CVE-2026-84253

click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-84254

click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94235

Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-106029

WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-86717

Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89283

WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-86706

Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96334

WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95597

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93950

WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-65459

WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62118

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62035

WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62033

WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Subscriber Settings Change in uListing <= 2.2.0 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62028

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42706

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42705

WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40808

WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40801

WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40777

WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—