CVE-2026-54835

WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rustaurius Wordpress

Products

Five Star Restaurant Menu Wordpress

CVE-2026-54837

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Intranet &amp; Private Site &#8211; All-in-one Intranet Wordpress

CVE-2026-54839

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups <= 2.0.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kingaddons Wordpress

Products

Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups Wordpress

CVE-2026-54846

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Akosglys Wordpress

Products

Syncee Premium Dropshipping &amp; Wholesale Wordpress

CVE-2026-56025

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paymob Wordpress

Products

Paymob For Woocommerce Wordpress

CVE-2026-56026

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chris Carlevato Wordpress

Products

Utm.codes Wordpress

CVE-2026-56029

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Corvuspay Wordpress

Products

Woocommerce Payment Gateway Wordpress

CVE-2026-56033

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dokan Multivendor Plugin Wordpress

Products

Dokan Pro Wordpress

CVE-2026-56035

WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cory Marsh Wordpress

Products

Bitfire Security Wordpress

CVE-2026-56036

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codemstory Wordpress

Products

워드프레스 결제 심플페이 Wordpress

CVE-2026-56038

WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Frisbii Wordpress

Products

Frisbii Pay Wordpress

CVE-2026-56039

WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wordpress.com

Products

Wordpress Quick Interest Slider

CVE-2026-56040

WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wordpress.com

Products

Wordpress Gutenverse Form

CVE-2026-56047

WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Perfmatters, Powered Kinsta + Generatepress Docs Changelog Feature Requests Legal Affiliate Contact Wordpress

Products

Perfmatters Wordpress

CVE-2026-56059

WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Physcode Wordpress

Products

Travel Booking Wordpress

CVE-2026-56062

WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

CVSS 3.1 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Oooorgle Wordpress

Products

Quotes Llama Wordpress

CVE-2026-56063

WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Mailchimp Block Wordpress

CVE-2026-56069

WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Site Building With Toolset Wordpress

Products

Toolset Forms Wordpress

CVE-2026-57316

WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Roxnor Wordpress

Products

Getgenie Wordpress

CVE-2026-57321

WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Icc0rz Wordpress

Products

H5p Wordpress