CVE-2026-27400

WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ovatheme Wordpress

Products

Bookpro Wordpress

CVE-2026-39545

WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Zermatt Wordpress

CVE-2026-39573

WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Mildhill Wordpress

CVE-2026-39582

WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Hitek

CVE-2026-39589

WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

A Wp Life Wordpress

Products

Webenvo Wordpress

CVE-2026-40724

WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Client Portal Ltd. Wordpress

Products

Client Portal (pro) Wordpress

CVE-2026-40725

WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Barn2 Media Ltd Wordpress

Products

Woocommerce Product Filters Wordpress

CVE-2026-40726

WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

User Registration Stripe Wordpress

CVE-2026-40746

WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Restaurant Zone Wordpress

CVE-2026-40747

WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Ecommerce Zone Wordpress

CVE-2026-40748

WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Kids Gift Shop Wordpress

CVE-2026-40749

WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Charity Zone Wordpress

CVE-2026-40753

WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Easymeals Wordpress

CVE-2026-40765

WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Collectchat Wordpress

Products

Collectchat Wordpress

CVE-2026-40768

WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dimitri Grassi Wordpress

Products

Salon Booking System Wordpress

CVE-2026-41557

WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Presslayouts Wordpress

Products

Kapee Wordpress

CVE-2026-42380

WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Jwsthemes Wordpress

Products

Ai Lab Wordpress

CVE-2026-48875

WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetsmartfilters Wordpress

CVE-2026-49058

WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Loginpress Wordpress

Products

Loginpress Pro Wordpress

CVE-2026-49072

WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opmc Wordpress

Products

Woocommerce Anti-fraud Wordpress