CVE-2026-57677

WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Novalnet Wordpress

Products

Novalnet Payment Gateway For Woocommerce Wordpress

CVE-2026-57683

WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Epsiloncool Wordpress

Products

Wp Fast Total Search Wordpress

CVE-2026-57684

WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tranmautritam Wordpress

Products

Thefox Wordpress

CVE-2026-57685

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drfuri Wordpress

Products

Martfury - Woocommerce Marketplace Wordpress Theme Wordpress

CVE-2026-57686

WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpxpo

Products

Wordpress Wowaddons

CVE-2026-57688

WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Gurmehub Wordpress

Products

Pos Entegratör Wordpress

CVE-2026-57689

WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Werkstatt Wordpress

CVE-2026-57690

WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Werkstatt Wordpress

CVE-2026-57748

WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Shopify Help Center Wordpress

Products

Shopify Wordpress

CVE-2026-57750

WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Keksdieb Wordpress

Products

Ez Form Calculator Premium Wordpress

CVE-2026-57751

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Heateor Support Wordpress

Products

Heateor Social Login Wordpress

CVE-2026-57753

WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nathanbarry Wordpress

Products

Kit (formerly Convertkit) For Woocommerce Wordpress

CVE-2026-57755

WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Misbah Wp Wordpress

Products

Mosaic Gallery &#8211; Advanced Gallery Wordpress

CVE-2026-57756

WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability

Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress 友人a丶

Products

Wordpress Nicen-localize-image

CVE-2026-57757

WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ploudapp Wordpress

Products

Pcloud Wp Backup Wordpress

CVE-2026-57761

WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Blueastralthemes Wordpress

Products

Seowp Wordpress

CVE-2026-57762

WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Andrew Fiebert Wordpress

Products

Simple Urls Wordpress

CVE-2026-57763

WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gordon Böhme Wordpress

Products

Structured Content Wordpress

CVE-2026-57764

WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Surbma Wordpress

Products

Surbma | Yoast Seo Breadcrumb Shortcode Wordpress

CVE-2026-57760

WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sendcloud Wordpress

Products

Sendcloud Shipping Wordpress