CVE-2025-68081

WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability

Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Lester Chan Wordpress

Products

Wp-polls Wordpress

CVE-2026-24628

WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Photo Gallery By Supsystic Wordpress

CVE-2026-24639

WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability

Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ronald Huereca Wordpress

Products

Photo Block Wordpress

CVE-2026-25405

WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability

Contributor SQL Injection in eRoom <= 1.7.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Digitalme Wordpress

Products

Eroom Wordpress

CVE-2026-25427

WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Digitalme Wordpress

Products

Eroom Wordpress

CVE-2026-27064

WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Everpress Wordpress

Products

Mailster Wordpress

CVE-2026-27377

WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Quickcal - Appointment Booking Calendar For Wordpress Wordpress

CVE-2026-27399

WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webwizards Wordpress

Products

Marketking Wordpress

CVE-2026-57370

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepress It Solutions Llc Wordpress

Products

Visitor Traffic Real Time Statistics Pro Wordpress

CVE-2026-57397

WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Thimpress. Wordpress

Products

Coaching Wordpress

CVE-2026-57425

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdesk

Products

Wordpress Autopay Dla Woocommerce

CVE-2026-57427

WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Download Monitor Wordpress

Products

Download Monitor - Wpforms Lock Wordpress

CVE-2026-57699

WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bqworks Wordpress

Products

Slider Pro Wordpress

CVE-2026-57785

WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apustheme Wordpress

Products

Apuslisting Wordpress

CVE-2026-59514

WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mightynetworks Vs Buddyboss Wordpress

Products

Buddyboss Platform Wordpress

CVE-2026-59542

WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Chill

Products

Wordpress Kali Forms

CVE-2026-59543

WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wplake

Products

Wordpress Advanced Views

CVE-2026-61954

WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Payu India Wordpress

Products

Payu India Wordpress

CVE-2026-61972

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woolentor Wordpress

Products

Shoplentor Pro Wordpress

CVE-2026-61973

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woolentor Wordpress

Products

Shoplentor Pro Wordpress