CVE-2026-56025

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paymob Wordpress

Products

Paymob For Woocommerce Wordpress

CVE-2026-56026

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chris Carlevato Wordpress

Products

Utm.codes Wordpress

CVE-2026-56029

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Corvuspay Wordpress

Products

Woocommerce Payment Gateway Wordpress

CVE-2026-56033

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dokan Multivendor Plugin Wordpress

Products

Dokan Pro Wordpress

CVE-2026-56035

WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cory Marsh Wordpress

Products

Bitfire Security Wordpress

CVE-2026-56036

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codemstory Wordpress

Products

워드프레스 결제 심플페이 Wordpress

CVE-2026-56038

WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Frisbii Wordpress

Products

Frisbii Pay Wordpress

CVE-2026-56039

WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wordpress.com

Products

Wordpress Quick Interest Slider

CVE-2026-56040

WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wordpress.com

Products

Wordpress Gutenverse Form

CVE-2026-56047

WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Perfmatters, Powered Kinsta + Generatepress Docs Changelog Feature Requests Legal Affiliate Contact Wordpress

Products

Perfmatters Wordpress

CVE-2026-56059

WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Physcode Wordpress

Products

Travel Booking Wordpress

CVE-2026-56062

WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

CVSS 3.1 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Oooorgle Wordpress

Products

Quotes Llama Wordpress

CVE-2026-56063

WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Mailchimp Block Wordpress

CVE-2026-56069

WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Site Building With Toolset Wordpress

Products

Toolset Forms Wordpress

CVE-2026-57316

WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Roxnor Wordpress

Products

Getgenie Wordpress

CVE-2026-57321

WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Icc0rz Wordpress

Products

H5p Wordpress

CVE-2026-57323

WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Flash & Html5 Video Wordpress

CVE-2026-57325

WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jellywp Wordpress

Products

Nanomag Wordpress

CVE-2026-57430

WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Seopress Free Wordpress

Products

Seopress Pro Wordpress

CVE-2026-57618

WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Neve Pro Wordpress