CVE-2026-62033

WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Subscriber Settings Change in uListing <= 2.2.0 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62028

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62025

WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62024

WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62022

WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62021

WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-5725

Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-4791

PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42706

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42705

WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40808

WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40805

WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40801

WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40777

WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39802

WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39801

WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-18558

Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-17025

Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-16776

MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time wp_kses_post does not neutralize the payload because the attack is delivered via shortcode attributes rather than raw HTML in post content, allowing the unescaped values to survive to render time.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-14877

Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—