CVE-2026-16747

Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kirki Wordpress

Products

Kirki Wordpress

CVE-2026-65498

WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Complianz Wordpress

Products

Complianz Wordpress

CVE-2026-19089

Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Tychesoftwares Wordpress

Products

Product Input Fields For Woocommerce Wordpress

CVE-2024-32532

WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Siteground Wordpress

Products

Speed Optimizer Wordpress

CVE-2024-32518

WordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-66659

WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Essekia Wordpress

Products

Tablesome Table Wordpress

CVE-2026-15426

AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Acyba Wordpress

Products

Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress Wordpress

CVE-2026-18988

Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Shapedplugin Wordpress

Products

Easy Accordion – Ai-powered Faq & Accordion Blocks, Product Faq Wordpress

CVE-2026-15606

Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Shabti Wordpress

Products

Frontend Admin By Dynamapps Wordpress

CVE-2026-14870

Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Crmperks Wordpress

Products

Database For Contact Form 7, Wpforms, Elementor Forms Wordpress

CVE-2026-14305

WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdelicious

Products

Wordpress Wp Delicious

CVE-2026-12898

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Wordpress Yaniiliev

Products

Wordpress All In One Wp Migration And Backup

CVE-2026-16548

Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Chat Widget Wordpress

Products

Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And Chat Wordpress

CVE-2026-14237

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Vitepos Wordpress

Products

Vitepos Wordpress

CVE-2026-14238

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Vitepos Wordpress

Products

Vitepos Wordpress

CVE-2026-19075

All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Plugins360 Wordpress

Products

All-in-one Video Gallery Wordpress

CVE-2026-18030

Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Bricksforge Wordpress

Products

Bricksforge Wordpress

CVE-2026-15238

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress Hotel Booking Wordpress

Products

Motopress Hotel Booking Wordpress

CVE-2026-12971

LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Learnpress Wordpress

Products

Learnpress Wordpress

CVE-2026-16955

AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ai Engine Project Wordpress

Products

Ai Engine Wordpress