CVE-2026-110030

Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Hide Price Until Login

CVE-2026-110504

Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Enable Svg, Webp, And Ico Upload

CVE-2026-110505

Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Enable Svg, Webp, And Ico Upload

CVE-2026-111739

Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

All-in-one Security (aios) Two Factor Authentication

CVE-2026-113616

LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Logixfast Auth

CVE-2026-113617

Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Automated Import Products To Cart

CVE-2026-114270

GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Geodirectory

CVE-2026-115245

Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Chat Ai With Dispatcher

CVE-2026-115259

Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Photo Engine

CVE-2026-85007

YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Yt Player

CVE-2026-86794

Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Community Events

CVE-2026-88941

Network Agent Windows Module Vulnerability Causing Malfunction

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Kaspersky

Products

Administration Server Network Agent

CVE-2026-109215

LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Litespeedtech Wordpress-extensions

Products

Litespeed Cache Litespeed Cache

CVE-2026-104727

Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Berocket Wordpress-extensions

Products

Sequential Order Numbers For Woocommerce Sequential Order Numbers For Woocommerce

CVE-2026-116763

LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Litespeedtech Wordpress-extensions

Products

Litespeed Cache Litespeed Cache

CVE-2026-107743

Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mapster Wordpress-extensions

Products

Mapster Wp Maps Mapster Wp Maps

CVE-2026-111419

Hardcoded API Token in Foxit Official Website

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-111418

SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-111417

Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-115965

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Wordpress-extensions

Products

Buddypress Buddypress