CVE-2026-66460

WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aftership & Automizely Wordpress

Products

Aftership Tracking Wordpress

CVE-2026-66432

WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Denishua Wordpress

Products

Wpjam Basic Wordpress

CVE-2026-66449

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dylan Kuhn Wordpress

Products

Geo Mashup Wordpress

CVE-2026-66458

WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress

Products

Realpress Wordpress

CVE-2026-66478

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Andymoyle Wordpress

Products

Church Admin Wordpress

CVE-2026-66660

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Scottpaterson Wordpress

Products

Contact Form 7 – Paypal & Stripe Add-on Wordpress

CVE-2026-66472

WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Everestthemes Wordpress

Products

Everest Backup Wordpress

CVE-2026-66655

WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Multiparcels Wordpress

Products

Multiparcels Shipping For Woocommerce Wordpress

CVE-2026-66687

WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Magepeopleteam Wordpress

Products

Wpbookingly Wordpress

CVE-2026-66693

WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors <= 1.4.113 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemix Wordpress

Products

Motors Wordpress

CVE-2026-66700

WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Zaytech

Products

Wordpress Smart Online Order For Clover

CVE-2026-73349

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Givewp Wordpress

CVE-2026-28173

WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Wp Event Solution Wordpress

CVE-2026-28175

WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp-buy

Products

Wordpress Visitor Traffic Real Time Statistics

CVE-2026-28176

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Booking Activities Team Wordpress

Products

Booking Activities Wordpress

CVE-2026-28181

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Acymailing Newsletter Team Wordpress

Products

Acymailing Smtp Newsletter Wordpress

CVE-2026-61960

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Wp Full Stripe Free Wordpress

CVE-2026-61966

WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Denishua Wordpress

Products

Wpjam Basic Wordpress

CVE-2026-61974

WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kitae-park Wordpress

Products

Mang Board Wp Wordpress

CVE-2026-61980

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Daan.dev Wordpress

Products

Omgf Pro Wordpress