730HigOct 6, 2026
WordPress
Wise Chat
risk 0.46cvss 7.1epss 0.00
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

Page 193 of 802