CVE-2026-32467

WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Apoyl Wordpress

Products

[aotuman] Grab Wechat Articles Wordpress

CVE-2026-32472

WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wbolt.com Wordpress

Products

Online Contact Widget Wordpress

CVE-2026-32473

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Deknows Wordpress

Products

Pdf Smart Viewer For Elementor Wordpress

CVE-2026-32474

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Templatiq

CVE-2026-66620

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Derek Herman Wordpress

Products

Optiontree Wordpress

CVE-2026-66633

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Forms Pro Add On Pack

CVE-2026-66634

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pantherius Wordpress

Products

Modal Survey Wordpress

CVE-2026-66639

WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpzoom

Products

Wordpress Wpzoom Forms – Contact Form Plugin For Gutenberg

CVE-2026-66640

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Marcus (aka @msykes) Wordpress

Products

Login With Ajax Wordpress

CVE-2026-66643

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wronganswersonly

Products

Wordpress Wufoo Shortcode

CVE-2026-66645

WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdeveloper

Products

Wordpress Table Of Contents Block

CVE-2026-66646

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mythemeshop Wordpress

Products

Wp Tab Widget Wordpress

CVE-2026-73181

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themecomplete Wordpress

Products

Extra Product Options & Add-ons For Woocommerce Wordpress

CVE-2026-73338

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autopay Wordpress

Products

Autopay Wordpress

CVE-2026-73342

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Magazine3 Wordpress

Products

Wp Multilang Wordpress

CVE-2026-73359

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Legal Pages

Products

Wordpress Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent

CVE-2026-73375

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73376

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73377

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73397

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Youzify

Products

Wordpress Youzify