CVE-2026-57717

WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Knit Pay Wordpress

Products

Knit Pay Wordpress

CVE-2026-57767

WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codecabin Wordpress

Products

Wp Google Maps Wordpress

CVE-2026-57784

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ninjaforms Wordpress

Products

Ninja Forms File Uploads Wordpress

CVE-2026-59513

WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Masteriyo Wordpress

Products

Masteriyo Wordpress

CVE-2026-59524

WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sandhillsdev Wordpress

Products

Easy Digital Downloads Wordpress

CVE-2026-59525

WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-59540

WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress

CVE-2026-59544

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Thrivethemes Wordpress

Products

Thrive Quiz Builder Wordpress

CVE-2026-59545

WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Discord Integration Wordpress

CVE-2026-59555

WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-61943

WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress

Products

Wpdm Premium Packages Wordpress

CVE-2026-61948

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress

Products

Wpdm Premium Packages Wordpress

CVE-2026-61981

WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Quantumcloud Wordpress

Products

Simple Link Directory Wordpress

CVE-2026-65454

WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress

Products

Quiz And Survey Master Wordpress

CVE-2026-65463

WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Masteriyo Wordpress

Products

Masteriyo Wordpress

CVE-2026-65465

WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress

Products

Jetelements For Elementor Wordpress

CVE-2026-65466

WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock. Jetimpex Inc. Wordpress

Products

Jetreviews Wordpress

CVE-2026-65467

WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock. Jetimpex Inc. Wordpress

Products

Jetreviews Wordpress

CVE-2026-65468

WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress

Products

Jetbooking Wordpress

CVE-2026-65469

WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Strategy11 Wordpress

Products

Awp Classifieds Wordpress