CVE-2026-32469

WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpkube

Products

Wordpress Captcha 4wp

CVE-2026-65504

WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ivanbebek Wordpress

Products

Box Now Delivery Croatia Wordpress

CVE-2026-65517

WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Scott Paterson Wordpress

Products

Easy Paypal Buy Now Button Wordpress

CVE-2026-65523

WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Approveme Wordpress

Products

Formidable Forms Signature Online Contract Automation Wordpress

CVE-2026-65541

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Solutioned Wordpress

Products

Staff Training Wordpress

CVE-2026-65542

WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65543

WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Vimeodev Wordpress

Products

Vimeo Wordpress

CVE-2026-65544

WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65554

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lattepress Wordpress

Products

Anspress – Question And Answer Wordpress

CVE-2026-65556

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mihche Wordpress

Products

Wpbruiser {no- Captcha Anti-spam} Wordpress

CVE-2026-65571

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

69 Clothing Wordpress

CVE-2026-65572

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

A.williams Wordpress

CVE-2026-66665

WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Brandexponents Wordpress

Products

Type Hub Wordpress

CVE-2026-66681

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeff Farthing Wordpress

Products

Theme My Login Wordpress

CVE-2026-66683

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Zone

Products

Wordpress Custom Css And Javascript

CVE-2026-66685

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Alex Wordpress

Products

Featured Video Plus Wordpress

CVE-2026-66686

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vladimir Garagulya Wordpress

Products

Plugins Garbage Collector (database Cleanup) Wordpress

CVE-2026-66696

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Gutenberg Blocks By Kadence Blocks Wordpress

CVE-2026-53977

OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Bohdan Triapitsyn

Products

Openchamber

CVE-2026-62873

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Admin Center Windows Admin Center