CVE-2026-39xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

698 records · Page 3 of 7

• CVE-2026-39768: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive.

  Updated 2026-10-07 · Rejected record
• CVE-2026-39767: WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability 6.5 Medium

  Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

  Updated 2026-10-06
• CVE-2026-39766: WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

  Updated 2026-10-06
• CVE-2026-39765: WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability 7.2 High

  Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

  Updated 2026-10-06
• CVE-2026-39764: WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

  Updated 2026-10-06
• CVE-2026-39763: WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.

  Updated 2026-10-05
• CVE-2026-39762: WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.

  Updated 2026-10-06
• CVE-2026-39761: WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

  Updated 2026-10-06
• CVE-2026-39760: WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

  Updated 2026-10-06
• CVE-2026-39759: WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability 9.9 Critical

  Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

  Updated 2026-10-06
• CVE-2026-39758: WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

  Updated 2026-10-06
• CVE-2026-39757: WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

  Updated 2026-10-06
• CVE-2026-39756: WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.

  Updated 2026-10-06
• CVE-2026-39755: WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

  Updated 2026-10-06
• CVE-2026-39754: WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability 6.5 Medium

  Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

  Updated 2026-10-06
• CVE-2026-39753: WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

  Updated 2026-10-06
• CVE-2026-39752: WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability 7.7 High

  Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

  Updated 2026-10-06
• CVE-2026-39751: WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

  Updated 2026-10-06
• CVE-2026-39750: WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

  Updated 2026-10-06
• CVE-2026-39749: WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

  Updated 2026-10-06
• CVE-2026-39748: WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

  Updated 2026-10-06
• CVE-2026-39747: WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Woffice <= 5.4.35 versions.

  Updated 2026-10-06
• CVE-2026-39746: WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.

  Updated 2026-10-29
• CVE-2026-39745: WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

  Updated 2026-10-06
• CVE-2026-39742: WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.

  Updated 2026-10-29
• CVE-2026-39741: WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

  Updated 2026-10-29
• CVE-2026-39739: WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.

  Updated 2026-10-30
• CVE-2026-39738: WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

  Updated 2026-10-30
• CVE-2026-39737: WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

  Updated 2026-10-29
• CVE-2026-39736: WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

  Updated 2026-10-29
• CVE-2026-39735: WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

  Updated 2026-10-29
• CVE-2026-39734: WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability 7.5 High

  Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

  Updated 2026-10-30
• CVE-2026-39732: WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

  Updated 2026-10-30
• CVE-2026-39731: WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

  Updated 2026-10-06
• CVE-2026-39730: WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

  Updated 2026-10-07
• CVE-2026-39729: WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability 7.2 High

  Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

  Updated 2026-10-06
• CVE-2026-39728: WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

  Updated 2026-10-06
• CVE-2026-39727: WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

  Updated 2026-10-06
• CVE-2026-39726: WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

  Updated 2026-10-06
• CVE-2026-39725: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829.

  Updated 2026-10-09 · Rejected record
• CVE-2026-39724: WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

  Updated 2026-10-06
• CVE-2026-39723: WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.

  Updated 2026-10-08
• CVE-2026-39722: WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

  Updated 2026-10-06
• CVE-2026-39721: WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.

  Updated 2026-10-05
• CVE-2026-39720: WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

  Updated 2026-10-06
• CVE-2026-39719: WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

  Updated 2026-10-06
• CVE-2026-39718: WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

  Updated 2026-10-02
• CVE-2026-39717: WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

  Updated 2026-10-09
• CVE-2026-39716: WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.

  Updated 2026-04-29
• CVE-2026-39715: WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.5.5.

  Updated 2026-04-29
• CVE-2026-39714: WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

  Updated 2026-04-29
• CVE-2026-39713: WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.

  Updated 2026-04-29
• CVE-2026-39712: WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Updated 2026-04-29
• CVE-2026-39711: WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Updated 2026-04-29
• CVE-2026-39710: WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Updated 2026-04-29
• CVE-2026-39709: WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.4.

  Updated 2026-04-29
• CVE-2026-39708: WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through 1.3.17.

  Updated 2026-09-25
• CVE-2026-39707: WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.

  Updated 2026-04-29
• CVE-2026-39706: WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.

  Updated 2026-04-29
• CVE-2026-39705: WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.

  Updated 2026-04-29
• CVE-2026-39704: WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.

  Updated 2026-04-29
• CVE-2026-39703: WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.

  Updated 2026-04-29
• CVE-2026-39702: WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.

  Updated 2026-04-29
• CVE-2026-39701: WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.

  Updated 2026-04-29
• CVE-2026-39700: WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.

  Updated 2026-04-29
• CVE-2026-39699: WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.

  Updated 2026-04-29
• CVE-2026-39698: WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.

  Updated 2026-04-29
• CVE-2026-39697: WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAIO – The new AI GEO / SEO tool: from n/a through <= 6.2.8.

  Updated 2026-04-29
• CVE-2026-39696: WordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through <= 1.2.0.

  Updated 2026-04-29
• CVE-2026-39695: WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <= 1.4.0.

  Updated 2026-04-29
• CVE-2026-39694: WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.

  Updated 2026-04-29
• CVE-2026-39693: WordPress FSM Custom Featured Image Caption plugin <= 1.25.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.

  Updated 2026-04-29
• CVE-2026-39692: WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Updated 2026-04-29
• CVE-2026-39691: WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.

  Updated 2026-04-29
• CVE-2026-39690: WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.

  Updated 2026-04-29
• CVE-2026-39689: WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.

  Updated 2026-04-29
• CVE-2026-39688: WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.

  Updated 2026-04-29
• CVE-2026-39687: WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.

  Updated 2026-04-29
• CVE-2026-39686: WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.

  Updated 2026-04-29
• CVE-2026-39685: WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.

  Updated 2026-04-29
• CVE-2026-39684: WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows PHP Local File Inclusion.This issue affects OrganicFood: from n/a through <= 3.6.4.

  Updated 2026-04-29
• CVE-2026-39683: WordPress Garden Gnome Package plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.

  Updated 2026-04-29
• CVE-2026-39682: WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.

  Updated 2026-04-29
• CVE-2026-39681: WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.

  Updated 2026-04-29
• CVE-2026-39680: WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.

  Updated 2026-04-29
• CVE-2026-39679: WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

  Updated 2026-04-29
• CVE-2026-39678: WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.

  Updated 2026-10-08
• CVE-2026-39677: WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.

  Updated 2026-04-29
• CVE-2026-39676: WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

  Updated 2026-04-29
• CVE-2026-39675: WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.

  Updated 2026-04-29
• CVE-2026-39674: WordPress MK Google Directions plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.

  Updated 2026-04-29
• CVE-2026-39673: WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.

  Updated 2026-04-29
• CVE-2026-39672: WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.

  Updated 2026-04-29
• CVE-2026-39671: WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

  Updated 2026-04-29
• CVE-2026-39670: WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability 6.0 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through <= 2.3.0.

  Updated 2026-04-29
• CVE-2026-39669: WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.

  Updated 2026-04-28
• CVE-2026-39668: WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

  Updated 2026-04-29
• CVE-2026-39667: WordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through <= 1.7.0.

  Updated 2026-04-29
• CVE-2026-39666: WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.

  Updated 2026-04-29
• CVE-2026-39665: WordPress SEO Friendly Images plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.

  Updated 2026-04-29

Search a CVE ID or check dependency files →