CVE-2026-42xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

864 records · Page 3 of 9

• CVE-2026-42759: WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Affiliate Super Assistent amazonsimpleadmin allows Stored XSS.This issue affects Affiliate Super Assistent: from n/a through <= 1.10.1.

  Updated 2026-05-27
• CVE-2026-42758: WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through < 4.08.253.

  Updated 2026-05-27
• CVE-2026-42757: WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability 9.9 Critical

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.This issue affects WebinarIgnition: from n/a through < 4.08.253.

  Updated 2026-05-27
• CVE-2026-42756: WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability 9.9 Critical

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP &#8211; Compress / Optimize Images &amp; Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP &#8211; Compress / Optimize Images &amp; Convert WebP | SEO Friendly: from n/a through <= 3.2.7.

  Updated 2026-05-27
• CVE-2026-42755: WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQL Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.

  Updated 2026-05-27
• CVE-2026-42754: WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phbernard Favicon favicon-by-realfavicongenerator allows Reflected XSS.This issue affects Favicon: from n/a through <= 1.3.46.

  Updated 2026-05-27
• CVE-2026-42753: WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability 7.3 High

  Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through <= 2.11.10.

  Updated 2026-05-27
• CVE-2026-42752: WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability 6.5 Medium

  Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.

  Updated 2026-06-16
• CVE-2026-42751: WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.18.

  Updated 2026-05-27
• CVE-2026-42750: WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.

  Updated 2026-05-27
• CVE-2026-42749: WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability 7.1 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comments): from n/a through <= 1.3.0.

  Updated 2026-05-27
• CVE-2026-42748: WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpify-woo allows Upload a Web Shell to a Web Server.This issue affects WPify Woo Czech: from n/a through <= 5.4.1.

  Updated 2026-05-27
• CVE-2026-42747: WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.

  Updated 2026-05-27
• CVE-2026-42746: WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability 7.3 High

  Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitive Data.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.

  Updated 2026-05-27
• CVE-2026-42745: WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability 7.3 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypass.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.

  Updated 2026-05-27
• CVE-2026-42744: WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability 6.5 Medium

  Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Manipulating Hidden Fields.This issue affects Ads by WPQuads: from n/a through <= 3.0.2.

  Updated 2026-05-27
• CVE-2026-42743: WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability 6.5 Medium

  Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

  Updated 2026-06-16
• CVE-2026-42742: WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.

  Updated 2026-05-12
• CVE-2026-42741: WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2.

  Updated 2026-05-12
• CVE-2026-42740: WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.

  Updated 2026-05-27
• CVE-2026-42739: WordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blocker advanced-ip-blocker allows DOM-Based XSS.This issue affects Advanced IP Blocker: from n/a through <= 8.10.7.

  Updated 2026-05-27
• CVE-2026-42738: WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.

  Updated 2026-05-27
• CVE-2026-42737: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.

  Updated 2026-05-27
• CVE-2026-42736: WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability 7.5 High

  Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through <= 2.14.16.

  Updated 2026-05-27
• CVE-2026-42735: WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability 8.2 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.

  Updated 2026-05-27
• CVE-2026-42734: WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through <= 1.13.19.

  Updated 2026-05-27
• CVE-2026-42733: WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.This issue affects WPCS: from n/a through <= 1.3.1.

  Updated 2026-05-27
• CVE-2026-42732: WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability 6.5 Medium

  Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Input Data Manipulation.This issue affects Ads by WPQuads: from n/a through <= 3.0.2.

  Updated 2026-05-27
• CVE-2026-42731: WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.

  Updated 2026-05-27
• CVE-2026-42730: WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.

  Updated 2026-05-27
• CVE-2026-42729: WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows DOM-Based XSS.This issue affects PropertyHive: from n/a through <= 2.2.2.

  Updated 2026-05-27
• CVE-2026-42728: WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 2.8.2.

  Updated 2026-05-27
• CVE-2026-42727: WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.

  Updated 2026-05-27
• CVE-2026-42726: WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AWP Classifieds: from n/a through <= 4.4.5.

  Updated 2026-05-27
• CVE-2026-42725: WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.5.

  Updated 2026-05-27
• CVE-2026-42724: WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

  Updated 2026-10-11
• CVE-2026-42723: WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

  Updated 2026-10-11
• CVE-2026-42722: WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

  Updated 2026-10-11
• CVE-2026-42721: WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.

  Updated 2026-10-07
• CVE-2026-42720: WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.

  Updated 2026-10-07
• CVE-2026-42719: WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability 9.8 Critical

  Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

  Updated 2026-10-11
• CVE-2026-42718: WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

  Updated 2026-10-11
• CVE-2026-42717: WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in Leyka <= 3.32.3 versions.

  Updated 2026-10-11
• CVE-2026-42716: WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

  Updated 2026-10-11
• CVE-2026-42715: WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  Updated 2026-10-11
• CVE-2026-42714: WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.

  Updated 2026-10-07
• CVE-2026-42713: WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.

  Updated 2026-10-07
• CVE-2026-42712: WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

  Updated 2026-10-11
• CVE-2026-42711: WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  Updated 2026-10-11
• CVE-2026-42710: WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.

  Updated 2026-10-07
• CVE-2026-42709: WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  Updated 2026-10-11
• CVE-2026-42708: WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.

  Updated 2026-10-07
• CVE-2026-42707: WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.

  Updated 2026-10-29
• CVE-2026-42706: WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

  Updated 2026-10-11
• CVE-2026-42705: WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

  Updated 2026-10-11
• CVE-2026-42704: WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

  Updated 2026-10-11
• CVE-2026-42703: WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

  Updated 2026-10-29
• CVE-2026-42702: WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

  Updated 2026-10-13
• CVE-2026-42701: WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability 7.2 High

  Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

  Updated 2026-10-30
• CVE-2026-42700: WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

  Updated 2026-10-05
• CVE-2026-42699: WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  Updated 2026-10-11
• CVE-2026-42698: WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability 5.3 Medium

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.

  Updated 2026-10-08
• CVE-2026-42697: WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

  Updated 2026-10-13
• CVE-2026-42696: WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability 10.0 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration &amp; Cloning: from n/a through 1.5.19.

  Updated 2026-10-13
• CVE-2026-42695: WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.

  Updated 2026-10-11
• CVE-2026-42694: WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability 4.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

  Updated 2026-10-30
• CVE-2026-42693: WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

  Updated 2026-10-29
• CVE-2026-42692: WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

  Updated 2026-10-29
• CVE-2026-42691: WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.

  Updated 2026-10-30
• CVE-2026-42690: WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

  Updated 2026-10-29
• CVE-2026-42689: WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability 3.7 Low

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.

  Updated 2026-10-12
• CVE-2026-42688: WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

  Updated 2026-06-16
• CVE-2026-42687: WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability 8.1 High

  Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  Updated 2026-06-16
• CVE-2026-42686: WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

  Updated 2026-06-16
• CVE-2026-42685: WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

  Updated 2026-06-02
• CVE-2026-42684: WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.

  Updated 2026-06-02
• CVE-2026-42683: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.

  Updated 2026-06-01
• CVE-2026-42682: WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability 9.1 Critical

  Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.

  Updated 2026-06-01
• CVE-2026-42681: WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.

  Updated 2026-06-01
• CVE-2026-42680: WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1.

  Updated 2026-06-01
• CVE-2026-42679: WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal. This issue affects Classified Listing: from n/a through 5.3.8.

  Updated 2026-06-01
• CVE-2026-42678: WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.

  Updated 2026-06-01
• CVE-2026-42677: WordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Document Revisions: from n/a before 4.0.0.

  Updated 2026-06-01
• CVE-2026-42676: WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.

  Updated 2026-06-01
• CVE-2026-42675: WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability 7.3 High

  Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.

  Updated 2026-06-01
• CVE-2026-42674: WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability 7.5 High

  Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue affects Advanced Access Manager: from n/a through 7.1.0.

  Updated 2026-06-01
• CVE-2026-42673: WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.

  Updated 2026-06-01
• CVE-2026-42672: WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.

  Updated 2026-06-01
• CVE-2026-42671: WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157.

  Updated 2026-06-01
• CVE-2026-42670: WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability 7.5 High

  Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

  Updated 2026-06-02
• CVE-2026-42669: WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

  Updated 2026-06-02
• CVE-2026-42668: WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability 7.5 High

  Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

  Updated 2026-06-16
• CVE-2026-42667: WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability 7.5 High

  Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

  Updated 2026-06-16
• CVE-2026-42666: WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

  Updated 2026-06-16
• CVE-2026-42665: WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

  Updated 2026-06-16
• CVE-2026-42664: WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability 8.2 High

  Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.

  Updated 2026-06-16
• CVE-2026-42663: WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

  Updated 2026-06-16
• CVE-2026-42662: WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability 6.5 Medium

  Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

  Updated 2026-06-16
• CVE-2026-42661: WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability 8.8 High

  Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.

  Updated 2026-06-16
• CVE-2026-42660: WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability 6.5 Medium

  Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.

  Updated 2026-06-16

Search a CVE ID or check dependency files →