CVE-2026-57785

WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apustheme Wordpress

Products

Apuslisting Wordpress

CVE-2026-59542

WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Chill

Products

Wordpress Kali Forms

CVE-2026-59543

WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wplake

Products

Wordpress Advanced Views

CVE-2026-61954

WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Payu India Wordpress

Products

Payu India Wordpress

CVE-2026-61972

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woolentor Wordpress

Products

Shoplentor Pro Wordpress

CVE-2026-61973

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woolentor Wordpress

Products

Shoplentor Pro Wordpress

CVE-2026-65457

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Yoomoney

Products

Wordpress Юkassa Для Woocommerce

CVE-2026-65461

WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Webの相談所 Wordpress

Products

Really Simple Csv Importer Wordpress

CVE-2026-65464

WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Givewp Wordpress

CVE-2026-65471

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Avada Studio Wordpress

Products

Avada Core Wordpress

CVE-2026-65472

WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kit Wordpress

Products

Kit (formerly Convertkit) Wordpress

CVE-2026-65473

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Virtue/ascend/pinnacle Toolkit Wordpress

CVE-2026-65486

WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bastien Ho Wordpress

Products

Event Post Wordpress

CVE-2026-65500

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65501

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vendidero Wordpress

Products

Shiptastic For Woocommerce Wordpress

CVE-2026-65511

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65521

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mahmudul Hasan Arif Wordpress

Products

Wp Social Ninja Wordpress

CVE-2026-65522

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65524

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Avada Custom Branding Wordpress

CVE-2026-65534

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Charlie Etienne Wordpress

Products

Custom Links In Elementor Image Carousel Wordpress