CVE-2026-27xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

914 records · Page 6 of 10

• CVE-2026-27445: PGP Signature Reflection 6.9 Medium

  SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofing.

  Updated 2026-03-04
• CVE-2026-27444: Header Email Address Parsing 7.8 High

  SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.

  Updated 2026-03-04
• CVE-2026-27443: S/MIME Decryption Tag Sanitization Bypass 8.2 High

  SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.

  Updated 2026-03-04
• CVE-2026-27442: zip_attachments Path Traversal 9.3 Critical

  The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.

  Updated 2026-03-04
• CVE-2026-27441: PDF Password CMDi 9.5 Critical

  SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.

  Updated 2026-03-04
• CVE-2026-27440: WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.7.6.

  Updated 2026-04-28
• CVE-2026-27439: WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2026-27438: WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2026-27437: WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.

  Updated 2026-04-28
• CVE-2026-27436: WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability 9.1 Critical

  Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

  Updated 2026-07-02
• CVE-2026-27435: WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice: from n/a before 5.4.33.

  Updated 2026-07-01
• CVE-2026-27434: WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.

  Updated 2026-10-07
• CVE-2026-27433: WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

  Updated 2026-10-16
• CVE-2026-27432: WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.

  Updated 2026-09-04
• CVE-2026-27430: WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

  Updated 2026-07-02
• CVE-2026-27429: WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

  Updated 2026-06-17
• CVE-2026-27428: WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injection.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

  Updated 2026-04-28
• CVE-2026-27427: WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affects Geo Mashup: from n/a through 1.13.18.

  Updated 2026-05-26
• CVE-2026-27426: WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

  Updated 2026-07-02
• CVE-2026-27425: WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

  Updated 2026-07-02
• CVE-2026-27424: WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.

  Updated 2026-05-20
• CVE-2026-27423: WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

  Updated 2026-07-23
• CVE-2026-27422: WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

  Updated 2026-09-23
• CVE-2026-27421: WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS. This issue affects Royal Elementor Addons: from n/a before 1.7.1053.

  Updated 2026-05-07
• CVE-2026-27420: WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.

  Updated 2026-10-08
• CVE-2026-27419: WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

  Updated 2026-07-02
• CVE-2026-27418: WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

  Updated 2026-07-23
• CVE-2026-27417: WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.

  Updated 2026-04-28
• CVE-2026-27416: WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.

  Updated 2026-05-07
• CVE-2026-27415: WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.

  Updated 2026-05-07
• CVE-2026-27414: WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability 8.8 High

  Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

  Updated 2026-07-02
• CVE-2026-27413: WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.

  Updated 2026-04-28
• CVE-2026-27412: WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

  Updated 2026-07-02
• CVE-2026-27411: WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability 5.4 Medium

  Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through <= 1.7.9.

  Updated 2026-04-29
• CVE-2026-27410: WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability 6.5 Medium

  Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

  Updated 2026-06-17
• CVE-2026-27409: WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webba Booking: from n/a through 6.4.13.

  Updated 2026-07-01
• CVE-2026-27408: WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.

  Updated 2026-10-12
• CVE-2026-27407: WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability 7.2 High

  Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

  Updated 2026-06-16
• CVE-2026-27406: WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects My Tickets: from n/a through <= 2.1.0.

  Updated 2026-04-29
• CVE-2026-27405: WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

  Updated 2026-05-20
• CVE-2026-27404: WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

  Updated 2026-07-02
• CVE-2026-27403: WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

  Updated 2026-07-23
• CVE-2026-27402: WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

  Updated 2026-07-02
• CVE-2026-27401: WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.

  Updated 2026-10-29
• CVE-2026-27400: WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability 8.6 High

  Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

  Updated 2026-06-17
• CVE-2026-27399: WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

  Updated 2026-07-23
• CVE-2026-27398: WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.

  Updated 2026-05-26
• CVE-2026-27397: WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.

  Updated 2026-04-28
• CVE-2026-27396: WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability 7.3 High

  Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

  Updated 2026-04-28
• CVE-2026-27395: WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

  Updated 2026-06-17
• CVE-2026-27394: WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

  Updated 2026-10-30
• CVE-2026-27393: WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6.

  Updated 2026-05-21
• CVE-2026-27392: WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability 4.3 Medium

  Contributor Broken Access Control in uListing <= 2.2.0 versions.

  Updated 2026-07-23
• CVE-2026-27391: WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in uListing <= 2.2.0 versions.

  Updated 2026-07-23
• CVE-2026-27390: WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability 8.8 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2026-27389: WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability 9.8 Critical

  Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2026-27388: WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2026-27387: WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.

  Updated 2026-04-28
• CVE-2026-27386: WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2026-27385: WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-27384: WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability 9.0 Critical

  Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.

  Updated 2026-04-29
• CVE-2026-27383: WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.

  Updated 2026-04-28
• CVE-2026-27382: WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.

  Updated 2026-04-28
• CVE-2026-27381: WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.

  Updated 2026-04-28
• CVE-2026-27380: WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability 7.2 High

  Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

  Updated 2026-08-13
• CVE-2026-27379: WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.

  Updated 2026-04-28
• CVE-2026-27378: WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

  Updated 2026-09-11
• CVE-2026-27377: WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability 6.7 Medium

  Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

  Updated 2026-07-23
• CVE-2026-27376: WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through <= 2.2.7.

  Updated 2026-04-28
• CVE-2026-27375: WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Gecko gecko allows Reflected XSS.This issue affects Gecko: from n/a through <= 1.9.8.

  Updated 2026-04-28
• CVE-2026-27374: WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Order Details: from n/a through <= 3.1.

  Updated 2026-04-28
• CVE-2026-27373: WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3.

  Updated 2026-04-28
• CVE-2026-27372: WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability 6.5 Medium

  Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

  Updated 2026-07-23
• CVE-2026-27371: WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  Updated 2026-09-30
• CVE-2026-27370: WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.

  Updated 2026-04-29
• CVE-2026-27369: WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability 8.1 High

  Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.

  Updated 2026-04-28
• CVE-2026-27368: WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.

  Updated 2026-04-28
• CVE-2026-27367: WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

  Updated 2026-04-28
• CVE-2026-27366: WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.

  Updated 2026-06-29
• CVE-2026-27365: WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

  Updated 2026-08-19
• CVE-2026-27364: WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.

  Updated 2026-08-25
• CVE-2026-27363: WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Stored XSS.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2026-27362: WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2026-27361: WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.

  Updated 2026-04-28
• CVE-2026-27360: WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.38.

  Updated 2026-04-28
• CVE-2026-27359: WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.

  Updated 2026-04-28
• CVE-2026-27358: WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.

  Updated 2026-04-28
• CVE-2026-27357: WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Search Analytics: from n/a before 1.5.0.

  Updated 2026-05-26
• CVE-2026-27355: WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

  Updated 2026-07-23
• CVE-2026-27354: WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.

  Updated 2026-04-28
• CVE-2026-27353: WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.

  Updated 2026-04-28
• CVE-2026-27352: WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.

  Updated 2026-04-28
• CVE-2026-27351: WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.

  Updated 2026-06-02
• CVE-2026-27350: WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

  Updated 2026-10-11
• CVE-2026-27349: WordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.

  Updated 2026-05-21
• CVE-2026-27348: WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.

  Updated 2026-04-28
• CVE-2026-27347: WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.

  Updated 2026-09-04
• CVE-2026-27346: WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability 4.9 Medium

  Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a before 5.2.10.

  Updated 2026-05-26
• CVE-2026-27345: WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

  Updated 2026-08-13
• CVE-2026-27344: WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability 5.9 Medium

  Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5.

  Updated 2026-04-28

Search a CVE ID or check dependency files →