CVE-2026-27372

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Peprodev Wordpress

Products

Peprodev Ultimate Invoice Wordpress

CVE-2026-27391

WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in uListing <= 2.2.0 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Ulisting Wordpress

CVE-2026-27392

WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in uListing <= 2.2.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Ulisting Wordpress

CVE-2026-27423

WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-57367

WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpbookingsystem

Products

Wordpress Wp Booking System

CVE-2026-57701

WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Webcodingplace Wordpress

Products

Real Estate Manager Wordpress

CVE-2026-57717

WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Knit Pay Wordpress

Products

Knit Pay Wordpress

CVE-2026-57767

WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codecabin Wordpress

Products

Wp Google Maps Wordpress

CVE-2026-57784

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ninjaforms Wordpress

Products

Ninja Forms File Uploads Wordpress

CVE-2026-59513

WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Masteriyo Wordpress

Products

Masteriyo Wordpress

CVE-2026-59524

WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sandhillsdev Wordpress

Products

Easy Digital Downloads Wordpress

CVE-2026-59525

WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-59540

WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress

CVE-2026-59544

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Thrivethemes Wordpress

Products

Thrive Quiz Builder Wordpress

CVE-2026-59545

WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Discord Integration Wordpress

CVE-2026-59555

WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Rolandbarkerxnauwebdesign Wordpress

Products

Participants Database Wordpress

CVE-2026-61943

WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress

Products

Wpdm Premium Packages Wordpress

CVE-2026-61948

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress

Products

Wpdm Premium Packages Wordpress

CVE-2026-61981

WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Quantumcloud Wordpress

Products

Simple Link Directory Wordpress

CVE-2026-65454

WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress

Products

Quiz And Survey Master Wordpress