CVE-2026-90887
— WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.
Remote
|
Cross-Site Scripting
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-78528
— WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
Remote
|
Authorization
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-78295
— WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.
Remote
|
Cross-Site Request Forgery
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-78294
— WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Remote
|
Cross-Site Scripting
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-74017
— WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-74005
— WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnera…
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
Remote
|
Cross-Site Request Forgery
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-74002
— WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
Remote
|
Authorization
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-74000
— WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Remote
|
Authorization
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-73999
— WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Remote
|
Authorization
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66676
— WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
Remote
|
Authorization
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66631
— WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
Remote
|
Injection
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66630
— WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
Remote
|
Injection
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66628
— WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66626
— WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
Remote
|
Injection
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66625
— WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66624
— WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
Remote
|
Injection
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66619
— WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability
Administrator SQL Injection in Newsletters <= 4.18 versions.
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66618
— WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
Remote
|
Injection
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66617
— WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
Remote
|
Cross-Site Scripting
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
CVE-2026-66608
— WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.…
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
Remote
|
Server-Side Request Forgery
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Sep 17, 2026