CVE-2026-27368

WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Seedprod Wordpress

Products

Coming Soon Page, Under Construction & Maintenance Mode Wordpress

CVE-2026-27387

WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Designinvento Wordpress

Products

Directorypress Wordpress

CVE-2026-27440

WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.7.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Saadiqbal Wordpress

Products

Mycred Wordpress

CVE-2026-22344

WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes FiveStar fivestar allows PHP Local File Inclusion.This issue affects FiveStar: from n/a through <= 1.7.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Fivestar Wordpress

CVE-2026-22346

WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows Object Injection.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through <= 1.5.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

A Wp Life Wordpress

Products

Slider Responsive Slideshow – Image Slider, Gallery Slideshow Wordpress

CVE-2026-22352

WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Persianscript Wordpress

Products

Persian Woocommerce Sms Wordpress

CVE-2026-22367

WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Coworking coworking allows PHP Local File Inclusion.This issue affects Coworking: from n/a through <= 1.6.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Coworking Wordpress

CVE-2026-22369

WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ironfit ironfit allows PHP Local File Inclusion.This issue affects Ironfit: from n/a through <= 1.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Ironfit Wordpress

CVE-2026-22370

WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Marveland marveland allows PHP Local File Inclusion.This issue affects Marveland: from n/a through <= 1.3.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Marveland Wordpress

CVE-2026-22372

WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Isida isida allows PHP Local File Inclusion.This issue affects Isida: from n/a through <= 1.4.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Isida Wordpress

CVE-2026-22373

WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fooddy fooddy allows PHP Local File Inclusion.This issue affects Fooddy: from n/a through <= 1.3.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Fooddy Wordpress

CVE-2026-22375

WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Impacto Patronus impacto-patronus allows PHP Local File Inclusion.This issue affects Impacto Patronus: from n/a through <= 1.2.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Impacto Patronus Wordpress

CVE-2026-22377

WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Saveo saveo allows PHP Local File Inclusion.This issue affects Saveo: from n/a through <= 1.1.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Saveo Wordpress

CVE-2026-22378

WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Blabber blabber allows PHP Local File Inclusion.This issue affects Blabber: from n/a through <= 1.7.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Blabber Wordpress

CVE-2026-22379

WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Netmix netmix allows PHP Local File Inclusion.This issue affects Netmix: from n/a through <= 1.0.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Netmix Wordpress

CVE-2026-22381

WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows PHP Local File Inclusion.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Pawfriends - Pet Shop And Veterinary Wordpress Theme Wordpress

CVE-2026-24944

WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe2: from n/a through <= 10.44.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Subscribe2 Wordpress

CVE-2026-24956

WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress

Products

Download Manager Addons For Elementor Wordpress

CVE-2026-1369

Conditional CAPTCHA <= 4.0.0 - Open Redirect

The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Conditional Captcha Wordpress

Products

Conditional Captcha Wordpress

CVE-2026-4338

ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure

The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Activitypub Automattic Wordpress

Products

Activitypub Activitypub Wordpress