CVE-2026-32459

WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Flycart Wordpress

Products

Upsellwp Wordpress

CVE-2026-32461

WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Really-simple-plugins Wordpress

Products

Really Simple Ssl Wordpress

CVE-2026-32485

WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-32484

WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Boldgrid Wordpress

Products

Weforms Wordpress

CVE-2026-32451

WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Fusion Builder Wordpress

CVE-2026-32438

WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw School Education Wordpress

CVE-2026-32442

WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

E2pdf Wordpress

Products

E2pdf Wordpress

CVE-2026-32436

WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Photography Wordpress

CVE-2026-32437

WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Portfolio Wordpress

CVE-2026-32441

WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Webtoffee Wordpress

Products

Wordpress Comments Import And Export Wordpress

CVE-2026-32427

WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Education Lite Wordpress

CVE-2026-32434

WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Fitness Wordpress

CVE-2026-32435

WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vowelweb Wordpress

Products

Vw Pet Shop Wordpress

CVE-2026-32417

WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wppochipp

Products

Wordpress Pochipp

CVE-2026-32421

WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through <= 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Agilelogix Wordpress

Products

Post Timeline Wordpress

CVE-2026-32410

WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woobewoo Wordpress

Products

Wbw Currency Switcher For Woocommerce Wordpress

CVE-2026-32404

WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Studio99 Wordpress

Products

Studio99 Wp Monitor Wordpress

CVE-2026-32408

WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.23.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusecom Wordpress

Products

Brizy Wordpress

CVE-2026-32396

WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

Team Wordpress

CVE-2026-32409

WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmu Dev - Your All-in-one Wordpress Platform

Products

Wordpress Forminator