CVE-2026-32xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

942 records · Page 6 of 10

• CVE-2026-32451: WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

  Updated 2026-04-29
• CVE-2026-32450: WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.7.

  Updated 2026-04-29
• CVE-2026-32449: WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.

  Updated 2026-04-29
• CVE-2026-32448: WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.

  Updated 2026-04-29
• CVE-2026-32447: WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.

  Updated 2026-04-29
• CVE-2026-32446: WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.

  Updated 2026-04-29
• CVE-2026-32445: WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability 2.7 Low

  Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.

  Updated 2026-04-29
• CVE-2026-32444: WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability 9.9 Critical

  Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

  Updated 2026-08-18
• CVE-2026-32443: WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.

  Updated 2026-04-29
• CVE-2026-32442: WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability 5.0 Medium

  Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.

  Updated 2026-04-29
• CVE-2026-32441: WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability 7.7 High

  Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

  Updated 2026-04-29
• CVE-2026-32440: WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.

  Updated 2026-04-29
• CVE-2026-32439: WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.

  Updated 2026-04-29
• CVE-2026-32438: WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.

  Updated 2026-04-29
• CVE-2026-32437: WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.

  Updated 2026-04-29
• CVE-2026-32436: WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.

  Updated 2026-04-29
• CVE-2026-32435: WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.

  Updated 2026-04-29
• CVE-2026-32434: WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.

  Updated 2026-04-29
• CVE-2026-32433: WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.

  Updated 2026-04-29
• CVE-2026-32432: WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.

  Updated 2026-04-29
• CVE-2026-32431: WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.

  Updated 2026-04-29
• CVE-2026-32430: WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.

  Updated 2026-04-29
• CVE-2026-32429: WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.

  Updated 2026-04-29
• CVE-2026-32428: WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.

  Updated 2026-04-29
• CVE-2026-32427: WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.

  Updated 2026-04-29
• CVE-2026-32426: WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through < 1.4.7.

  Updated 2026-04-29
• CVE-2026-32425: WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.

  Updated 2026-04-29
• CVE-2026-32424: WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.2.

  Updated 2026-04-29
• CVE-2026-32423: WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.

  Updated 2026-04-29
• CVE-2026-32422: WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

  Updated 2026-04-29
• CVE-2026-32421: WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through <= 2.4.1.

  Updated 2026-04-29
• CVE-2026-32420: WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.

  Updated 2026-04-29
• CVE-2026-32419: WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts allows DOM-Based XSS.This issue affects List category posts: from n/a through <= 0.93.1.

  Updated 2026-04-29
• CVE-2026-32418: WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection.This issue affects Meow Gallery: from n/a through <= 5.4.4.

  Updated 2026-04-29
• CVE-2026-32417: WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.

  Updated 2026-04-29
• CVE-2026-32416: WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.

  Updated 2026-04-29
• CVE-2026-32415: WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability 5.0 Medium

  Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7.

  Updated 2026-04-29
• CVE-2026-32414: WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability 7.2 High

  Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Remote Code Inclusion.This issue affects Advanced Woo Labels: from n/a through <= 2.36.

  Updated 2026-04-29
• CVE-2026-32413: WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Permalink Manager Lite: from n/a through < 2.5.3.

  Updated 2026-04-29
• CVE-2026-32412: WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Gift Up! Gift Up Gift Cards for WordPress and WooCommerce gift-up allows Server Side Request Forgery.This issue affects Gift Up Gift Cards for WordPress and WooCommerce: from n/a through <= 3.1.7.

  Updated 2026-04-29
• CVE-2026-32411: WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed Calendly embed-calendly-scheduling allows Stored XSS.This issue affects Embed Calendly: from n/a through <= 4.4.

  Updated 2026-04-29
• CVE-2026-32410: WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.

  Updated 2026-04-29
• CVE-2026-32409: WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.

  Updated 2026-04-29
• CVE-2026-32408: WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.23.

  Updated 2026-04-29
• CVE-2026-32407: WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Smart Wishlist for WooCommerce: from n/a through <= 5.0.8.

  Updated 2026-04-29
• CVE-2026-32406: WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.

  Updated 2026-04-29
• CVE-2026-32405: WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.

  Updated 2026-04-29
• CVE-2026-32404: WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.

  Updated 2026-04-29
• CVE-2026-32403: WordPress Toocheke Companion plugin <= 1.194 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows DOM-Based XSS.This issue affects Toocheke Companion: from n/a through <= 1.194.

  Updated 2026-04-29
• CVE-2026-32402: WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.

  Updated 2026-04-29
• CVE-2026-32401: WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability 7.2 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9.

  Updated 2026-04-29
• CVE-2026-32400: WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.

  Updated 2026-04-29
• CVE-2026-32399: WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

  Updated 2026-04-29
• CVE-2026-32398: WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability 6.5 Medium

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through <= 1.5.15.

  Updated 2026-04-29
• CVE-2026-32397: WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.

  Updated 2026-04-29
• CVE-2026-32396: WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.

  Updated 2026-04-29
• CVE-2026-32395: WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.6.

  Updated 2026-04-29
• CVE-2026-32394: WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through <= 2.31.0.

  Updated 2026-04-29
• CVE-2026-32393: WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly Theme Addons greenly-addons allows PHP Local File Inclusion.This issue affects Greenly Theme Addons: from n/a through < 8.2.

  Updated 2026-04-29
• CVE-2026-32392: WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly greenly allows PHP Local File Inclusion.This issue affects Greenly: from n/a through <= 8.1.

  Updated 2026-04-29
• CVE-2026-32391: WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.

  Updated 2026-04-29
• CVE-2026-32390: WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in linethemes Nanosoft nanosoft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nanosoft: from n/a through < 1.3.2.

  Updated 2026-04-29
• CVE-2026-32389: WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCare: from n/a before 1.2.2.

  Updated 2026-05-26
• CVE-2026-32388: WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in linethemes GLB glb allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GLB: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-32387: WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout for PayPal: from n/a through <= 1.0.46.

  Updated 2026-04-29
• CVE-2026-32386: WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.

  Updated 2026-04-29
• CVE-2026-32385: WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.

  Updated 2026-04-29
• CVE-2026-32384: WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.

  Updated 2026-04-29
• CVE-2026-32383: WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.

  Updated 2026-04-29
• CVE-2026-32382: WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Digital Download digital-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Digital Download: from n/a through <= 1.1.4.

  Updated 2026-04-29
• CVE-2026-32381: WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-32380: WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.

  Updated 2026-04-29
• CVE-2026-32379: WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Rara Academic rara-academic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Academic: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-32378: WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.

  Updated 2026-04-29
• CVE-2026-32377: WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-32376: WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Kalon kalon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalon: from n/a through <= 1.2.9.

  Updated 2026-04-29
• CVE-2026-32375: WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.

  Updated 2026-04-29
• CVE-2026-32374: WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.

  Updated 2026-04-29
• CVE-2026-32373: WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.

  Updated 2026-04-29
• CVE-2026-32372: WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.

  Updated 2026-04-29
• CVE-2026-32371: WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.

  Updated 2026-04-29
• CVE-2026-32370: WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.

  Updated 2026-04-29
• CVE-2026-32369: WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Medilink-Core medilink-core allows PHP Local File Inclusion.This issue affects Medilink-Core: from n/a through < 2.0.7.

  Updated 2026-04-29
• CVE-2026-32368: WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.

  Updated 2026-04-29
• CVE-2026-32367: WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability 9.1 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.

  Updated 2026-04-29
• CVE-2026-32366: WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.

  Updated 2026-04-29
• CVE-2026-32365: WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.

  Updated 2026-04-29
• CVE-2026-32364: WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.

  Updated 2026-04-29
• CVE-2026-32363: WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.

  Updated 2026-04-29
• CVE-2026-32362: WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.

  Updated 2026-04-29
• CVE-2026-32361: WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0.

  Updated 2026-04-29
• CVE-2026-32360: WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.

  Updated 2026-04-29
• CVE-2026-32359: WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.

  Updated 2026-04-29
• CVE-2026-32358: WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.

  Updated 2026-04-29
• CVE-2026-32357: WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.

  Updated 2026-04-29
• CVE-2026-32356: WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through <= 5.1.2.

  Updated 2026-04-29
• CVE-2026-32355: WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

  Updated 2026-04-29
• CVE-2026-32354: WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.

  Updated 2026-04-29
• CVE-2026-32353: WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in MailerPress Team MailerPress mailerpress allows Server Side Request Forgery.This issue affects MailerPress: from n/a through <= 1.4.2.

  Updated 2026-04-29
• CVE-2026-32352: WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-Based XSS.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.

  Updated 2026-04-29

Search a CVE ID or check dependency files →