CVE-2026-104246

Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Contact Form 7 Signature Addon

CVE-2026-92433

Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Patreon Wordpress-extensions

Products

Patreon Wordpress Patreon Wordpress

CVE-2026-92431

Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Patreon Wordpress-extensions

Products

Patreon Wordpress Patreon Wordpress

CVE-2026-92432

Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Patreon Wordpress-extensions

Products

Patreon Wordpress Patreon Wordpress

CVE-2026-104122

Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ukr To Lat

CVE-2026-110373

WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hamid-alinia-idehweb Wordpress-extensions

Products

Login With Phone Number Login With Phone Number

CVE-2026-107436

WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpchill

Products

Strong Testimonials Strong Testimonials

CVE-2026-110895

WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Devitems Wordpress-extensions

Products

Support Genix Support Genix

CVE-2026-112111

Stored XSS via unquoted id attribute in Bootstrap Shortcodes [bs_tcontent]

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bootstrap Shortcodes Project Wordpress-extensions

Products

Bootstrap Shortcodes Bootstrap Shortcodes

CVE-2026-106028

ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Activetail For Woocommerce

CVE-2026-106933

Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Blaze Demo Importer

CVE-2026-91046

ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Elementsready Addons For Elementor

CVE-2026-91047

ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Elementsready Addons For Elementor

CVE-2026-89286

FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Formflow For Gohighlevel

CVE-2026-106014

Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Gateway For Vantiv On Wc

CVE-2026-94273

Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Snap Finance

CVE-2026-103311

Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Coinbase Commerce Payment Gateway For Woocommerce

CVE-2026-106010

BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bdm Digital Payment Gateway

CVE-2026-86791

iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ipos Pays Payment Gateway For Woocommerce

CVE-2026-91831

Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Subscribe To Comments