CVE-2026-65521

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mahmudul Hasan Arif Wordpress

Products

Wp Social Ninja Wordpress

CVE-2026-65522

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelacehq Wordpress

Products

Manual - Documentation, Knowledge Base & Education Wordpress Theme Wordpress

CVE-2026-65524

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Avada Custom Branding Wordpress

CVE-2026-65534

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Charlie Etienne Wordpress

Products

Custom Links In Elementor Image Carousel Wordpress

CVE-2026-65535

WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Takayuki Miyauchi Wordpress

Products

Tinymce Templates Wordpress

CVE-2026-65536

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mahdi Yousefi Wordpress

Products

افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) Wordpress

CVE-2026-65537

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Cyr To Lat Reloaded – Transliteration Of Links And File Names Wordpress

CVE-2026-65538

WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nilo Velez Wordpress

Products

Machete Wordpress

CVE-2026-65539

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bimal Rekhadiya Wordpress

Products

Kwayy Html Sitemap Wordpress

CVE-2026-65540

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Metin Saraç Wordpress

Products

Popup For Cf7 With Sweet Alert Wordpress

CVE-2026-65550

WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpshopmart

Products

Wordpress Tabs

CVE-2026-61945

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Multivendorx Wordpress

Products

Woocommerce Product Stock Alert Wordpress

CVE-2026-65450

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Romancode Wordpress

Products

Mapsvg Wordpress

CVE-2026-27403

WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nerdpress Wordpress

Products

Hubbub Lites Wordpress

CVE-2026-65050

Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ninjaforms Wordpress

Products

Ninja Forms Wordpress

CVE-2026-65452

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Motovnet Wordpress

Products

Ebook Store Wordpress

CVE-2026-65483

WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hashthemes Wordpress

Products

Hashthemes Demo Importer Wordpress

CVE-2026-65527

WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lqd Wordpress

Products

Liquid Speech Balloon Wordpress

CVE-2026-59517

WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hassantafreshi Wordpress

Products

Easy Form Builder Wordpress

CVE-2026-61951

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themetechmount Wordpress

Products

Truebooker Wordpress