CVE-2026-74019
— WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
Remote
|
Authorization
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-74018
— WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
Remote
|
Misconfiguration
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-74016
— WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
Remote
|
Misconfiguration
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-74014
— WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
Remote
|
Misconfiguration
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-74013
— WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-74001
— WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerabi…
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Remote
|
Authentication
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-73998
— WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-73993
— WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-73992
— WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-73402
— WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
Remote
|
Cross-Site Scripting
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-68566
— WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerabil…
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-68564
— WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
Remote
|
Cross-Site Scripting
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66682
— WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vuln…
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66680
— WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66677
— WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
Remote
|
Authentication
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66673
— WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
Remote
|
Cross-Site Scripting
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66672
— WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
Remote
|
Injection
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66649
— WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66647
— WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
Remote
|
Authorization
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
CVE-2026-66616
— WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.
Remote
|
Cross-Site Scripting
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026
Aug 20, 2026