CVE-2026-54854

WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs Wordpress-extensions

Products

Profile Builder Profile Builder

CVE-2026-54855

WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs Wordpress-extensions

Products

Profile Builder Profile Builder

CVE-2026-78527

WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gsplugins Wordpress-extensions

Products

Gs Testimonial Slider Gs Testimonial Slider

CVE-2026-90888

WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Leadsnap Wordpress-extensions

Products

Leadsnap Leadsnap

CVE-2026-94175

WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Saad Iqbal Wordpress-extensions

Products

All In One Login All In One Login

CVE-2026-107868

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Yithemes

Products

Yith Woocommerce Product Add Ons Yith Woocommerce Product Add-ons

CVE-2026-115947

WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress-extensions

Products

Husky Husky

CVE-2026-116401

WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress-extensions

Products

Husky Husky

CVE-2026-116851

WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Implecode Wordpress-extensions

Products

Ecommerce Product Catalog Ecommerce Product Catalog

CVE-2026-116852

WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Marketingfire Wordpress-extensions

Products

Widget-options Widget Options

CVE-2026-116854

WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aguilatechnologies Wordpress-extensions

Products

Wp Customer Area Wp Customer Area

CVE-2026-116861

WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpdesk

Products

Flexible Chat Flexible Chat

CVE-2026-116862

WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Acato Wordpress-extensions

Products

Wp Rest Cache Wp Rest Cache

CVE-2026-118086

WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hakan Ozevin Wordpress-extensions

Products

Wp Base Booking Wp Base Booking

CVE-2026-118089

WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rextheme Wordpress-extensions

Products

Product Feed Manager Product Feed Manager

CVE-2026-109234

Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Tigroumeow Wordpress-extensions

Products

Meow Lightbox Meow Lightbox

CVE-2026-118043

Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bulk Media Register

CVE-2026-118185

Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security Optimizer

CVE-2026-118437

BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Buddyforms

CVE-2026-118438

Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Firelight Lightbox