CVE-2026-57xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

802 records · Page 3 of 9

• CVE-2026-57748: WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability 7.5 High

  Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

  Updated 2026-07-02
• CVE-2026-57747: WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

  Updated 2026-07-02
• CVE-2026-57746: WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability 7.1 High

  Subscriber Broken Access Control in Booked <= 3.0.0 versions.

  Updated 2026-07-02
• CVE-2026-57745: WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Updated 2026-07-13
• CVE-2026-57744: WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Updated 2026-07-13
• CVE-2026-57743: WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Updated 2026-07-13
• CVE-2026-57742: WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

  Updated 2026-10-11
• CVE-2026-57741: WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

  Updated 2026-07-13
• CVE-2026-57740: WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.

  Updated 2026-07-13
• CVE-2026-57739: WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

  Updated 2026-07-13
• CVE-2026-57738: WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

  Updated 2026-07-13
• CVE-2026-57737: WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

  Updated 2026-10-07
• CVE-2026-57736: WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability 7.4 High

  Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

  Updated 2026-07-01
• CVE-2026-57735: WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

  Updated 2026-07-23
• CVE-2026-57734: WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Updated 2026-07-13
• CVE-2026-57733: WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.

  Updated 2026-07-13
• CVE-2026-57732: WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.

  Updated 2026-07-13
• CVE-2026-57731: WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability 6.5 Medium

  Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

  Updated 2026-07-02
• CVE-2026-57730: WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

  Updated 2026-07-02
• CVE-2026-57729: WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.

  Updated 2026-07-13
• CVE-2026-57728: WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.

  Updated 2026-07-13
• CVE-2026-57727: WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.

  Updated 2026-10-19
• CVE-2026-57726: WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

  Updated 2026-07-13
• CVE-2026-57725: WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

  Updated 2026-07-13
• CVE-2026-57724: WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

  Updated 2026-07-13
• CVE-2026-57723: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability 7.4 High

  Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

  Updated 2026-07-01
• CVE-2026-57722: WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enable Media Replace: from n/a through 4.2.1.

  Updated 2026-07-02
• CVE-2026-57721: WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6.

  Updated 2026-07-01
• CVE-2026-57720: WordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2.

  Updated 2026-07-01
• CVE-2026-57719: WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.

  Updated 2026-07-13
• CVE-2026-57718: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.

  Updated 2026-07-13
• CVE-2026-57717: WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

  Updated 2026-07-23
• CVE-2026-57716: WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability 5.3 Medium

  Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

  Updated 2026-07-23
• CVE-2026-57715: WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.

  Updated 2026-07-13
• CVE-2026-57714: WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.

  Updated 2026-07-13
• CVE-2026-57713: WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

  Updated 2026-07-13
• CVE-2026-57712: WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.

  Updated 2026-07-13
• CVE-2026-57711: WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

  Updated 2026-07-13
• CVE-2026-57710: WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.

  Updated 2026-07-13
• CVE-2026-57709: WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.

  Updated 2026-07-13
• CVE-2026-57708: WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Contact Form Entries contact-form-entries allows Reflected XSS.This issue affects Contact Form Entries: from n/a through <= 1.5.2.

  Updated 2026-07-13
• CVE-2026-57707: WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.

  Updated 2026-07-13
• CVE-2026-57706: WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan, Inc. Dokan dokan-lite allows Reflected XSS.This issue affects Dokan: from n/a through <= 5.0.6.

  Updated 2026-07-13
• CVE-2026-57705: WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

  Updated 2026-07-13
• CVE-2026-57704: WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

  Updated 2026-07-23
• CVE-2026-57703: WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability 6.3 Medium

  Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

  Updated 2026-07-23
• CVE-2026-57702: WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.

  Updated 2026-07-13
• CVE-2026-57701: WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

  Updated 2026-07-23
• CVE-2026-57700: WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.

  Updated 2026-06-29
• CVE-2026-57699: WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

  Updated 2026-07-23
• CVE-2026-57698: WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability 6.5 Medium

  Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.

  Updated 2026-07-13
• CVE-2026-57697: WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability 7.5 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.

  Updated 2026-07-13
• CVE-2026-57696: WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability 7.1 High

  Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

  Updated 2026-07-23
• CVE-2026-57695: WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through <= 5.1.0.

  Updated 2026-07-13
• CVE-2026-57694: WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.

  Updated 2026-07-13
• CVE-2026-57693: WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.

  Updated 2026-07-13
• CVE-2026-57692: WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2.

  Updated 2026-07-01
• CVE-2026-57691: WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability 5.8 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.

  Updated 2026-07-13
• CVE-2026-57690: WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

  Updated 2026-07-02
• CVE-2026-57689: WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

  Updated 2026-07-02
• CVE-2026-57688: WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability 8.2 High

  Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

  Updated 2026-07-02
• CVE-2026-57687: WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

  Updated 2026-07-02
• CVE-2026-57686: WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

  Updated 2026-07-02
• CVE-2026-57685: WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

  Updated 2026-07-02
• CVE-2026-57684: WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

  Updated 2026-07-02
• CVE-2026-57683: WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

  Updated 2026-07-02
• CVE-2026-57682: WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

  Updated 2026-07-02
• CVE-2026-57681: WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

  Updated 2026-07-02
• CVE-2026-57680: WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

  Updated 2026-07-02
• CVE-2026-57679: WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

  Updated 2026-07-02
• CVE-2026-57678: WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

  Updated 2026-07-02
• CVE-2026-57677: WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

  Updated 2026-07-02
• CVE-2026-57676: WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.

  Updated 2026-07-08
• CVE-2026-57675: WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

  Updated 2026-07-02
• CVE-2026-57674: WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

  Updated 2026-07-02
• CVE-2026-57673: WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

  Updated 2026-07-02
• CVE-2026-57672: WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

  Updated 2026-07-02
• CVE-2026-57671: WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

  Updated 2026-07-02
• CVE-2026-57670: WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

  Updated 2026-07-02
• CVE-2026-57669: WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

  Updated 2026-07-02
• CVE-2026-57668: WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.

  Updated 2026-07-13
• CVE-2026-57667: WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability 8.5 High

  Sales Representative SQL Injection in Groundhogg <= 4.5 versions.

  Updated 2026-06-29
• CVE-2026-57665: WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

  Updated 2026-06-26
• CVE-2026-57664: WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability 4.3 Medium

  Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.

  Updated 2026-06-26
• CVE-2026-57663: WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

  Updated 2026-06-26
• CVE-2026-57662: WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

  Updated 2026-06-26
• CVE-2026-57661: WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

  Updated 2026-06-26
• CVE-2026-57660: WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

  Updated 2026-06-29
• CVE-2026-57659: WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.

  Updated 2026-06-26
• CVE-2026-57658: WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability 9.1 Critical

  Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

  Updated 2026-06-26
• CVE-2026-57657: WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

  Updated 2026-06-26
• CVE-2026-57656: WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

  Updated 2026-06-26
• CVE-2026-57655: WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability 8.2 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

  Updated 2026-06-26
• CVE-2026-57654: WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability 6.5 Medium

  Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

  Updated 2026-06-29
• CVE-2026-57653: WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.

  Updated 2026-06-26
• CVE-2026-57652: WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

  Updated 2026-06-26
• CVE-2026-57651: WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

  Updated 2026-06-26
• CVE-2026-57650: WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

  Updated 2026-06-26
• CVE-2026-57649: WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

  Updated 2026-06-26
• CVE-2026-57648: WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability 4.3 Medium

  Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

  Updated 2026-06-29

Search a CVE ID or check dependency files →