CVE-2026-40792

WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iqonic Wordpress

Products

Kivicare Wordpress

CVE-2026-40799

WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Replywp Wordpress

Products

Simple Cloudfare Turnstile Wordpress

CVE-2026-42668

WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Omnisend Wordpress

Products

Email Marketing For Woocommerce Wordpress

CVE-2026-42686

WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Theeventprime Wordpress

Products

Eventprime Wordpress

CVE-2026-42687

WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Theeventprime Wordpress

Products

Eventprime Wordpress

CVE-2026-42743

WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Masteriyo Wordpress

CVE-2026-45437

WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brthumar1959 Wordpress

Products

Product Filter Widget For Elementor Wordpress

CVE-2026-45441

WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Magepeopleteam Wordpress

Products

Wpevently Wordpress

CVE-2026-48878

WordPress Visual Link Preview plugin <= 2.4.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bootstrapped Wordpress

Products

Visual Link Preview Wordpress

CVE-2026-49043

WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpengine

Products

Wordpress Wp Migrate

CVE-2026-49078

WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wptravelengine

Products

Wordpress Wp Travel Engine

CVE-2026-49104

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Wordpress

Products

Integration For Mailchimp And Contact Form 7, Wpforms, Elementor, Ninja Forms Wordpress

CVE-2026-49109

WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crmperks Wordpress

Products

Integration For Salesforce And Contact Form 7, Wpforms, Elementor, Ninja Forms Wordpress

CVE-2026-49766

WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpusermanager

Products

Wordpress Wp User Manager

CVE-2026-49770

WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wptravelengine

Products

Wordpress Wp Travel Engine

CVE-2026-49775

WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress

Products

Welcart E-commerce Wordpress

CVE-2026-49776

WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

John-dagelmore Wordpress

Products

Gptranslate – Multilingual Ai Translation For Wordpress: Automatically Translate Websites Wordpress

CVE-2026-52703

WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ninjateam Wordpress

Products

Fastdup Wordpress

CVE-2026-52714

WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Squirrly Wordpress

Products

Seo Plugin By Squirrly Seo Wordpress

CVE-2026-49772

WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

CVSS 3.1 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Stellarwp Wordpress

Products

The Events Calendar Wordpress