CVE-2026-11767

CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Crt Addons For Elementor

CVE-2026-13693

Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bit Form

CVE-2026-13694

Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bit Form

CVE-2026-14183

Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Classified Listing

CVE-2026-14185

WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wpbot

CVE-2026-8082

Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bpost Shipping Platform

CVE-2026-12968

Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wowaddons

CVE-2026-12421

ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Arforms

CVE-2026-12877

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Software Issue Manager

CVE-2026-12394

MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Memberglut

CVE-2026-11351

ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Shinystat Analytics

CVE-2026-11974

Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Media Folder Addon

CVE-2026-14333

Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Demi

CVE-2026-14830

FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Flxwoo

CVE-2026-14833

Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Lightbox With Photoswipe

CVE-2026-14834

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mailgun For Wordpress

CVE-2026-14849

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Paid Member Subscriptions

CVE-2026-14922

WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&amp;lt;img src=... onload=...&amp;gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`&lt;img ... onload=...&gt;`).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Photo Album Plus

CVE-2026-14927

FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fluentcart

CVE-2026-14928

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Js Help Desk