CVE-2026-105068

WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelite Wordpress-extensions

Products

Events Manager Events Manager

CVE-2026-104391

WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress-extensions

Products

Quiz And Survey Master Quiz And Survey Master

CVE-2026-40800

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Elextensions Wordpress-extensions

Products

Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes

CVE-2026-62142

WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Melapress Wordpress-extensions

Products

Wp 2fa Wp 2fa

CVE-2026-96539

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Ultimatemember Wordpress-extensions

Products

Ultimate Member Ultimate Member

CVE-2026-104759

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpo365

Products

Wpo365 Wpo365 | Seamless Wordpress + Microsoft Integration (wpo365 | Login)

CVE-2026-104722

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Webilia Wordpress-extensions

Products

Listdom: Ai-powered Business Directory With Classifieds Ads Listings Listdom: Ai-powered Business Directory With Classifieds Ads Listings

CVE-2026-107657

HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern &lt;a href="%value%"&gt;Custom link&lt;/a&gt;), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hivepress Wordpress-extensions

Products

Hivepress Hivepress

CVE-2026-96765

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpo365

Products

Wpo365 Wpo365 | Seamless Wordpress + Microsoft Integration (wpo365 | Login)

CVE-2025-14123

Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Davidanderson Wordpress-extensions

Products

Redux Framework Redux Framework

CVE-2026-84224

Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Kirki

CVE-2026-94663

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Metagauss Wordpress-extensions

Products

Profilegrid Profilegrid

CVE-2026-107866

WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress-extensions

Products

Jetelements For Elementor Jetelements For Elementor

CVE-2026-103520

HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hivepress Wordpress-extensions

Products

Hivepress Hivepress

CVE-2026-94256

SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Sms Alert

CVE-2026-109935

Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Otter Blocks

CVE-2026-94075

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Tribulant Wordpress-extensions

Products

Newsletters Newsletters

CVE-2026-114694

WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pixelite Wordpress-extensions

Products

Events Manager Events Manager

CVE-2026-114194

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Igorfuna Wordpress-extensions

Products

Ad Inserter Ad Inserter

CVE-2026-114178

WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Boldgrid Wordpress-extensions

Products

W3 Total Cache W3 Total Cache