CVE-2026-66640

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Marcus (aka @msykes) Wordpress

Products

Login With Ajax Wordpress

CVE-2026-66643

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wronganswersonly

Products

Wordpress Wufoo Shortcode

CVE-2026-66645

WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdeveloper

Products

Wordpress Table Of Contents Block

CVE-2026-66646

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mythemeshop Wordpress

Products

Wp Tab Widget Wordpress

CVE-2026-73181

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themecomplete Wordpress

Products

Extra Product Options & Add-ons For Woocommerce Wordpress

CVE-2026-73338

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autopay Wordpress

Products

Autopay Wordpress

CVE-2026-73342

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Magazine3 Wordpress

Products

Wp Multilang Wordpress

CVE-2026-73359

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Legal Pages

Products

Wordpress Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent

CVE-2026-73375

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73376

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73377

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress

Products

Ultimate Maps By Supsystic Wordpress

CVE-2026-73397

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Youzify

Products

Wordpress Youzify

CVE-2026-73399

WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Flutterwave Wordpress

Products

Flutterwave Woocommerce Wordpress

CVE-2026-73994

WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Charitable Wordpress

CVE-2026-73997

WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Starter Templates By Kadence Wp Wordpress

CVE-2026-74015

WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Merkulove Wordpress

Products

Readabler Wordpress

CVE-2026-15446

EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content, which the plugin's bundled lazysizes ls.unveilhooks addon then uses to dynamically create and insert a script element into the DOM at page view time.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nosilver4u Wordpress

Products

Ewww Image Optimizer Wordpress

CVE-2026-73394

WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stitchexpress Wordpress

Products

Stitch Express Wordpress

CVE-2026-32552

WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Yith

Products

Wordpress Yith Woocommerce Membership Premium

CVE-2026-73182

WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jeff Starr Wordpress

Products

Bbq Pro Wordpress