CVE-2026-66590

WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tagembed Wordpress

Products

Tagembed Wordpress

CVE-2026-66594

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lukeseager Wordpress

Products

Wordpress Persistent Login Wordpress

CVE-2026-66598

WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kingtech Llc. Wordpress

Products

B2bking Premium Wordpress

CVE-2026-66605

WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hasthemes Wordpress

Products

Swatchly – Woocommerce Variation Swatches For Products Wordpress

CVE-2026-66606

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Smartsmtp Wordpress

CVE-2026-66609

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codexthemes Wordpress

Products

Thegem (elementor) Wordpress

CVE-2026-66647

WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

Homlisti Wordpress

CVE-2026-66672

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66673

WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66677

WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vaultdweller Wordpress

Products

Leyka Wordpress

CVE-2026-68564

WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Notificationx Wordpress

Products

Notificationx Pro Wordpress

CVE-2026-73998

WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Axew3 Wordpress

Products

Wp W3all Phpbb Wordpress

CVE-2026-74013

WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wordpress.com

Products

Wordpress Eshipper Commerce

CVE-2026-74014

WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Indithemes Wordpress

Products

It Residence Wordpress

CVE-2026-74016

WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Smart Cleaning Wordpress

CVE-2026-74018

WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Warehouse Cargo Wordpress

CVE-2026-74020

WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anders Norén Wordpress

Products

Koji Wordpress

CVE-2026-28163

WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress

Products

New User Approve Wordpress

CVE-2026-15706

Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Baylan Measuring Instruments Industry And Trade Inc.

Products

Baylan Smart Meter Management Application (bms)

CVE-2026-55558

aiosmtplib: STARTTLS response injection

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cole

Products

Aiosmtplib