CVE-2026-39xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

698 records · Page 4 of 7

• CVE-2026-39664: WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.

  Updated 2026-04-29
• CVE-2026-39663: WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.

  Updated 2026-04-29
• CVE-2026-39662: WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.

  Updated 2026-04-29
• CVE-2026-39661: WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18.

  Updated 2026-05-26
• CVE-2026-39660: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Updated 2026-04-29 · Rejected record
• CVE-2026-39659: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Updated 2026-04-21 · Rejected record
• CVE-2026-39658: WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.

  Updated 2026-04-29
• CVE-2026-39657: WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.

  Updated 2026-04-29
• CVE-2026-39656: WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

  Updated 2026-04-29
• CVE-2026-39655: WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7.

  Updated 2026-05-26
• CVE-2026-39654: WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.

  Updated 2026-05-13
• CVE-2026-39653: WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.

  Updated 2026-04-29
• CVE-2026-39652: WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.

  Updated 2026-04-29
• CVE-2026-39651: WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.

  Updated 2026-04-29
• CVE-2026-39650: WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.

  Updated 2026-04-29
• CVE-2026-39649: WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.

  Updated 2026-04-29
• CVE-2026-39648: WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.

  Updated 2026-04-29
• CVE-2026-39647: WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.

  Updated 2026-04-29
• CVE-2026-39646: WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.

  Updated 2026-04-29
• CVE-2026-39645: WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.

  Updated 2026-04-29
• CVE-2026-39644: WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.

  Updated 2026-04-29
• CVE-2026-39643: WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.

  Updated 2026-04-29
• CVE-2026-39642: WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.

  Updated 2026-05-26
• CVE-2026-39641: WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through <= 2.5.4.

  Updated 2026-04-29
• CVE-2026-39640: WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.

  Updated 2026-04-29
• CVE-2026-39639: WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.

  Updated 2026-04-29
• CVE-2026-39638: WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.

  Updated 2026-04-29
• CVE-2026-39637: WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.

  Updated 2026-04-29
• CVE-2026-39636: WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.

  Updated 2026-04-29
• CVE-2026-39635: WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

  Updated 2026-04-29
• CVE-2026-39634: WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

  Updated 2026-04-29
• CVE-2026-39633: WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

  Updated 2026-04-29
• CVE-2026-39632: WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

  Updated 2026-04-29
• CVE-2026-39631: WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability 4.9 Medium

  Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.

  Updated 2026-04-29
• CVE-2026-39630: WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through <= 4.1.0.

  Updated 2026-04-29
• CVE-2026-39629: WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.

  Updated 2026-04-29
• CVE-2026-39628: WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.

  Updated 2026-04-29
• CVE-2026-39627: WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from n/a through <= 2.266.

  Updated 2026-04-29
• CVE-2026-39626: WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.

  Updated 2026-04-29
• CVE-2026-39625: WordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.

  Updated 2026-04-29
• CVE-2026-39624: WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.

  Updated 2026-04-29
• CVE-2026-39623: WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.

  Updated 2026-04-29
• CVE-2026-39622: WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Base: from n/a through <= 3.0.8.

  Updated 2026-04-29
• CVE-2026-39621: WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.

  Updated 2026-04-29
• CVE-2026-39620: WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.

  Updated 2026-04-29
• CVE-2026-39619: WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.

  Updated 2026-04-29
• CVE-2026-39618: WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.

  Updated 2026-04-29
• CVE-2026-39617: WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.

  Updated 2026-04-29
• CVE-2026-39616: WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.

  Updated 2026-04-29
• CVE-2026-39615: WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.

  Updated 2026-04-29
• CVE-2026-39614: WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.

  Updated 2026-04-29
• CVE-2026-39613: WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.

  Updated 2026-04-29
• CVE-2026-39612: WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.

  Updated 2026-04-29
• CVE-2026-39611: WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.

  Updated 2026-04-29
• CVE-2026-39610: WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.

  Updated 2026-04-29
• CVE-2026-39609: WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.

  Updated 2026-04-29
• CVE-2026-39608: WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.

  Updated 2026-04-29
• CVE-2026-39607: WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.

  Updated 2026-04-29
• CVE-2026-39606: WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizReview: from n/a through <= 1.5.13.

  Updated 2026-04-29
• CVE-2026-39605: WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.

  Updated 2026-04-29
• CVE-2026-39604: WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through <= 3.6.0.

  Updated 2026-04-29
• CVE-2026-39603: WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

  Updated 2026-04-29
• CVE-2026-39602: WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.

  Updated 2026-04-29
• CVE-2026-39601: WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability 3.7 Low

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

  Updated 2026-10-05
• CVE-2026-39600: WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companion: from n/a through 0.8.2.

  Updated 2026-10-07
• CVE-2026-39599: WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability 4.3 Medium

  Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

  Updated 2026-10-06
• CVE-2026-39598: WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability 8.0 High

  Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.

  Updated 2026-06-17
• CVE-2026-39597: WordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

  Updated 2026-06-17
• CVE-2026-39596: WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

  Updated 2026-06-17
• CVE-2026-39595: WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability 4.7 Medium

  Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

  Updated 2026-06-17
• CVE-2026-39594: WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability 6.4 Medium

  Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

  Updated 2026-06-16
• CVE-2026-39593: WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.

  Updated 2026-05-21
• CVE-2026-39592: WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7.

  Updated 2026-04-29
• CVE-2026-39591: WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

  Updated 2026-06-16
• CVE-2026-39590: WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

  Updated 2026-06-17
• CVE-2026-39589: WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

  Updated 2026-06-17
• CVE-2026-39588: WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NM Gift Registry and Wishlist Lite: from n/a through <= 5.13.

  Updated 2026-04-29
• CVE-2026-39587: WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability 8.1 High

  Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

  Updated 2026-06-16
• CVE-2026-39586: WordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through <= 4.1132.

  Updated 2026-04-29
• CVE-2026-39585: WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.

  Updated 2026-05-12
• CVE-2026-39584: WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

  Updated 2026-06-16
• CVE-2026-39583: WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

  Updated 2026-06-16
• CVE-2026-39582: WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

  Updated 2026-06-17
• CVE-2026-39581: WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

  Updated 2026-06-16
• CVE-2026-39580: WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

  Updated 2026-06-17
• CVE-2026-39579: WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability 8.8 High

  Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

  Updated 2026-06-15
• CVE-2026-39578: WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

  Updated 2026-06-17
• CVE-2026-39577: WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

  Updated 2026-06-17
• CVE-2026-39576: WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

  Updated 2026-06-17
• CVE-2026-39575: WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.

  Updated 2026-04-29
• CVE-2026-39574: WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

  Updated 2026-06-16
• CVE-2026-39573: WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

  Updated 2026-06-17
• CVE-2026-39572: WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.

  Updated 2026-04-29
• CVE-2026-39571: WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.

  Updated 2026-04-29
• CVE-2026-39570: WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.

  Updated 2026-04-29
• CVE-2026-39569: WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.

  Updated 2026-04-29
• CVE-2026-39568: WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

  Updated 2026-06-17
• CVE-2026-39567: WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

  Updated 2026-06-17
• CVE-2026-39566: WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.

  Updated 2026-04-29
• CVE-2026-39565: WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.

  Updated 2026-04-29

Search a CVE ID or check dependency files →