CVE-2026-65457

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Yoomoney

Products

Wordpress Юkassa Для Woocommerce

CVE-2026-65461

WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Webの相談所 Wordpress

Products

Really Simple Csv Importer Wordpress

CVE-2026-65464

WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Givewp Wordpress

CVE-2026-65471

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Avada Studio Wordpress

Products

Avada Core Wordpress

CVE-2026-65472

WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kit Wordpress

Products

Kit (formerly Convertkit) Wordpress

CVE-2026-65473

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Virtue/ascend/pinnacle Toolkit Wordpress

CVE-2026-65486

WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bastien Ho Wordpress

Products

Event Post Wordpress

CVE-2026-65500

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65501

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vendidero Wordpress

Products

Shiptastic For Woocommerce Wordpress

CVE-2026-65511

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65521

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mahmudul Hasan Arif Wordpress

Products

Wp Social Ninja Wordpress

CVE-2026-65522

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65524

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Avada Custom Branding Wordpress

CVE-2026-65534

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Charlie Etienne Wordpress

Products

Custom Links In Elementor Image Carousel Wordpress

CVE-2026-65535

WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Takayuki Miyauchi Wordpress

Products

Tinymce Templates Wordpress

CVE-2026-65536

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mahdi Yousefi Wordpress

Products

افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) Wordpress

CVE-2026-65537

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Cyr To Lat Reloaded – Transliteration Of Links And File Names Wordpress

CVE-2026-65538

WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nilo Velez Wordpress

Products

Machete Wordpress

CVE-2026-65539

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bimal Rekhadiya Wordpress

Products

Kwayy Html Sitemap Wordpress

CVE-2026-65540

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Metin Saraç Wordpress

Products

Popup For Cf7 With Sweet Alert Wordpress