CVE-2026-73364

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdesk

Products

Wordpress Flexible Subscriptions

CVE-2026-73384

WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cmsminds Wordpress

Products

Pay With Contact Form 7 Wordpress

CVE-2026-73385

WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Outanking Team Wordpress

Products

Outranking Plugin Options Wordpress

CVE-2026-73387

WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Smartdatasoft Wordpress

Products

Resido Wordpress

CVE-2026-73389

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

The4 Wordpress

Products

Kalles Addons Wordpress

CVE-2026-73390

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Klbtheme Wordpress

Products

Total Donations Wordpress

CVE-2026-73391

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Klbtheme Wordpress

Products

Total Donations Wordpress

CVE-2026-77067

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Omnivore-app

Products

Omnivore

CVE-2026-74021

WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anders Norén Wordpress

Products

Chaplin Wordpress

CVE-2026-66590

WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tagembed Wordpress

Products

Tagembed Wordpress

CVE-2026-66594

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lukeseager Wordpress

Products

Wordpress Persistent Login Wordpress

CVE-2026-66598

WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kingtech Llc. Wordpress

Products

B2bking Premium Wordpress

CVE-2026-66605

WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hasthemes Wordpress

Products

Swatchly – Woocommerce Variation Swatches For Products Wordpress

CVE-2026-66606

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Smartsmtp Wordpress

CVE-2026-66609

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codexthemes Wordpress

Products

Thegem (elementor) Wordpress

CVE-2026-66647

WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

Homlisti Wordpress

CVE-2026-66672

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66673

WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66677

WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vaultdweller Wordpress

Products

Leyka Wordpress

CVE-2026-68564

WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Notificationx Wordpress

Products

Notificationx Pro Wordpress