CVE-2026-65464

WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Givewp Wordpress

CVE-2026-65471

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Avada Studio Wordpress

Products

Avada Core Wordpress

CVE-2026-65472

WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kit Wordpress

Products

Kit (formerly Convertkit) Wordpress

CVE-2026-65473

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Virtue/ascend/pinnacle Toolkit Wordpress

CVE-2026-65486

WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bastien Ho Wordpress

Products

Event Post Wordpress

CVE-2026-65500

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65501

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vendidero Wordpress

Products

Shiptastic For Woocommerce Wordpress

CVE-2026-65511

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65521

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mahmudul Hasan Arif Wordpress

Products

Wp Social Ninja Wordpress

CVE-2026-65522

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65524

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Avada Custom Branding Wordpress

CVE-2026-65534

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Charlie Etienne Wordpress

Products

Custom Links In Elementor Image Carousel Wordpress

CVE-2026-65535

WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Takayuki Miyauchi Wordpress

Products

Tinymce Templates Wordpress

CVE-2026-65536

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mahdi Yousefi Wordpress

Products

افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) Wordpress

CVE-2026-65537

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Cyr To Lat Reloaded – Transliteration Of Links And File Names Wordpress

CVE-2026-65538

WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nilo Velez Wordpress

Products

Machete Wordpress

CVE-2026-65539

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bimal Rekhadiya Wordpress

Products

Kwayy Html Sitemap Wordpress

CVE-2026-65540

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Metin Saraç Wordpress

Products

Popup For Cf7 With Sweet Alert Wordpress

CVE-2026-65550

WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpshopmart

Products

Wordpress Tabs

CVE-2026-61945

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Multivendorx Wordpress

Products

Woocommerce Product Stock Alert Wordpress