CVE-2026-32xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

942 records · Page 5 of 10

• CVE-2026-32551: WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.

  Updated 2026-09-21
• CVE-2026-32550: WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

  Updated 2026-08-27
• CVE-2026-32549: WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

  Updated 2026-08-18
• CVE-2026-32548: WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

  Updated 2026-08-06
• CVE-2026-32547: WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

  Updated 2026-08-18
• CVE-2026-32546: WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through <= 3.2.22.

  Updated 2026-04-29
• CVE-2026-32545: WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Taboola Taboola Pixel taboola-pixel allows Reflected XSS.This issue affects Taboola Pixel: from n/a through <= 1.1.4.

  Updated 2026-04-29
• CVE-2026-32544: WordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OOPSpam Team OOPSpam Anti-Spam oopspam-anti-spam allows Stored XSS.This issue affects OOPSpam Anti-Spam: from n/a through <= 1.2.62.

  Updated 2026-04-29
• CVE-2026-32543: WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.

  Updated 2026-04-29
• CVE-2026-32542: WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through < 3.15.0.

  Updated 2026-04-29
• CVE-2026-32541: WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through <= 1.0.12.

  Updated 2026-04-29
• CVE-2026-32540: WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.

  Updated 2026-04-29
• CVE-2026-32539: WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23.

  Updated 2026-04-29
• CVE-2026-32538: WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through <= 1.1.24.

  Updated 2026-04-29
• CVE-2026-32537: WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.

  Updated 2026-04-29
• CVE-2026-32536: WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08.

  Updated 2026-04-29
• CVE-2026-32535: WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.

  Updated 2026-04-29
• CVE-2026-32534: WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.

  Updated 2026-04-29
• CVE-2026-32533: WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through <= 5.2.6.

  Updated 2026-04-29
• CVE-2026-32532: WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

  Updated 2026-04-29
• CVE-2026-32531: WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through < 1.4.5.

  Updated 2026-04-29
• CVE-2026-32530: WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability 8.8 High

  Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

  Updated 2026-04-29
• CVE-2026-32529: WordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Molla molla allows Reflected XSS.This issue affects Molla: from n/a through < 1.5.19.

  Updated 2026-04-29
• CVE-2026-32528: WordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Riode riode allows Reflected XSS.This issue affects Riode: from n/a through < 1.6.29.

  Updated 2026-04-29
• CVE-2026-32527: WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.5.

  Updated 2026-04-29
• CVE-2026-32526: WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.

  Updated 2026-04-29
• CVE-2026-32525: WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability 9.9 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.

  Updated 2026-04-29
• CVE-2026-32524: WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.

  Updated 2026-04-29
• CVE-2026-32523: WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2.

  Updated 2026-04-29
• CVE-2026-32522: WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.

  Updated 2026-04-29
• CVE-2026-32521: WordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows DOM-Based XSS.This issue affects WP Custom Admin Interface: from n/a through <= 7.42.

  Updated 2026-04-29
• CVE-2026-32520: WordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4.

  Updated 2026-04-29
• CVE-2026-32519: WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability 9.0 Critical

  Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-32518: WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through < 3.8.

  Updated 2026-04-29
• CVE-2026-32517: WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.

  Updated 2026-04-29
• CVE-2026-32516: WordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Blind SQL Injection.This issue affects Miraculous Core Plugin: from n/a through < 2.1.2.

  Updated 2026-04-29
• CVE-2026-32515: WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.1.2.

  Updated 2026-04-29
• CVE-2026-32514: WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Anton Voytenko Petitioner petitioner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Petitioner: from n/a through <= 0.7.3.

  Updated 2026-04-29
• CVE-2026-32513: WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.

  Updated 2026-04-29
• CVE-2026-32512: WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

  Updated 2026-04-29
• CVE-2026-32511: WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.

  Updated 2026-04-29
• CVE-2026-32510: WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.

  Updated 2026-04-29
• CVE-2026-32509: WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.

  Updated 2026-04-29
• CVE-2026-32508: WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8.

  Updated 2026-04-29
• CVE-2026-32507: WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.

  Updated 2026-04-29
• CVE-2026-32506: WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

  Updated 2026-04-29
• CVE-2026-32505: WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Kiddy kiddy allows PHP Local File Inclusion.This issue affects Kiddy: from n/a through <= 2.0.8.

  Updated 2026-04-29
• CVE-2026-32504: WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS VintWood vintwood allows PHP Local File Inclusion.This issue affects VintWood: from n/a through <= 1.1.8.

  Updated 2026-04-29
• CVE-2026-32503: WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Trendustry trendustry allows PHP Local File Inclusion.This issue affects Trendustry: from n/a through <= 1.1.4.

  Updated 2026-04-29
• CVE-2026-32502: WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

  Updated 2026-04-29
• CVE-2026-32501: WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in wp-configurator WP Configurator Pro wp-configurator-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Configurator Pro: from n/a through <= 3.7.9.

  Updated 2026-04-29
• CVE-2026-32500: WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP Local File Inclusion.This issue affects MetaMax: from n/a through <= 1.1.4.

  Updated 2026-04-29
• CVE-2026-32499: WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.

  Updated 2026-04-29
• CVE-2026-32498: WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.

  Updated 2026-04-29
• CVE-2026-32497: WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability 5.3 Medium

  Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.

  Updated 2026-04-29
• CVE-2026-32496: WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability 6.8 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Contact Form 7 wp-contact-form-7-spam-blocker allows Path Traversal.This issue affects Spam Protect for Contact Form 7: from n/a through <= 1.2.9.

  Updated 2026-04-29
• CVE-2026-32495: WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Link Software LLC WP Terms Popup wp-terms-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Terms Popup: from n/a through <= 2.10.0.

  Updated 2026-04-29
• CVE-2026-32494: WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.

  Updated 2026-04-29
• CVE-2026-32493: WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 3.2.0.

  Updated 2026-05-13
• CVE-2026-32492: WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability 5.3 Medium

  Authentication Bypass by Spoofing vulnerability in Joe Dolson My Tickets my-tickets allows Identity Spoofing.This issue affects My Tickets: from n/a through <= 2.1.1.

  Updated 2026-04-29
• CVE-2026-32491: WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Review Slider wp-facebook-reviews allows Stored XSS.This issue affects WP Review Slider: from n/a through <= 13.9.

  Updated 2026-04-29
• CVE-2026-32490: WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP TripAdvisor Review Slider wp-tripadvisor-review-slider allows Stored XSS.This issue affects WP TripAdvisor Review Slider: from n/a through <= 14.1.

  Updated 2026-04-29
• CVE-2026-32489: WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

  Updated 2026-04-29
• CVE-2026-32488: WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability 8.1 High

  Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9.

  Updated 2026-04-29
• CVE-2026-32487: WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.

  Updated 2026-04-29
• CVE-2026-32486: WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.

  Updated 2026-04-29
• CVE-2026-32485: WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.

  Updated 2026-04-29
• CVE-2026-32484: WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.

  Updated 2026-04-29
• CVE-2026-32483: WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.

  Updated 2026-04-29
• CVE-2026-32482: WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.

  Updated 2026-04-29
• CVE-2026-32481: WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability 7.5 High

  Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

  Updated 2026-08-18
• CVE-2026-32480: WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.

  Updated 2026-09-04
• CVE-2026-32479: WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

  Updated 2026-08-28
• CVE-2026-32478: WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

  Updated 2026-08-24
• CVE-2026-32477: WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability 8.6 High

  Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

  Updated 2026-08-24
• CVE-2026-32476: WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.

  Updated 2026-08-24
• CVE-2026-32475: WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability 9.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

  Updated 2026-08-20
• CVE-2026-32474: WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability 9.9 Critical

  Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

  Updated 2026-08-18
• CVE-2026-32473: WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

  Updated 2026-08-18
• CVE-2026-32472: WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

  Updated 2026-08-18
• CVE-2026-32471: WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

  Updated 2026-08-24
• CVE-2026-32470: WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

  Updated 2026-08-18
• CVE-2026-32469: WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability 5.3 Medium

  Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

  Updated 2026-08-06
• CVE-2026-32468: WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability 7.5 High

  Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

  Updated 2026-08-18
• CVE-2026-32467: WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability 6.0 Medium

  Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

  Updated 2026-08-18
• CVE-2026-32466: WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

  Updated 2026-08-18
• CVE-2026-32465: WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability 8.8 High

  Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

  Updated 2026-08-18
• CVE-2026-32464: WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

  Updated 2026-08-18
• CVE-2026-32463: WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability 9.9 Critical

  Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

  Updated 2026-08-18
• CVE-2026-32462: WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.

  Updated 2026-04-29
• CVE-2026-32461: WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.

  Updated 2026-04-29
• CVE-2026-32460: WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.36.

  Updated 2026-04-29
• CVE-2026-32459: WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

  Updated 2026-04-29
• CVE-2026-32458: WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.

  Updated 2026-04-29
• CVE-2026-32457: WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product Addons) for WooCommerce: from n/a through <= 1.6.18.

  Updated 2026-04-29
• CVE-2026-32456: WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.

  Updated 2026-04-29
• CVE-2026-32455: WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.

  Updated 2026-04-29
• CVE-2026-32454: WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.

  Updated 2026-04-29
• CVE-2026-32453: WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.

  Updated 2026-04-29
• CVE-2026-32452: WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

  Updated 2026-04-29

Search a CVE ID or check dependency files →