CVE-2026-57527

ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zaproxy

Products

Zap-extensions

CVE-2025-63041

WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability

Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Codeamp Wordpress

Products

Forget About Shortcode Buttons Wordpress

CVE-2025-63078

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability

Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetmonsters Wordpress

Products

Restaurant Menu By Motopress Wordpress

CVE-2025-63079

WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress

Products

Live Copy Paste For Elementor Wordpress

CVE-2025-64636

WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rhewlif Wordpress

Products

Donation Thermometer Wordpress

CVE-2025-64637

WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opal Wp Wordpress

Products

Auros Core Wordpress

CVE-2025-66123

WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

About Envato Wordpress

Products

Bookpro Wordpress

CVE-2025-68063

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Splash - Sport Club Wordpress Theme For Basketball, Football, Hockey Wordpress

CVE-2025-68064

WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Everthemess Wordpress

Products

Goya Core Wordpress

CVE-2025-68074

WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ghozylab Wordpress

Products

Image Carousel Wordpress

CVE-2025-68075

WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kerry Wordpress

Products

Bne Testimonials Wordpress

CVE-2026-54833

WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Dev Kabir Wordpress

Products

Enable Cors Wordpress

CVE-2026-54834

WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fpuenteonline Wordpress

Products

Object Cache 4 Everyone Wordpress

CVE-2026-54835

WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rustaurius Wordpress

Products

Five Star Restaurant Menu Wordpress

CVE-2026-54837

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Intranet &amp; Private Site &#8211; All-in-one Intranet Wordpress

CVE-2026-54839

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups <= 2.0.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kingaddons Wordpress

Products

Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups Wordpress

CVE-2026-54846

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Akosglys Wordpress

Products

Syncee Premium Dropshipping &amp; Wholesale Wordpress

CVE-2026-56025

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paymob Wordpress

Products

Paymob For Woocommerce Wordpress

CVE-2026-56026

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chris Carlevato Wordpress

Products

Utm.codes Wordpress

CVE-2026-56029

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Corvuspay Wordpress

Products

Woocommerce Payment Gateway Wordpress