CVE-2026-25xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

887 records · Page 6 of 9

• CVE-2026-25434: WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

  Updated 2026-10-06
• CVE-2026-25433: WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability 7.1 High

  Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

  Updated 2026-10-06
• CVE-2026-25432: WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.

  Updated 2026-04-28
• CVE-2026-25431: WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1.

  Updated 2026-05-13
• CVE-2026-25430: WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2026-25429: WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2026-25428: WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability 4.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.

  Updated 2026-04-28
• CVE-2026-25427: WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

  Updated 2026-07-23
• CVE-2026-25426: WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.1.

  Updated 2026-05-27
• CVE-2026-25425: WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.

  Updated 2026-06-15
• CVE-2026-25424: WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability 4.3 Medium

  Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

  Updated 2026-07-23
• CVE-2026-25423: WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability 3.8 Low

  Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.

  Updated 2026-04-28
• CVE-2026-25422: WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.

  Updated 2026-04-28
• CVE-2026-25421: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Collision with another CVE. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Collision with another CVE.

  Updated 2026-02-18 · Rejected record
• CVE-2026-25420: WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.

  Updated 2026-04-28
• CVE-2026-25419: WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.

  Updated 2026-04-28
• CVE-2026-25418: WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.

  Updated 2026-04-28
• CVE-2026-25417: WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

  Updated 2026-04-28
• CVE-2026-25416: WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2026-25415: WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  Updated 2026-04-28
• CVE-2026-25414: WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability 8.8 High

  Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  Updated 2026-04-28
• CVE-2026-25413: WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  Updated 2026-04-28
• CVE-2026-25412: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Updated 2026-02-24 · Rejected record
• CVE-2026-25411: WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.

  Updated 2026-04-28
• CVE-2026-25410: WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.

  Updated 2026-04-28
• CVE-2026-25409: WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2026-25408: WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.

  Updated 2026-04-28
• CVE-2026-25407: WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.

  Updated 2026-04-28
• CVE-2026-25406: WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability 8.1 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.

  Updated 2026-04-28
• CVE-2026-25405: WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in eRoom <= 1.7.1 versions.

  Updated 2026-07-23
• CVE-2026-25404: WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.

  Updated 2026-04-28
• CVE-2026-25403: WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  Updated 2026-08-06
• CVE-2026-25402: WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through <= 16.011.0.

  Updated 2026-04-28
• CVE-2026-25401: WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

  Updated 2026-04-28
• CVE-2026-25400: WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.

  Updated 2026-04-28
• CVE-2026-25399: WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2026-25398: WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

  Updated 2026-04-28
• CVE-2026-25397: WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability 7.5 High

  Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2026-25396: WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.

  Updated 2026-04-29
• CVE-2026-25395: WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.

  Updated 2026-04-28
• CVE-2026-25394: WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2026-25393: WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2026-25392: WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.

  Updated 2026-04-28
• CVE-2026-25391: WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.

  Updated 2026-04-28
• CVE-2026-25390: WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.

  Updated 2026-04-28
• CVE-2026-25389: WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.

  Updated 2026-04-28
• CVE-2026-25388: WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.

  Updated 2026-04-28
• CVE-2026-25387: WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.

  Updated 2026-04-28
• CVE-2026-25386: WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.

  Updated 2026-04-28
• CVE-2026-25385: WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability 5.5 Medium

  Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.

  Updated 2026-04-28
• CVE-2026-25384: WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.

  Updated 2026-04-28
• CVE-2026-25383: WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.

  Updated 2026-04-28
• CVE-2026-25382: WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6.

  Updated 2026-04-28
• CVE-2026-25381: WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP Local File Inclusion.This issue affects LoveDate: from n/a through < 3.8.6.

  Updated 2026-04-28
• CVE-2026-25380: WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through < 2.1.5.

  Updated 2026-04-28
• CVE-2026-25379: WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.

  Updated 2026-04-28
• CVE-2026-25378: WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.

  Updated 2026-04-28
• CVE-2026-25377: WordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  Updated 2026-04-28
• CVE-2026-25376: WordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows Reflected XSS.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  Updated 2026-04-28
• CVE-2026-25375: WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.

  Updated 2026-04-28
• CVE-2026-25374: WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2026-25373: WordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProgressionStudios Vayvo vayvo-progression allows Reflected XSS.This issue affects Vayvo: from n/a through < 6.8.

  Updated 2026-04-28
• CVE-2026-25372: WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.

  Updated 2026-04-28
• CVE-2026-25371: WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.

  Updated 2026-04-28
• CVE-2026-25370: WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.

  Updated 2026-04-28
• CVE-2026-25369: WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through <= 3.15.9.

  Updated 2026-05-11
• CVE-2026-25368: WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.

  Updated 2026-04-28
• CVE-2026-25367: WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.

  Updated 2026-04-28
• CVE-2026-25366: WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability 9.9 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

  Updated 2026-04-28
• CVE-2026-25365: WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

  Updated 2026-04-28
• CVE-2026-25364: WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.

  Updated 2026-04-28
• CVE-2026-25363: WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FooGallery: from n/a through <= 3.1.11.

  Updated 2026-04-28
• CVE-2026-25362: WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This issue affects FooGallery: from n/a through <= 3.1.11.

  Updated 2026-04-28
• CVE-2026-25361: WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.

  Updated 2026-04-28
• CVE-2026-25360: WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.

  Updated 2026-04-28
• CVE-2026-25359: WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.

  Updated 2026-04-28
• CVE-2026-25358: WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.

  Updated 2026-04-28
• CVE-2026-25357: WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability 8.1 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.

  Updated 2026-04-28
• CVE-2026-25356: WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.

  Updated 2026-04-28
• CVE-2026-25355: WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

  Updated 2026-04-28
• CVE-2026-25354: WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.

  Updated 2026-04-28
• CVE-2026-25353: WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.

  Updated 2026-04-28
• CVE-2026-25352: WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.

  Updated 2026-04-28
• CVE-2026-25351: WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.

  Updated 2026-04-28
• CVE-2026-25350: WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.

  Updated 2026-04-28
• CVE-2026-25349: WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.

  Updated 2026-04-28
• CVE-2026-25348: WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.

  Updated 2026-04-28
• CVE-2026-25347: WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.

  Updated 2026-04-28
• CVE-2026-25346: WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.

  Updated 2026-04-29
• CVE-2026-25345: WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability 9.9 Critical

  Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.

  Updated 2026-04-28
• CVE-2026-25344: WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability 6.5 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

  Updated 2026-04-29
• CVE-2026-25343: WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue affects WP SMS: from n/a through <= 7.1.

  Updated 2026-04-28
• CVE-2026-25342: WordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kutethemes Boutique kute-boutique allows Reflected XSS.This issue affects Boutique: from n/a through < 2.4.6.

  Updated 2026-04-28
• CVE-2026-25341: WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.

  Updated 2026-04-28
• CVE-2026-25340: WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.

  Updated 2026-04-28
• CVE-2026-25339: WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.

  Updated 2026-04-29
• CVE-2026-25338: WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.

  Updated 2026-04-28
• CVE-2026-25337: WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.1.5.

  Updated 2026-04-28
• CVE-2026-25336: WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through <= 1.1.5.

  Updated 2026-04-28
• CVE-2026-25335: WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 5.0.0.

  Updated 2026-04-28

Search a CVE ID or check dependency files →