CVE-2026-5224

Sensitive Data Exposure in Kriptek Crypto's Cryptosim

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kriptok Crypto

Products

Cryptosim

CVE-2026-16309

IDOR in Netiket Information Technologies' EdoWEB

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netiket Information Technologies

Products

Edoweb

CVE-2026-50575

BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Unitronix

Products

Betterdesk

CVE-2026-28567

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fahad Mahmood Wordpress

Products

Wp Sort Order Wordpress

CVE-2026-28570

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Spabrice Wordpress

Products

Vavo Core Wordpress

CVE-2026-32444

WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Cwicly Wordpress

Products

Cwicly Wordpress

CVE-2026-32463

WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Kamlesh Parmar Wordpress

Products

Sync Post With Other Site Wordpress

CVE-2026-32464

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Vladimir Prelovac Wordpress

Products

Theme Test Drive Wordpress

CVE-2026-32466

WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpexperts

Products

Wordpress Gravity Forms Bookings Premium

CVE-2026-32467

WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Apoyl Wordpress

Products

[aotuman] Grab Wechat Articles Wordpress

CVE-2026-32472

WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wbolt.com Wordpress

Products

Online Contact Widget Wordpress

CVE-2026-32473

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Deknows Wordpress

Products

Pdf Smart Viewer For Elementor Wordpress

CVE-2026-32474

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Templatiq

CVE-2026-66620

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Derek Herman Wordpress

Products

Optiontree Wordpress

CVE-2026-66633

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Forms Pro Add On Pack

CVE-2026-66634

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pantherius Wordpress

Products

Modal Survey Wordpress

CVE-2026-66639

WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpzoom

Products

Wordpress Wpzoom Forms – Contact Form Plugin For Gutenberg

CVE-2026-66640

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Marcus (aka @msykes) Wordpress

Products

Login With Ajax Wordpress

CVE-2026-66643

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wronganswersonly

Products

Wordpress Wufoo Shortcode

CVE-2026-66645

WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdeveloper

Products

Wordpress Table Of Contents Block