CVE-2026-73183

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Get Maps Marker Pro Wordpress

Products

Maps Marker Pro Wordpress

CVE-2026-73354

WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Reichertbrothers Wordpress

Products

Simplyrets Real Estate Idx Wordpress

CVE-2026-73364

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdesk

Products

Wordpress Flexible Subscriptions

CVE-2026-73384

WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cmsminds Wordpress

Products

Pay With Contact Form 7 Wordpress

CVE-2026-73385

WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Outanking Team Wordpress

Products

Outranking Plugin Options Wordpress

CVE-2026-73387

WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Smartdatasoft Wordpress

Products

Resido Wordpress

CVE-2026-73389

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

The4 Wordpress

Products

Kalles Addons Wordpress

CVE-2026-73390

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Klbtheme Wordpress

Products

Total Donations Wordpress

CVE-2026-73391

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Klbtheme Wordpress

Products

Total Donations Wordpress

CVE-2026-74021

WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anders Norén Wordpress

Products

Chaplin Wordpress

CVE-2026-66590

WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tagembed Wordpress

Products

Tagembed Wordpress

CVE-2026-66594

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lukeseager Wordpress

Products

Wordpress Persistent Login Wordpress

CVE-2026-66598

WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kingtech Llc. Wordpress

Products

B2bking Premium Wordpress

CVE-2026-66605

WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hasthemes Wordpress

Products

Swatchly – Woocommerce Variation Swatches For Products Wordpress

CVE-2026-66606

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

Smartsmtp Wordpress

CVE-2026-66609

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Codexthemes Wordpress

Products

Thegem (elementor) Wordpress

CVE-2026-66647

WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

Homlisti Wordpress

CVE-2026-66672

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66673

WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Monkeysan Wordpress

Products

Flatastic Wordpress

CVE-2026-66677

WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vaultdweller Wordpress

Products

Leyka Wordpress