CVE-2026-39448

WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Coderpress Wordpress

Products

Nowpayments For Woocommerce Wordpress

CVE-2026-57350

WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Andy Fragen Wordpress

Products

Wp Debugging Wordpress

CVE-2026-57354

WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock. Jetimpex Inc. Wordpress

Products

Jetreviews Wordpress

CVE-2026-57357

WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Search Atlas Group Wordpress

Products

Search Atlas Seo Wordpress

CVE-2026-57358

WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sysbasics Wordpress

Products

Customize My Account For Woocommerce Wordpress

CVE-2026-57426

WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Chill Media Labs S.r.l. Wordpress

Products

Modula - Pro Wordpress

CVE-2026-57672

WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Melograno Venture Studio Wordpress

Products

Wpdatatables Wordpress

CVE-2026-57673

WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Optimole Wordpress

Products

Optimole Wordpress

CVE-2026-57677

WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Novalnet Wordpress

Products

Novalnet Payment Gateway For Woocommerce Wordpress

CVE-2026-57683

WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Epsiloncool Wordpress

Products

Wp Fast Total Search Wordpress

CVE-2026-57684

WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tranmautritam Wordpress

Products

Thefox Wordpress

CVE-2026-57685

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drfuri Wordpress

Products

Martfury - Woocommerce Marketplace Wordpress Theme Wordpress

CVE-2026-57686

WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpxpo

Products

Wordpress Wowaddons

CVE-2026-57688

WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Gurmehub Wordpress

Products

Pos Entegratör Wordpress

CVE-2026-57689

WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Werkstatt Wordpress

CVE-2026-57690

WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Werkstatt Wordpress

CVE-2026-57748

WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Shopify Help Center Wordpress

Products

Shopify Wordpress

CVE-2026-57750

WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Keksdieb Wordpress

Products

Ez Form Calculator Premium Wordpress

CVE-2026-57751

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Heateor Support Wordpress

Products

Heateor Social Login Wordpress

CVE-2026-57753

WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nathanbarry Wordpress

Products

Kit (formerly Convertkit) For Woocommerce Wordpress