CVE-2026-56062

WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

CVSS 3.1 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Oooorgle Wordpress

Products

Quotes Llama Wordpress

CVE-2026-56063

WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Mailchimp Block Wordpress

CVE-2026-56069

WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Site Building With Toolset Wordpress

Products

Toolset Forms Wordpress

CVE-2026-57316

WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Roxnor Wordpress

Products

Getgenie Wordpress

CVE-2026-57321

WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Icc0rz Wordpress

Products

H5p Wordpress

CVE-2026-57323

WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Flash & Html5 Video Wordpress

CVE-2026-57325

WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jellywp Wordpress

Products

Nanomag Wordpress

CVE-2026-57430

WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Seopress Free Wordpress

Products

Seopress Pro Wordpress

CVE-2026-57618

WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Neve Pro Wordpress

CVE-2026-57627

WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Kirki Wordpress

CVE-2026-57633

WordPress WCBoost &#8211; Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wcboost Wordpress

Products

Wcboost &#8211; Products Compare Wordpress

CVE-2026-57635

WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Funnelkit Wordpress

Products

Funnelkit Payment Gateway For Stripe Woocommerce Wordpress

CVE-2026-57638

WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Booking

CVE-2026-57644

WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability

Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Jetmonsters Wordpress

Products

Restaurant Menu By Motopress Wordpress

CVE-2026-57647

WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Panorama Viewer – 360 Degree Image + Video Viewer Wordpress

CVE-2026-57651

WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nk Wordpress

Products

Ghost Kit Wordpress

CVE-2026-57655

WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Jay Versluis Wordpress

Products

Child Theme Wizard Wordpress

CVE-2026-57656

WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Peregrinethemes Wordpress

Products

Hester Core Wordpress

CVE-2026-57657

WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Noor Alam Wordpress

Products

Gmail Smtp Wordpress

CVE-2026-57659

WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Stranger Studios Wordpress

Products

Paid Memberships Pro - Add Member From Admin Wordpress