CVE-2026-94461

WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Metaphorcreations Wordpress

Products

Ditty Wordpress

CVE-2026-94680

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

The Post Grid Wordpress

CVE-2026-94498

WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Appmysite Wordpress

Products

Appmysite Wordpress

CVE-2026-94671

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme Wordpress

Products

The Post Grid Wordpress

CVE-2026-94679

WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Support

CVE-2026-94682

WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Secondlinethemes Wordpress

Products

Podcast Importer Secondline Wordpress

CVE-2026-95513

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Vcita Wordpress

Products

Online Booking & Scheduling Calendar For Wordpress By Vcita Wordpress

CVE-2026-95514

WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgsm Wordpress

Products

Netgsm Wordpress

CVE-2026-95525

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-94080

WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webwizards Wordpress

Products

Marketking Wordpress

CVE-2026-95529

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Calculated Fields Form Wordpress

CVE-2026-95515

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ninjaforms Wordpress

Products

Ninja Forms Wordpress

CVE-2026-95522

WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Easy Digital Downloads Wordpress

CVE-2026-95523

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-95524

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-95527

WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Conekta Group Wordpress

Products

Conekta Payment Gateway Wordpress

CVE-2026-95590

WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tainacan Wordpress

Products

Tainacan Wordpress

CVE-2026-95604

WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tangible Wordpress

Products

Loops & Logic Wordpress

CVE-2026-93526

WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Event Tickets Wordpress

CVE-2026-93772

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tomdever Wordpress

Products

Wpforo Forum Wordpress