CVE-2026-56058

WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themecatcher Wordpress

Products

Quform Wordpress

CVE-2026-56066

WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shortpixel Wordpress

Products

Shortpixel Adaptive Images Wordpress

CVE-2026-56010

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tychesoftwares Wordpress

Products

Abandoned Cart Pro For Woocommerce Wordpress

CVE-2026-56043

WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cusrev Wordpress

Products

Customer Reviews For Woocommerce Wordpress

CVE-2026-56055

WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Inspirythemes Wordpress

Products

Realhomes Wordpress

CVE-2026-57617

WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Seedprod Llc Wordpress

Products

Seedprod Pro Wordpress

CVE-2026-56070

WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

CVSS 3.1 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Themehunk Wordpress

Products

Advance Product Search Wordpress

CVE-2026-56072

WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2026-57312

WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpeverest

Products

Wordpress Everest Forms

CVE-2026-57313

WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Surecart Wordpress

Products

Surecart Wordpress

CVE-2026-57317

WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nsquared Wordpress

Products

Simply Schedule Appointments Wordpress

CVE-2026-57319

WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress

Products

Fox Wordpress

CVE-2026-57324

WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Villatheme Wordpress

Products

Gift4u Wordpress

CVE-2025-68052

WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eagle-themes Wordpress

Products

Eagle Booking Wordpress

CVE-2026-57622

WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Wpcafe Wordpress

CVE-2026-57634

WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Folio Team

Products

Wordpress Ppwp

CVE-2026-57637

WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tychesoftwares Wordpress

Products

Abandoned Cart Lite For Woocommerce Wordpress

CVE-2026-56032

WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Buddyboss Wordpress

Products

Buddyboss Platform Wordpress

CVE-2026-56044

WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Adenion Wordpress

Products

Blog2social Wordpress

CVE-2026-56045

WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Valvepress Wordpress

Products

Automatic Wordpress