CVE-2026-39767

WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Baseapp Wordpress-extensions

Products

Wpbase Cache Wpbase Cache

CVE-2026-39770

WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Amentotech Wordpress-extensions

Products

Doctreat Core Doctreat

CVE-2026-39771

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mightynetworks Vs Buddyboss Wordpress-extensions

Products

Buddyboss Platform Buddyboss Platform

CVE-2026-39772

WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft Wordpress-extensions

Products

Captcha By Bestwebsoft Captcha By Bestwebsoft

CVE-2026-39773

WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Amentotech Wordpress-extensions

Products

Doctreat Core Doctreat Core

CVE-2026-39774

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tourfic Ai Studio Wordpress-extensions

Products

Tourfic Pro Tourfic Pro

CVE-2026-39775

WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dexignzone Wordpress-extensions

Products

Jobzilla - Job Board Wordpress Theme Jobzilla

CVE-2026-39776

WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpshopmart

Products

Tabs Tabs

CVE-2026-39778

WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeansar Wordpress-extensions

Products

Ansar Import – One Click Starter Sites – For Elementor & Themes Ansar Import – One Click Starter Sites – For Elementor & Themes

CVE-2026-39780

WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Youzify

Products

Youzify Youzify

CVE-2026-39784

WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nicdark Wordpress-extensions

Products

Hotel Booking Hotel Booking

CVE-2026-39787

WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

10web Wordpress-extensions

Products

10web Social Post Feed 10web Social Photo Feed

CVE-2026-39788

WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Shamimsplugins Wordpress-extensions

Products

Front End Pm Front End Pm

CVE-2026-39792

WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mitchell Bennis Wordpress-extensions

Products

Simple File List Simple File List

CVE-2026-39793

WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Nicu Micle Wordpress-extensions

Products

Simple Jwt Login Simple Jwt Login

CVE-2026-39794

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wclovers Wordpress-extensions

Products

Woocommerce Multivendor Marketplace Woocommerce Multivendor Marketplace Rest Api

CVE-2026-39796

WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Flipper Code Wordpress-extensions

Products

Advanced Posts Listing – Show Post List Easily Advanced Posts Listing–show Post List Easily

CVE-2026-39797

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Data443 Wordpress-extensions

Products

Gdpr Framework By Data443 Gdpr Framework By Data443

CVE-2026-39798

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themetechmount Wordpress-extensions

Products

Truebooker Truebooker

CVE-2026-40806

WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Plugin-devs Wordpress-extensions

Products

Blog, Posts And Category Filter For Elementor Blog Posts And Category Filter For Elementor