CVE-2026-27345

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Magepeople Wordpress

Products

Taxi Booking Manager For Woocommerce Wordpress

CVE-2026-27537

WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Supsysticcom Wordpress

Products

Smart Popup By Supsystic Wordpress

CVE-2026-28004

WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Strategy11team Wordpress

Products

Business Directory Plugin Wordpress

CVE-2026-28008

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Oauth Single Sign On – Sso (oauth Client) Wordpress

CVE-2026-28148

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Headless Single Sign On Wordpress

CVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Headless Single Sign On Wordpress

CVE-2026-28189

WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-61965

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress

Products

Geekybot Wordpress

CVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Otp Verification Wordpress

CVE-2026-66424

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress

CVE-2026-66429

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66430

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66444

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kendysond Wordpress

Products

Payment Forms For Paystack Wordpress

CVE-2026-66456

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft Wordpress

Products

Profile Extra Fields Wordpress

CVE-2026-66461

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smepay Wordpress

Products

Smepay:upi Gateway For Woocommerce Wordpress

CVE-2026-66467

WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluentcommunity

CVE-2026-66653

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Barista Wordpress

CVE-2026-66656

WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Foton Core Wordpress

CVE-2026-66657

WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Biagiotti Wordpress

CVE-2026-66658

WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mvp Themes Wordpress

Products

Reviewer Wordpress