CVE-2025-69152

WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Artale | Wedding Photography Wordpress Wordpress

CVE-2025-69153

WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Trendy Travel Wordpress

CVE-2025-69154

WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Spalab | Beauty Salon Wordpress Theme Wordpress

CVE-2025-69155

WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Fitness Zone Wordpress Theme Wordpress

CVE-2025-69156

WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Design Themes Wordpress

Products

Kids Zone - Children Wordpress Theme Wordpress

CVE-2026-27404

WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Lms Wordpress

CVE-2026-27412

WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Pearl - Corporate Business Wordpress

CVE-2026-27414

WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Werkstatt Wordpress

CVE-2026-27425

WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themesuite Wordpress

Products

Automotive Listings Wordpress

CVE-2026-27430

WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tranmautritam Wordpress

Products

Thefox Wordpress

CVE-2026-39448

WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Coderpress Wordpress

Products

Nowpayments For Woocommerce Wordpress

CVE-2026-57350

WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Andy Fragen Wordpress

Products

Wp Debugging Wordpress

CVE-2026-57354

WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock. Jetimpex Inc. Wordpress

Products

Jetreviews Wordpress

CVE-2026-57357

WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Search Atlas Group Wordpress

Products

Search Atlas Seo Wordpress

CVE-2026-57358

WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sysbasics Wordpress

Products

Customize My Account For Woocommerce Wordpress

CVE-2026-57426

WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Chill Media Labs S.r.l. Wordpress

Products

Modula - Pro Wordpress

CVE-2026-57672

WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Melograno Venture Studio Wordpress

Products

Wpdatatables Wordpress

CVE-2026-57673

WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Optimole Wordpress

Products

Optimole Wordpress

CVE-2026-57677

WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Novalnet Wordpress

Products

Novalnet Payment Gateway For Woocommerce Wordpress

CVE-2026-57683

WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Epsiloncool Wordpress

Products

Wp Fast Total Search Wordpress