CVE-2026-28186

WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Travelfic Toolkit Wordpress

CVE-2026-61978

WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Webhosting4ugr Wordpress

Products

Secure Card Gateway For Epay Paycenter (piraeus Bank) Wordpress

CVE-2026-65580

WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bracketweb Wordpress

Products

Agrion Wordpress

CVE-2026-66446

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

If-so Dynamic Content Wordpress

Products

If-so Dynamic Content Personalization Wordpress

CVE-2026-66455

WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Rockiger Wordpress

Products

Reactpress Wordpress

CVE-2026-66462

WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bookingwp Wordpress

Products

Woocommerce Appointments Wordpress

CVE-2026-66463

WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hassan Fakih Wordpress

Products

Icarry Wordpress

CVE-2026-66464

WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Toast Plugins Wordpress

Products

Internal Link Optimiser Wordpress

CVE-2026-66465

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Agnihd Wordpress

Products

Cartify Wordpress

CVE-2026-66466

WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Storegrowth: Smart Sales Booster For Woocommerce | Bogo, Upsells, Direct Checkout, Quick View, Side Cart Wordpress

CVE-2026-66468

WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Powerfulwp Wordpress

Products

Local Delivery Drivers For Woocommerce Wordpress

CVE-2026-66469

WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Afonso Matos Wordpress

Products

Arvow Ai Seo Writer Wordpress

CVE-2026-66654

WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Tangiblewp Wordpress

Products

Vehica Core Wordpress

CVE-2026-66661

WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Onokazu Wordpress

Products

Directories Pro Wordpress

CVE-2026-66691

WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Scriptsbundle Wordpress

Products

Nokri Wordpress

CVE-2026-16101

forced re-pairing with already bonded device

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs.com

Products

Wiseconnect

CVE-2026-19291

Bluetooth re-pairing can use a lower security level than previous

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs.com

Products

Wiseconnect

CVE-2026-19292

Bluetooth re-pairing with legitimate device can use lower security level

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs.com

Products

Wiseconnect

CVE-2026-19293

SMP security request

SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs.com

Products

Wiseconnect

CVE-2026-65932

BT122 stops advertising

The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs.com

Products

Bt122