WordPress CVEs

CVE-2026-118167 November 6, 2026

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing… Full details

MEDIUM 5.3

CVE-2026-118045 November 6, 2026

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not… Full details

HIGH 8.7

CVE-2026-116533 November 6, 2026

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on… Full details

CRITICAL 9.8

CVE-2026-115673 November 6, 2026

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute… Full details

HIGH 7.5

CVE-2026-115230 November 6, 2026

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary… Full details

CRITICAL 9.8

CVE-2026-114427 November 6, 2026

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role… Full details

MEDIUM 6.8

CVE-2026-113615 November 6, 2026

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers… Full details

CRITICAL 9.8

CVE-2026-113584 November 6, 2026

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an… Full details

CRITICAL 9.8

CVE-2026-110955 November 6, 2026

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username. Full details

CRITICAL 9.8

CVE-2026-110813 November 6, 2026

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is… Full details

HIGH 7.5

CVE-2026-110532 November 6, 2026

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. Full details

HIGH 8.6

CVE-2026-110525 November 6, 2026

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that… Full details

HIGH 8.8

CVE-2026-119751 November 5, 2026

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose… Full details

MEDIUM 6.9

CVE-2026-107776 November 5, 2026

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission… Full details

LOW 2.2

CVE-2026-100109 November 5, 2026

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role,… Full details

CRITICAL 9.8

CVE-2026-91049 November 5, 2026

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated… Full details

MEDIUM 6.4

CVE-2026-90967 November 5, 2026

The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices,… Full details

MEDIUM 4.3

CVE-2026-90966 November 5, 2026

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is… Full details

MEDIUM 4.3

CVE-2026-90965 November 5, 2026

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that… Full details

MEDIUM 5.3

CVE-2026-90964 November 5, 2026

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header… Full details

MEDIUM 5.3

CVE-2026-90963 November 5, 2026

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that… Full details

MEDIUM 5.3

CVE-2026-88814 November 5, 2026

The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code… Full details

LOW 3.7

CVE-2026-87856 November 5, 2026

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other… Full details

MEDIUM 5.3

CVE-2026-86795 November 5, 2026

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not… Full details

MEDIUM 5.3

CVE-2026-86442 November 5, 2026

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read… Full details

HIGH 8.2

CVE-2026-85570 November 5, 2026

The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless… Full details

MEDIUM 4.3

CVE-2026-85351 November 5, 2026

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and… Full details

MEDIUM 5

CVE-2026-85347 November 5, 2026

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to… Full details

MEDIUM 6.8

CVE-2026-85346 November 5, 2026

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as… Full details

MEDIUM 4.3

CVE-2026-19256 November 5, 2026

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and… Full details

CRITICAL 9.8

CVE-2026-16304 November 5, 2026

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber… Full details

HIGH 8.1

CVE-2026-109150 November 5, 2026

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in… Full details

HIGH 7.1

CVE-2026-107787 November 5, 2026

The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder… Full details

LOW 3.1

CVE-2026-107786 November 5, 2026

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform… Full details

MEDIUM 6.8

CVE-2026-107775 November 5, 2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing… Full details

LOW 2.7

CVE-2026-107774 November 5, 2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly… Full details

MEDIUM 5.3

CVE-2026-107773 November 5, 2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order… Full details

MEDIUM 6.5

CVE-2026-105971 November 5, 2026

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of… Full details

MEDIUM 5.3

CVE-2026-105259 November 5, 2026

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and… Full details

MEDIUM 6.8

CVE-2026-100144 November 5, 2026

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default,… Full details

CRITICAL 9.3

CVE-2025-15702 November 5, 2026

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any… Full details

HIGH 8.8

CVE-2025-15701 November 5, 2026

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored… Full details

LOW 3.5

CVE-2026-93389 November 5, 2026

The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores… Full details

HIGH 8.2

CVE-2026-120553 November 5, 2026

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-120533 November 5, 2026

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-118193 November 5, 2026

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()`… Full details

HIGH 8.8

CVE-2026-116617 November 5, 2026

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes… Full details

HIGH 8.1

CVE-2026-104812 November 5, 2026

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated… Full details

MEDIUM 6.4

CVE-2026-119749 November 4, 2026

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can… Full details

HIGH 8.7

CVE-2026-119748 November 4, 2026

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing… Full details

MEDIUM 6.9