CVE-2026-62xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

815 records · Page 8 of 9

• CVE-2026-62117: WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  Updated 2026-10-11
• CVE-2026-62116: WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  Updated 2026-10-11
• CVE-2026-62115: WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

  Updated 2026-10-11
• CVE-2026-62114: WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

  Updated 2026-09-11
• CVE-2026-62113: WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

  Updated 2026-09-11
• CVE-2026-62112: WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability 7.6 High

  Editor SQL Injection in Amelia <= 2.4.9 versions.

  Updated 2026-09-11
• CVE-2026-62111: WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

  Updated 2026-09-11
• CVE-2026-62110: WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

  Updated 2026-09-11
• CVE-2026-62109: WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability 7.6 High

  Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.

  Updated 2026-09-11
• CVE-2026-62108: WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability 9.8 Critical

  Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

  Updated 2026-09-17
• CVE-2026-62107: WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability 8.8 High

  Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

  Updated 2026-09-11
• CVE-2026-62106: WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability 8.8 High

  Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.

  Updated 2026-09-11
• CVE-2026-62105: WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

  Updated 2026-09-11
• CVE-2026-62104: WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability 10.0 Critical

  Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.

  Updated 2026-09-19
• CVE-2026-62103: WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

  Updated 2026-09-11
• CVE-2026-62102: WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability 8.8 High

  Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.

  Updated 2026-09-11
• CVE-2026-62101: WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability 9.8 Critical

  Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.

  Updated 2026-09-17
• CVE-2026-62100: WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

  Updated 2026-10-11
• CVE-2026-62099: WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

  Updated 2026-10-11
• CVE-2026-62098: WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability 6.5 Medium

  Unauthenticated Content Injection in Boutique <= 2.3.3 versions.

  Updated 2026-10-11
• CVE-2026-62097: WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

  Updated 2026-09-30
• CVE-2026-62096: WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

  Updated 2026-10-11
• CVE-2026-62095: WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

  Updated 2026-10-11
• CVE-2026-62094: WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

  Updated 2026-10-11
• CVE-2026-62093: WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

  Updated 2026-10-11
• CVE-2026-62092: WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

  Updated 2026-10-11
• CVE-2026-62091: WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

  Updated 2026-10-11
• CVE-2026-62090: WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

  Updated 2026-10-11
• CVE-2026-62089: WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.

  Updated 2026-09-11
• CVE-2026-62088: WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

  Updated 2026-09-11
• CVE-2026-62087: WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

  Updated 2026-10-11
• CVE-2026-62086: WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

  Updated 2026-10-11
• CVE-2026-62085: WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

  Updated 2026-09-30
• CVE-2026-62084: WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

  Updated 2026-09-30
• CVE-2026-62083: WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability 5.4 Medium

  Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

  Updated 2026-09-30
• CVE-2026-62082: WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

  Updated 2026-10-11
• CVE-2026-62081: WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

  Updated 2026-09-30
• CVE-2026-62080: WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

  Updated 2026-09-30
• CVE-2026-62079: WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

  Updated 2026-09-30
• CVE-2026-62078: WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

  Updated 2026-09-30
• CVE-2026-62077: WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

  Updated 2026-10-11
• CVE-2026-62076: WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

  Updated 2026-10-11
• CVE-2026-62075: WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

  Updated 2026-10-11
• CVE-2026-62074: WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

  Updated 2026-10-11
• CVE-2026-62073: WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

  Updated 2026-10-03
• CVE-2026-62072: WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability 8.8 High

  Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

  Updated 2026-10-06
• CVE-2026-62071: WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

  Updated 2026-10-01
• CVE-2026-62070: WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

  Updated 2026-10-11
• CVE-2026-62069: WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

  Updated 2026-10-11
• CVE-2026-62068: WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

  Updated 2026-10-11
• CVE-2026-62067: WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

  Updated 2026-10-11
• CVE-2026-62066: WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

  Updated 2026-10-11
• CVE-2026-62065: WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

  Updated 2026-10-11
• CVE-2026-62064: WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  Updated 2026-10-11
• CVE-2026-62063: WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

  Updated 2026-10-01
• CVE-2026-62062: WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

  Updated 2026-09-25
• CVE-2026-62061: WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.

  Updated 2026-10-01
• CVE-2026-62060: WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

  Updated 2026-10-01
• CVE-2026-62059: WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

  Updated 2026-10-01
• CVE-2026-62058: WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2.

  Updated 2026-10-01
• CVE-2026-62057: WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.

  Updated 2026-10-30
• CVE-2026-62056: WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.

  Updated 2026-10-30
• CVE-2026-62055: WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

  Updated 2026-10-30
• CVE-2026-62054: WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

  Updated 2026-10-11
• CVE-2026-62053: WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

  Updated 2026-10-11
• CVE-2026-62052: WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

  Updated 2026-10-11
• CVE-2026-62051: WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

  Updated 2026-10-11
• CVE-2026-62050: WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

  Updated 2026-10-11
• CVE-2026-62049: WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

  Updated 2026-10-09
• CVE-2026-62047: WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

  Updated 2026-10-30
• CVE-2026-62046: WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

  Updated 2026-10-11
• CVE-2026-62045: WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

  Updated 2026-10-11
• CVE-2026-62044: WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability 7.2 High

  Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

  Updated 2026-10-11
• CVE-2026-62043: WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability 7.5 High

  Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

  Updated 2026-10-11
• CVE-2026-62042: WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.

  Updated 2026-10-09
• CVE-2026-62041: WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1.

  Updated 2026-10-09
• CVE-2026-62040: WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.

  Updated 2026-10-14
• CVE-2026-62039: WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.

  Updated 2026-10-11
• CVE-2026-62038: WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability 7.3 High

  Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

  Updated 2026-10-11
• CVE-2026-62037: WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  Updated 2026-10-11
• CVE-2026-62036: WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.

  Updated 2026-10-11
• CVE-2026-62035: WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability 6.3 Medium

  Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

  Updated 2026-10-11
• CVE-2026-62034: WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  Updated 2026-10-11
• CVE-2026-62033: WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability 7.6 High

  Subscriber Settings Change in uListing <= 2.2.0 versions.

  Updated 2026-10-11
• CVE-2026-62032: WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability 9.8 Critical

  Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

  Updated 2026-10-11
• CVE-2026-62031: WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

  Updated 2026-10-11
• CVE-2026-62030: WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

  Updated 2026-10-11
• CVE-2026-62029: WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.

  Updated 2026-10-09
• CVE-2026-62028: WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.

  Updated 2026-10-11
• CVE-2026-62027: WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  Updated 2026-10-11
• CVE-2026-62026: WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.

  Updated 2026-10-09
• CVE-2026-62025: WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability 9.0 Critical

  Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

  Updated 2026-10-11
• CVE-2026-62024: WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability 9.9 Critical

  Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

  Updated 2026-10-11
• CVE-2026-62023: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

  Updated 2026-10-30
• CVE-2026-62022: WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

  Updated 2026-10-11
• CVE-2026-62021: WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability 8.8 High

  Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

  Updated 2026-10-11
• CVE-2026-62020: WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

  Updated 2026-10-11
• CVE-2026-62019: WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.

  Updated 2026-10-30
• CVE-2026-62018: WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  Updated 2026-10-29
• CVE-2026-62017: WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  Updated 2026-10-29

Search a CVE ID or check dependency files →