CVE-2026-118523

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Eventprime

CVE-2026-118983

VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Vikwidgetsloader

CVE-2026-62000

WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wclovers Wordpress-extensions

Products

Wcfm Marketplace Wcfm Marketplace

CVE-2026-54851

WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Awesomemotive Wordpress-extensions

Products

Contact Form By Wpforms Contact Form By Wpforms

CVE-2026-56065

WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Doofinder Wordpress-extensions

Products

Doofinder For Woocommerce Doofinder For Woocommerce

CVE-2026-62126

WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress-extensions

Products

Saml Sp Single Sign On Saml Sp Single Sign On

CVE-2026-57666

WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Aguilatechnologies Wordpress-extensions

Products

Wp Customer Area Wp Customer Area

CVE-2026-17114

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-115498

Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wingerspeed Wordpress-extensions

Products

Slim Jetpack Slim Jetpack

CVE-2026-104799

Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated user by only verifying `$user->exists()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to pass an unsanitized `data` array via the `key` and `data` parameters directly to `update_user_meta()`, overwriting arbitrary user meta on their own account — including the `wp_capabilities` meta key — to grant themselves Administrator-level privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rnlab Wordpress-extensions

Products

Mobile Builder Mobile Builder

CVE-2026-65555

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uncannyowl Wordpress-extensions

Products

Uncanny Toolkit For Learndash Uncanny Toolkit For Learndash

CVE-2026-119468

WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Noptin Newsletter Team Wordpress-extensions

Products

Noptin Noptin

CVE-2026-121970

Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wphostingdev

Products

Pay With Vipps And Mobilepay For Woocommerce Pay With Vipps And Mobilepay For Woocommerce

CVE-2026-119745

Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sender Wordpress-extensions

Products

Sender Sender

CVE-2026-109518

APT RCE via hard link reuse

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Debian Ubuntu

Products

Apt Apt

CVE-2026-16304

WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Event Manager

CVE-2026-19256

All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

All In One Login

CVE-2026-86442

WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Event Manager

CVE-2026-88814

YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition

The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Yith Woocommerce Gift Cards

CVE-2025-15701

Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Easy Social Icons