CVE-2026-28570

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Spabrice Wordpress

Products

Vavo Core Wordpress

CVE-2026-32444

WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Cwicly Wordpress

Products

Cwicly Wordpress

CVE-2026-32463

WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Kamlesh Parmar Wordpress

Products

Sync Post With Other Site Wordpress

CVE-2026-32464

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Vladimir Prelovac Wordpress

Products

Theme Test Drive Wordpress

CVE-2026-32466

WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpexperts

Products

Wordpress Gravity Forms Bookings Premium

CVE-2026-32467

WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Apoyl Wordpress

Products

[aotuman] Grab Wechat Articles Wordpress

CVE-2026-32472

WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wbolt.com Wordpress

Products

Online Contact Widget Wordpress

CVE-2026-32473

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Deknows Wordpress

Products

Pdf Smart Viewer For Elementor Wordpress

CVE-2026-32474

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Templatiq

CVE-2026-66620

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Derek Herman Wordpress

Products

Optiontree Wordpress

CVE-2026-66633

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Forms Pro Add On Pack

CVE-2026-66634

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pantherius Wordpress

Products

Modal Survey Wordpress

CVE-2026-66639

WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpzoom

Products

Wordpress Wpzoom Forms – Contact Form Plugin For Gutenberg

CVE-2026-66640

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Marcus (aka @msykes) Wordpress

Products

Login With Ajax Wordpress

CVE-2026-66643

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wronganswersonly

Products

Wordpress Wufoo Shortcode

CVE-2026-66645

WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdeveloper

Products

Wordpress Table Of Contents Block

CVE-2026-66646

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mythemeshop Wordpress

Products

Wp Tab Widget Wordpress

CVE-2026-73181

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themecomplete Wordpress

Products

Extra Product Options & Add-ons For Woocommerce Wordpress

CVE-2026-73338

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autopay Wordpress

Products

Autopay Wordpress

CVE-2026-73342

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Magazine3 Wordpress

Products

Wp Multilang Wordpress