Kicksend\ CVEs and Security Vulnerabilities

CVE-2025-64636

WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rhewlif Wordpress

Products

Donation Thermometer Wordpress

CVE-2025-64637

WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opal Wp Wordpress

Products

Auros Core Wordpress

CVE-2025-66123

WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

About Envato Wordpress

Products

Bookpro Wordpress

CVE-2025-68063

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Splash - Sport Club Wordpress Theme For Basketball, Football, Hockey Wordpress

CVE-2025-68064

WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Everthemess Wordpress

Products

Goya Core Wordpress

CVE-2025-68074

WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ghozylab Wordpress

Products

Image Carousel Wordpress

CVE-2025-68075

WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kerry Wordpress

Products

Bne Testimonials Wordpress

CVE-2026-54833

WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Dev Kabir Wordpress

Products

Enable Cors Wordpress

CVE-2026-54834

WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fpuenteonline Wordpress

Products

Object Cache 4 Everyone Wordpress

CVE-2026-54835

WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rustaurius Wordpress

Products

Five Star Restaurant Menu Wordpress

CVE-2026-54837

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Intranet & Private Site – All-in-one Intranet Wordpress

CVE-2026-54839

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kingaddons Wordpress

Products

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Wordpress

CVE-2026-54846

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Akosglys Wordpress

Products

Syncee Premium Dropshipping & Wholesale Wordpress

CVE-2026-56025

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paymob Wordpress

Products

Paymob For Woocommerce Wordpress

CVE-2026-56026

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chris Carlevato Wordpress

Products

Utm.codes Wordpress

CVE-2026-56029

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Corvuspay Wordpress

Products

Woocommerce Payment Gateway Wordpress

CVE-2026-56033

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dokan Multivendor Plugin Wordpress

Products

Dokan Pro Wordpress

CVE-2026-56035

WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cory Marsh Wordpress

Products

Bitfire Security Wordpress

CVE-2026-56036

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codemstory Wordpress

Products

워드프레스 결제 심플페이 Wordpress

CVE-2026-56038

WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Frisbii Wordpress

Products

Frisbii Pay Wordpress

Search vulnerabilities

WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability

WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability