CVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Headless Single Sign On Wordpress

CVE-2026-28189

WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-61965

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress

Products

Geekybot Wordpress

CVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Otp Verification Wordpress

CVE-2026-66424

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress

CVE-2026-66429

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66430

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66444

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kendysond Wordpress

Products

Payment Forms For Paystack Wordpress

CVE-2026-66456

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft Wordpress

Products

Profile Extra Fields Wordpress

CVE-2026-66461

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smepay Wordpress

Products

Smepay:upi Gateway For Woocommerce Wordpress

CVE-2026-66467

WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluentcommunity

CVE-2026-66653

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Barista Wordpress

CVE-2026-66656

WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Foton Core Wordpress

CVE-2026-66657

WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Biagiotti Wordpress

CVE-2026-66658

WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mvp Themes Wordpress

Products

Reviewer Wordpress

CVE-2026-66704

WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jegstudio Wordpress

Products

Gutenverse Wordpress

CVE-2026-73188

WordPress KiviCare plugin <= 4.5.1 - Sensitive Data Exposure vulnerability

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Iqonic Wordpress

Products

Kivicare Wordpress

CVE-2026-73340

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fifu Wordpress

Products

Featured Image From Url Wordpress

CVE-2026-73346

WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mailchimp Wordpress

Products

Mailchimp For Woocommerce Wordpress

CVE-2026-73353

WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Revolut Wordpress

Products

Revolut Gateway For Woocommerce Wordpress