CVE-2026-42634

WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress-extensions

Products

Video Background Block – Use Video As Background In The Section. Video Background Block Use Video As Background In The Section

CVE-2026-42635

WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpgenie

Products

Woocommerce Simple Auctions Woocommerce Simple Auctions

CVE-2026-42636

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wp Legal Pages

Products

Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent

CVE-2026-42637

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Payplug Wordpress-extensions

Products

Payplug For Woocommerce (official) Payplug For Woocommerce (official)

CVE-2026-48197

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Publishpress Wordpress-extensions

Products

Capabilities Publishpress Capabilities

CVE-2026-48199

WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Beplusthemes Wordpress-extensions

Products

Sermon'e Sermon'e

CVE-2026-62072

WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Progress Planner Wordpress-extensions

Products

Progress Planner Progress Planner

CVE-2026-94675

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fluent Forms Free Vs Pro Wordpress-extensions

Products

Fluent Forms Pro Add On Pack Fluent Forms Pro Add On Pack

CVE-2026-95526

WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress-extensions

Products

Bear Bear

CVE-2026-97308

WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Webfactoryltd Wordpress-extensions

Products

Wp Login Lockdown Login Lockdown

CVE-2026-100518

WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webfactoryltd Wordpress-extensions

Products

Advanced Google Recaptcha Advanced Google Recaptcha

CVE-2026-102387

WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Xserver

Products

Xserver Migrator Xserver Migrator

CVE-2026-102915

WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Marco Van Wieren Wordpress-extensions

Products

Wpo365 Wpo365

CVE-2026-104385

WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adrian Tobey Wordpress-extensions

Products

Groundhogg Groundhogg

CVE-2026-104387

WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Blubrry Wordpress-extensions

Products

Powerpress Podcasting Powerpress Podcasting

CVE-2026-104394

WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress-extensions

Products

Charitable Charitable

CVE-2026-104395

WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Picu Wordpress-extensions

Products

Picu Picu

CVE-2026-104405

WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress-extensions

Products

Givewp Givewp

CVE-2026-104406

WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Picu Wordpress-extensions

Products

Picu Picu

CVE-2026-104670

WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress