CVE-2026-115431

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wp Swings

Products

Upsell Order Bump Offer For Woocommerce Upsell Order Bump Offer For Woocommerce

CVE-2026-120851

WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publishpress Wordpress-extensions

Products

Publishpress Revisions Publishpress Revisions

CVE-2026-123471

WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress-extensions

Products

Mycred Mycred

CVE-2026-120845

WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Smush Image Compression And Optimization Smush Image Compression And Optimization

CVE-2026-27356

WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibericode Wordpress-extensions

Products

Mc4wp Mc4wp

CVE-2026-119219

Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in all versions up to, and including, 4.62.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Execution requires that the attacker-registered account be assigned as the post_author of a page or post whose template includes the Raven Author Box widget, a fixture an administrator can create by reassigning authorship to any user including newly registered Subscribers.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Artbees Wordpress-extensions

Products

Jupiter X Core Jupiter X Core

CVE-2026-120737

Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter

The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Artbees Wordpress-extensions

Products

Jupiter X Core Jupiter X Core

CVE-2026-121519

Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter

The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both harvest a valid wis_edit_feed nonce and overwrite any feed's slidespeed setting, after which the stored payload fires on every public pageview embedding the feed shortcode.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress-extensions

Products

Social Slider Feed Social Slider Feed

CVE-2026-119616

Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Picocodes Wordpress-extensions

Products

Noptin – Newsletter, New Post Notifications & Email Automation Noptin

CVE-2026-120555

Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Artbees Wordpress-extensions

Products

Jupiter X Core Jupiter X Core

CVE-2026-119098

LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to be enrolled as a student in a course containing a Content-type quiz question; the injected payload executes in the administrator's browser session during the normal grading workflow when 'Start a Review' is clicked on the affected attempt.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Lifterlms Wordpress-extensions

Products

Lifterlms Lifterlms

CVE-2026-119213

Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmanageninja

Products

Fluent Support Fluent Support

CVE-2026-119165

WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpbakery

Products

Wpbakery Page Builder Wpbakery Page Builder

CVE-2026-104913

Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Esaia Wordpress-extensions

Products

Interactive Real Estate – Floor Plan & Building Visualizer Interactive Real Estate

CVE-2026-121515

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress-extensions

Products

Fv Flowplayer Video Player Fv Flowplayer Video Player

CVE-2026-119175

Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A first-time commenter's submission requires a single administrator approval under the default comment_previously_approved setting; however, once approved, all subsequent comments from the same name and email pair bypass moderation, and the injected script executes for every visitor — including administrators viewing the post from the front end.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Gijo Wordpress-extensions

Products

Flying Images: Optimize And Lazy Load Images For Faster Page Speed Flying Images

CVE-2026-121516

QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qodeinteractive Wordpress-extensions

Products

Qode Wishlist For Woocommerce Qode Wishlist For Woocommerce

CVE-2026-124495

Apache Storm: Logviewer follows worker symlinks across topology ACLs

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Storm

CVE-2026-124496

Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Storm

CVE-2026-124690

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery