CVE-2026-66648
— WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66623
— WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnera…
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66610
— WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66599
— WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66587
— WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66585
— WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
Remote
|
Information Disclosure
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66584
— WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerabili…
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32558
— WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 -…
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32551
— WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Woo Essential <= 4.3.0 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32478
— WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32477
— WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitr…
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32476
— WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vuln…
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32471
— WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability
Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28190
— WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28171
— WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28167
— WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28166
— WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28165
— WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
digits
|
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28162
— WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-28153
— WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhoo…
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026