CVE-2026-94675

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fluent Forms Free Vs Pro Wordpress-extensions

Products

Fluent Forms Pro Add On Pack Fluent Forms Pro Add On Pack

CVE-2026-95526

WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress-extensions

Products

Bear Bear

CVE-2026-97308

WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Webfactoryltd Wordpress-extensions

Products

Wp Login Lockdown Login Lockdown

CVE-2026-100518

WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webfactoryltd Wordpress-extensions

Products

Advanced Google Recaptcha Advanced Google Recaptcha

CVE-2026-102387

WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Xserver

Products

Xserver Migrator Xserver Migrator

CVE-2026-102915

WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Marco Van Wieren Wordpress-extensions

Products

Wpo365 Wpo365

CVE-2026-104385

WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adrian Tobey Wordpress-extensions

Products

Groundhogg Groundhogg

CVE-2026-104387

WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Blubrry Wordpress-extensions

Products

Powerpress Podcasting Powerpress Podcasting

CVE-2026-104394

WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress-extensions

Products

Charitable Charitable

CVE-2026-104395

WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Picu Wordpress-extensions

Products

Picu Picu

CVE-2026-104405

WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress-extensions

Products

Givewp Givewp

CVE-2026-104406

WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Picu Wordpress-extensions

Products

Picu Picu

CVE-2026-104670

WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-104672

WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress-extensions

Products

Givewp Givewp

CVE-2026-104747

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress-extensions

Products

Haaken Haaken

CVE-2026-104757

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Carazo Wordpress-extensions

Products

Import And Export Users And Customers Import And Export Users And Customers

CVE-2026-104814

WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Epiph Wordpress-extensions

Products

Form Block Form Block

CVE-2026-105057

WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ben Marshall Wordpress-extensions

Products

Zero Spam Zero Spam

CVE-2026-105058

WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

John James Jacoby Wordpress-extensions

Products

Wp User Profiles Wp User Profiles

CVE-2026-105061

WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brandtoss Wordpress-extensions

Products

Wpmailster Wp Mailster