CVE-2026-104747

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress-extensions

Products

Haaken Haaken

CVE-2026-104757

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Carazo Wordpress-extensions

Products

Import And Export Users And Customers Import And Export Users And Customers

CVE-2026-104814

WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Epiph Wordpress-extensions

Products

Form Block Form Block

CVE-2026-105057

WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ben Marshall Wordpress-extensions

Products

Zero Spam Zero Spam

CVE-2026-105058

WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

John James Jacoby Wordpress-extensions

Products

Wp User Profiles Wp User Profiles

CVE-2026-105061

WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brandtoss Wordpress-extensions

Products

Wpmailster Wp Mailster

CVE-2026-105070

WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dimitri Grassi Wordpress-extensions

Products

Salon Booking System Salon Booking System

CVE-2026-105071

WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Royal Plugins Wordpress-extensions

Products

Sitevault Sitevault

CVE-2026-105317

WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs Wordpress-extensions

Products

Paid Member Subscriptions Paid Member Subscriptions

CVE-2026-104399

WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemix Wordpress-extensions

Products

Motors Motors

CVE-2026-103355

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Unlimited-elements Wordpress-extensions

Products

Unlimited Elements For Elementor (free Widgets, Addons, Templates) Unlimited Elements For Elementor

CVE-2026-97276

WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Veronalabs Wordpress-extensions

Products

Wp Statistics Wp Statistics

CVE-2026-103354

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Stellarwp Wordpress-extensions

Products

Gutenberg Blocks By Kadence Blocks Gutenberg Blocks By Kadence Blocks

CVE-2026-97307

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress-extensions

Products

Cost Calculator Builder Cost Calculator Builder

CVE-2026-103062

WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs Wordpress-extensions

Products

Translatepress Translatepress

CVE-2026-96451

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ultimatemember Wordpress-extensions

Products

Ultimate Member Ultimate Member

CVE-2026-104402

WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Farvisun Wordpress-extensions

Products

Mindio Magic Mcp Mindio Magic Mcp

CVE-2026-103344

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Unlimited-elements Wordpress-extensions

Products

Unlimited Elements For Elementor (free Widgets, Addons, Templates) Unlimited Elements For Elementor

CVE-2026-86817

Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Five Star Business Profile And Schema

CVE-2026-94171

WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Villatheme Wordpress-extensions

Products

Curcy Curcy