CVE-2026-73380

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Supsysticcom Wordpress

Products

Popup By Supsystic Wordpress

CVE-2026-73381

WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Supsysticcom Wordpress

Products

Popup By Supsystic Wordpress

CVE-2026-66599

WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress

Products

Wpcomplete Wordpress

CVE-2026-66671

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Verdure Core Wordpress

CVE-2026-28153

WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Notification Master Wordpress

Products

Notification Master &#8211; Real-time Wordpress Notifications With Email, Sms, Webhooks &amp; More Wordpress

CVE-2026-28171

WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Vanquish Wordpress

Products

Woocommerce File Approval Wordpress

CVE-2026-28190

WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themebing Wordpress

Products

Prolancer Element Wordpress

CVE-2026-32471

WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themebing Wordpress

Products

Prolancer Element Wordpress

CVE-2026-32476

WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Amplebyte Pvt Limited Wordpress

Products

Brave Conversion Engine (pro) Wordpress

CVE-2026-32558

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Redefiningtheweb Wordpress

Products

Affiliate Pro - Affiliate Program For Woocommerce & Wordpress Wordpress

CVE-2026-66585

WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpcafe

Products

Wordpress Wp Cafe Pro

CVE-2026-66587

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpcafe

Products

Wordpress Wp Cafe Pro

CVE-2026-66648

WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mvpthemes Wordpress

Products

Jawn Wordpress

CVE-2026-66670

WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Måne Wordpress

CVE-2026-28192

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Piotnet Wordpress

Products

Piotnet Addons For Elementor Wordpress

CVE-2026-28568

WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mdmag Wordpress

Products

Quill Forms Wordpress

CVE-2026-28569

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sslzen Wordpress

Products

Ssl Zen Wordpress

CVE-2026-32468

WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Duitku Wordpress

Products

Duitku Payment Gateway Wordpress

CVE-2026-32547

WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordplus Wordpress

Products

Better Messages Wordpress

CVE-2026-66638

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Shabti Wordpress

Products

Frontend Admin By Dynamapps Wordpress