CVE-2026-96827

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96825

WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96824

WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96823

WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96822

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96821

WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96820

WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96819

WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96818

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96817

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96816

WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96815

WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96814

WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96450

WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96352

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96351

WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96350

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96349

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96348

WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96347

WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—