CVE-2026-65541

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Solutioned Wordpress

Products

Staff Training Wordpress

CVE-2026-65542

WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65543

WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Vimeodev Wordpress

Products

Vimeo Wordpress

CVE-2026-65544

WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65554

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lattepress Wordpress

Products

Anspress – Question And Answer Wordpress

CVE-2026-65556

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mihche Wordpress

Products

Wpbruiser {no- Captcha Anti-spam} Wordpress

CVE-2026-65571

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

69 Clothing Wordpress

CVE-2026-65572

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

A.williams Wordpress

CVE-2026-66665

WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Brandexponents Wordpress

Products

Type Hub Wordpress

CVE-2026-66681

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeff Farthing Wordpress

Products

Theme My Login Wordpress

CVE-2026-66683

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Zone

Products

Wordpress Custom Css And Javascript

CVE-2026-66685

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Alex Wordpress

Products

Featured Video Plus Wordpress

CVE-2026-66686

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vladimir Garagulya Wordpress

Products

Plugins Garbage Collector (database Cleanup) Wordpress

CVE-2026-66696

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Gutenberg Blocks By Kadence Blocks Wordpress

CVE-2026-53977

OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Bohdan Triapitsyn

Products

Openchamber

CVE-2026-62873

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Admin Center Windows Admin Center

CVE-2026-57087

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 17 more

CVE-2026-57088

Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability

Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows Server 2019 Windows Server 2019 (server Core Installation) and 3 more

CVE-2026-57093

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-57096

Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more