CVE-2026-39xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

698 records · Page 5 of 7

• CVE-2026-39564: WordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive Data.This issue affects Sunshine Photo Cart: from n/a through < 3.6.2.

  Updated 2026-04-29
• CVE-2026-39563: WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.12.

  Updated 2026-04-29
• CVE-2026-39562: WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.

  Updated 2026-04-29
• CVE-2026-39561: WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.

  Updated 2026-04-29
• CVE-2026-39560: WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

  Updated 2026-06-17
• CVE-2026-39559: WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

  Updated 2026-06-17
• CVE-2026-39558: WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

  Updated 2026-06-17
• CVE-2026-39557: WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

  Updated 2026-06-17
• CVE-2026-39556: WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

  Updated 2026-06-17
• CVE-2026-39555: WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability 8.1 High

  Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.

  Updated 2026-06-02
• CVE-2026-39554: WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

  Updated 2026-06-17
• CVE-2026-39553: WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

  Updated 2026-06-02
• CVE-2026-39552: WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.

  Updated 2026-06-02
• CVE-2026-39551: WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability 8.1 High

  Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.

  Updated 2026-06-02
• CVE-2026-39550: WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability 8.1 High

  Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.

  Updated 2026-06-02
• CVE-2026-39549: WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

  Updated 2026-06-17
• CVE-2026-39548: WordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

  Updated 2026-06-17
• CVE-2026-39547: WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

  Updated 2026-06-17
• CVE-2026-39546: WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability 7.6 High

  Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

  Updated 2026-06-17
• CVE-2026-39545: WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

  Updated 2026-06-17
• CVE-2026-39544: WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.

  Updated 2026-04-29
• CVE-2026-39543: WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.

  Updated 2026-04-29
• CVE-2026-39542: WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through <= 2.10.13.

  Updated 2026-04-29
• CVE-2026-39541: WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.

  Updated 2026-04-29
• CVE-2026-39540: WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

  Updated 2026-06-16
• CVE-2026-39539: WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

  Updated 2026-06-17
• CVE-2026-39538: WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

  Updated 2026-04-29
• CVE-2026-39537: WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.

  Updated 2026-06-17
• CVE-2026-39536: WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.

  Updated 2026-04-29
• CVE-2026-39535: WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.

  Updated 2026-04-29
• CVE-2026-39534: WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

  Updated 2026-06-16
• CVE-2026-39533: WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

  Updated 2026-06-16
• CVE-2026-39532: WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability 8.8 High

  Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

  Updated 2026-06-16
• CVE-2026-39531: WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.

  Updated 2026-05-21
• CVE-2026-39530: WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

  Updated 2026-06-16
• CVE-2026-39529: WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

  Updated 2026-06-17
• CVE-2026-39528: WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.5.

  Updated 2026-04-29
• CVE-2026-39527: WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability 5.4 Medium

  Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

  Updated 2026-06-15
• CVE-2026-39526: WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through < 4.11.2.

  Updated 2026-04-29
• CVE-2026-39525: WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

  Updated 2026-06-16
• CVE-2026-39524: WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability 7.5 High

  Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

  Updated 2026-06-16
• CVE-2026-39523: WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

  Updated 2026-06-17
• CVE-2026-39522: WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

  Updated 2026-06-17
• CVE-2026-39521: WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Content: from n/a through <= 4.3.1.

  Updated 2026-04-29
• CVE-2026-39520: WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.

  Updated 2026-04-29
• CVE-2026-39519: WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

  Updated 2026-06-16
• CVE-2026-39518: WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability 7.1 High

  Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

  Updated 2026-06-16
• CVE-2026-39517: WordPress Blog Filter plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.6.

  Updated 2026-04-29
• CVE-2026-39516: WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.7.0.

  Updated 2026-04-29
• CVE-2026-39515: WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Motors < 1.4.107 versions.

  Updated 2026-06-16
• CVE-2026-39514: WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

  Updated 2026-06-15
• CVE-2026-39513: WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

  Updated 2026-06-16
• CVE-2026-39512: WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

  Updated 2026-06-16
• CVE-2026-39511: WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

  Updated 2026-06-16
• CVE-2026-39510: WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability 2.7 Low

  Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.

  Updated 2026-04-29
• CVE-2026-39509: WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.

  Updated 2026-04-29
• CVE-2026-39508: WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.

  Updated 2026-04-29
• CVE-2026-39507: WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

  Updated 2026-06-16
• CVE-2026-39506: WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine (Pro): from n/a through < 3.4.2.

  Updated 2026-04-29
• CVE-2026-39505: WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.

  Updated 2026-04-29
• CVE-2026-39504: WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.

  Updated 2026-04-29
• CVE-2026-39503: WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

  Updated 2026-06-16
• CVE-2026-39502: WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

  Updated 2026-06-15
• CVE-2026-39501: WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.

  Updated 2026-04-29
• CVE-2026-39500: WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.

  Updated 2026-04-29
• CVE-2026-39499: WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability 7.2 High

  Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

  Updated 2026-06-16
• CVE-2026-39498: WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability 7.2 High

  Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

  Updated 2026-06-16
• CVE-2026-39497: WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.

  Updated 2026-04-29
• CVE-2026-39496: WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.

  Updated 2026-04-29
• CVE-2026-39495: WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.

  Updated 2026-04-29
• CVE-2026-39494: WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

  Updated 2026-06-12
• CVE-2026-39493: WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

  Updated 2026-06-16
• CVE-2026-39492: WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.

  Updated 2026-06-16
• CVE-2026-39491: WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.

  Updated 2026-06-16
• CVE-2026-39490: WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

  Updated 2026-06-16
• CVE-2026-39489: WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability 4.4 Medium

  Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

  Updated 2026-06-15
• CVE-2026-39488: WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.

  Updated 2026-04-29
• CVE-2026-39487: WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.

  Updated 2026-04-29
• CVE-2026-39486: WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.

  Updated 2026-04-29
• CVE-2026-39485: WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.

  Updated 2026-04-29
• CVE-2026-39484: WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.

  Updated 2026-04-29
• CVE-2026-39483: WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidekazu Ishikawa VK All in One Expansion Unit vk-all-in-one-expansion-unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through <= 9.113.3.

  Updated 2026-04-29
• CVE-2026-39482: WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through <= 4.9.4.

  Updated 2026-04-29
• CVE-2026-39481: WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability 7.2 High

  Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

  Updated 2026-06-16
• CVE-2026-39480: WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability 7.5 High

  Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.

  Updated 2026-06-16
• CVE-2026-39479: WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.

  Updated 2026-04-29
• CVE-2026-39478: WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability 8.8 High

  Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

  Updated 2026-06-16
• CVE-2026-39477: WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.

  Updated 2026-04-29
• CVE-2026-39476: WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.

  Updated 2026-04-29
• CVE-2026-39475: WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.

  Updated 2026-04-29
• CVE-2026-39474: WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability 8.8 High

  Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

  Updated 2026-06-16
• CVE-2026-39473: WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This issue affects Simple History: from n/a through <= 5.24.0.

  Updated 2026-04-29
• CVE-2026-39472: WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability 7.2 High

  Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

  Updated 2026-06-16
• CVE-2026-39471: WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability 7.2 High

  Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

  Updated 2026-06-15
• CVE-2026-39470: WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability 7.2 High

  Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.

  Updated 2026-06-16
• CVE-2026-39469: WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.

  Updated 2026-04-29
• CVE-2026-39468: WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability 6.8 Medium

  Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

  Updated 2026-06-16
• CVE-2026-39467: WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability 7.2 High

  Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.

  Updated 2026-05-19
• CVE-2026-39466: WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker broken-link-checker allows Blind SQL Injection.This issue affects Broken Link Checker: from n/a through <= 2.4.7.

  Updated 2026-04-29
• CVE-2026-39465: WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability 9.1 Critical

  Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

  Updated 2026-06-16

Search a CVE ID or check dependency files →