CVE-2026-24637

WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability

Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Blubrry Wordpress

Products

Powerpress Podcasting Wordpress

CVE-2026-27053

WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Videowhisper Wordpress

Products

Broadcast Live Video Wordpress

CVE-2026-27407

WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Meowapps Wordpress

Products

Ai Engine Wordpress

CVE-2026-39450

WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Funnelkit Wordpress

Products

Funnelkit Automations Wordpress

CVE-2026-39515

WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors < 1.4.107 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemix Wordpress

Products

Motors Wordpress

CVE-2026-39518

WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Theeventprime Wordpress

Products

Eventprime Wordpress

CVE-2026-39524

WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Masteriyo Wordpress

CVE-2026-39532

WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Stiofansisland Wordpress

Products

Events Calendar For Geodirectory Wordpress

CVE-2026-39534

WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-39583

WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Datalogics Ecommerce Delivery Wordpress

Products

Datalogics Ecommerce Delivery Wordpress

CVE-2026-40773

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Rtcamp Wordpress

Products

Rtmedia For Wordpress, Buddypress And Bbpress Wordpress

CVE-2026-40779

WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Ylefebvre

Products

Wordpress Link Library

CVE-2026-40792

WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iqonic Wordpress

Products

Kivicare Wordpress

CVE-2026-40799

WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Replywp Wordpress

Products

Simple Cloudfare Turnstile Wordpress

CVE-2026-42668

WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Omnisend Wordpress

Products

Email Marketing For Woocommerce Wordpress

CVE-2026-42686

WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Theeventprime Wordpress

Products

Eventprime Wordpress

CVE-2026-42687

WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Theeventprime Wordpress

Products

Eventprime Wordpress

CVE-2026-42743

WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Masteriyo Wordpress

CVE-2026-45437

WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brthumar1959 Wordpress

Products

Product Filter Widget For Elementor Wordpress

CVE-2026-45441

WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Magepeopleteam Wordpress

Products

Wpevently Wordpress