CVE-2026-19052

ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Prosolution Wordpress

Products

Prosolution Wp Client Wordpress

CVE-2026-27345

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Magepeople Wordpress

Products

Taxi Booking Manager For Woocommerce Wordpress

CVE-2026-27537

WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Supsysticcom Wordpress

Products

Smart Popup By Supsystic Wordpress

CVE-2026-28004

WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Strategy11team Wordpress

Products

Business Directory Plugin Wordpress

CVE-2026-28008

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Oauth Single Sign On – Sso (oauth Client) Wordpress

CVE-2026-28148

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Headless Single Sign On Wordpress

CVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Headless Single Sign On Wordpress

CVE-2026-28189

WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-61965

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress

Products

Geekybot Wordpress

CVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Otp Verification Wordpress

CVE-2026-66424

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress

CVE-2026-66429

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66430

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-66444

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kendysond Wordpress

Products

Payment Forms For Paystack Wordpress

CVE-2026-66456

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft Wordpress

Products

Profile Extra Fields Wordpress

CVE-2026-66461

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smepay Wordpress

Products

Smepay:upi Gateway For Woocommerce Wordpress

CVE-2026-66467

WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluentcommunity

CVE-2026-66653

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Barista Wordpress

CVE-2026-66656

WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Foton Core Wordpress

CVE-2026-66657

WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Biagiotti Wordpress