CVE-2026-42637
— WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerabil…
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Remote
|
Authentication
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42636
— WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site…
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42635
— WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulne…
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42634
— WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.…
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42418
— WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: f…
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
CVE-2026-42417
— WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42416
— WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42415
— WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42414
— WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42413
— WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive…
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41562
— WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41561
— WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41560
— WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
Remote
|
Authorization
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41559
— WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data…
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41555
— WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <=…
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-40807
— WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cros…
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-40806
— WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scri…
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-39798
— WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-39797
— WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-39796
— WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access …
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
Remote
|
Authorization
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
