CVE-2026-124408

WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Wpcafe Wpcafe

CVE-2026-125784

WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Magnigenie Wordpress-extensions

Products

Restropress Restropress

CVE-2026-125763

WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Brainstormforce Wordpress-extensions

Products

Sureforms Sureforms

CVE-2026-125708

WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Element Pack Elementor Addons Element Pack Elementor Addons

CVE-2026-127050

Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback

Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Inisev Wordpress-extensions

Products

Backup Migration Backup Migration

CVE-2026-125787

WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress-extensions

Products

Quiz And Survey Master Quiz And Survey Master

CVE-2026-125785

WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress-extensions

Products

Jetengine Jetengine

CVE-2026-125836

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Nicu Micle Wordpress-extensions

Products

Simple Jwt Login Simple Jwt Login

CVE-2026-125444

WordPress King Addons for Elementor plugin <= 51.1.87 - Broken Access Control vulnerability

Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kingaddons Wordpress-extensions

Products

King Addons For Elementor King Addons For Elementor

CVE-2026-125434

WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Webful Creations Wordpress-extensions

Products

Repairbuddy Repairbuddy

CVE-2026-125680

WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bold-themes Wordpress-extensions

Products

Bold Page Builder Bold Page Builder

CVE-2026-124262

WordPress Ad Inserter plugin <= 2.8.19 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Igorfuna Wordpress-extensions

Products

Ad Inserter Ad Inserter

CVE-2026-125776

WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs Wordpress-extensions

Products

Profile Builder Profile Builder

CVE-2026-125778

WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress-extensions

Products

Mycred Mycred

CVE-2026-125436

WordPress The Post Grid plugin <= 7.9.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mamunur Rashid Wordpress-extensions

Products

The Post Grid The Post Grid

CVE-2026-125454

WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpchill

Products

Passster Passster

CVE-2026-125786

WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress-extensions

Products

Quiz And Survey Master Quiz And Survey Master

CVE-2026-107710

Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Hustle Hustle – Email Marketing, Lead Generation, Optins, Popups

CVE-2026-125438

WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webful Creations Wordpress-extensions

Products

Repairbuddy Repairbuddy

CVE-2026-124752

WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Element Pack Elementor Addons Element Pack Elementor Addons