CVE-2026-40753

WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Easymeals Wordpress

CVE-2026-40765

WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Collectchat Wordpress

Products

Collectchat Wordpress

CVE-2026-40768

WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dimitri Grassi Wordpress

Products

Salon Booking System Wordpress

CVE-2026-41557

WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Presslayouts Wordpress

Products

Kapee Wordpress

CVE-2026-42380

WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Jwsthemes Wordpress

Products

Ai Lab Wordpress

CVE-2026-48875

WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetsmartfilters Wordpress

CVE-2026-49058

WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Loginpress Wordpress

Products

Loginpress Pro Wordpress

CVE-2026-49072

WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opmc Wordpress

Products

Woocommerce Anti-fraud Wordpress

CVE-2026-49074

WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-49075

WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-49079

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetsearch Wordpress

CVE-2026-49081

WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

User Registration Stripe Wordpress

CVE-2026-49084

WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-52696

WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetblog Wordpress

CVE-2026-52698

WordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Pushengage – Web Push Notifications, Ecommerce Automation &amp; Chat Widget Wordpress

CVE-2026-52706

WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-54184

WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Alberto Hornero Wordpress

Products

Clean Login Wordpress

CVE-2026-54187

WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-54189

WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetimpex Inc. Wordpress

Products

Jetengine Wordpress

CVE-2026-54803

WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cozyvision Wordpress

Products

Sms Alert Order Notifications Wordpress