CVE-2026-39748

WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39745

WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39731

WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39729

WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39728

WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39724

WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39722

WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39720

WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39719

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39599

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32581

WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability

Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32580

WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32579

WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32578

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32577

WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32575

WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32572

WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32571

WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32570

WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32569

WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—