CVE-2026-16613

GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Gdpr Cookie Compliance

CVE-2026-16940

Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Custom Fields

CVE-2026-16942

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Custom Html Page

CVE-2026-16981

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Dhl For Woocommerce

CVE-2026-16993

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Dhl For Woocommerce

CVE-2026-14553

Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Zportals

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Peprodev Woocommerce Receipt Uploader

CVE-2026-14314

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Peprodev Woocommerce Receipt Uploader

CVE-2026-16268

Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Newsletters

CVE-2026-16954

AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ai Engine

CVE-2026-18050

Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Events Manager

CVE-2026-11588

EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Eonsr Aeo Agent

CVE-2026-14829

Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13's premium licensing state and erase the stored license key.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Checkimate

CVE-2026-18395

Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Child Pages Card

CVE-2026-16537

Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Slick Slider

CVE-2026-15246

RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Realhomes Memberships

CVE-2026-66457

WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pixelite Wordpress-extensions

Products

Events Manager Events Manager

CVE-2026-3430

Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Creative Mail

CVE-2026-5336

Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Dataverse Integration

CVE-2026-10599

Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Integrate Phonepe With Woocommerce