Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wordpress compares to other vendors in security performance

View Risk Score →

Software

wordpress
545
wordpress wordpress
134
wordpress download manager
15
wordpress wplms plugin
14
wordpress newsletters
10
wordpress contest gallery
9
wordpress file upload
9
wordpress js help desk
8
wordpress link library
8
wordpress profilegrid
8
wordpress ai engine
7
wordpress ninja forms
7
wordpress wp mailster
7
wordpress church admin plugin
6
wordpress essential addons for elementor
6
wordpress eventin
6
wordpress salon booking system plugin
6
wordpress simple membership
6
wordpress wp job portal
6
wordpress academy lms plugin
5
wordpress ai engine plugin
5
wordpress essential blocks
5
wordpress seriously simple podcasting
5
wordpress simple shopping cart
5
wordpress sunshine photo cart
5
wordpress advanced custom fields pro
4
wordpress betheme
4
wordpress build app online plugin
4
wordpress community events
4
wordpress easy appointments
4
wordpress easy digital downloads
4
wordpress elementor
4
wordpress elementsready addons for elementor
4
wordpress exclusive addons for elementor
4
wordpress file manager
4
wordpress js help desk plugin
4
wordpress simple paypal shopping cart
4
wordpress the pack elementor addons
4
wordpress wp compress
4
wordpress wp gotowebinar
4
wordpress wpforms
4
wordpress xstore core
4
wordpress admin and site enhancements (ase)
3
wordpress affiliate-toolkit
3
wordpress analytify
3
wordpress armember plugin
3
wordpress contact form email
3
wordpress js job manager plugin
3
wordpress listingpro
3
wordpress olive one click demo import
3

WordPress Real Estate Manager ProReal Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision

Risk 70
Severity
7.5
First published (updated )
CVE-2026-15142

WordPress ECSECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

Risk 64
First published (updated )
CVE-2026-14229

WordPress Simply Schedule AppointmentsSimply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints

Risk 36
First published (updated )
CVE-2026-16541

WordPress Backup MigrationBackup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login

Risk 65
First published (updated )
CVE-2026-18216

WordPress Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All FormsInvisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values

Risk 30
Severity
4.9
First published (updated )
CVE-2026-16146
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All FormsInvisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter

Risk 44
Severity
7.2
First published (updated )
CVE-2026-16145

WordPress Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & StripeContest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

Risk 38
Severity
6.5
First published (updated )
CVE-2026-16586

WordPress User Session Synchronizer pluginUser Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters

Risk 86
Severity
9.8
First published (updated )
CVE-2026-15341

WordPress Object Sync for SalesforceObject Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

Risk 43
Severity
7.5
First published (updated )
CVE-2026-15162

WordPress W3 Total CacheW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

Risk 44
Severity
7.2
First published (updated )
CVE-2026-18109
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress SMEPay: UPI Gateway for WooCommerce pluginWordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Risk 43
Severity
7.5
First published (updated )
CVE-2026-66461

WordPress Log in with Google pluginWordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Risk 86
Severity
9.8
First published (updated )
CVE-2026-28185

WordPress Booking ActivitiesWordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Risk 77
Severity
8.8
First published (updated )
CVE-2026-28176

WordPress Web Directory FreeWordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

Risk 61
Severity
9.3
First published (updated )
CVE-2026-28142

WordPress MStore APIWordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

Risk 75
Severity
8.1
First published (updated )
CVE-2026-27543
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress PPWP – Password Protect PagesPPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Risk 39
Severity
6.4
First published (updated )
CVE-2026-3639

WordPress Draft ListDraft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Risk 46
Severity
6.5
First published (updated )
CVE-2026-49466

WordPress Quick Paypal PaymentsQuick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN

Risk 27
Severity
5.3
First published (updated )
CVE-2026-17008

WordPress Tablesome TableWordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability

Risk 61
Severity
9.3
First published (updated )
CVE-2026-66659

WordPress WP Directory KitWP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

Risk 49
Severity
8.6
First published (updated )
CVE-2026-18474
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress Events Manager (WordPress plugin)Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

Risk 86
Severity
9.8
First published (updated )
CVE-2026-18366

WordPress User Access ManagerUser Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

Risk 27
Severity
5.3
First published (updated )
CVE-2026-18035

WordPress Events ManagerEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Risk 60
Severity
8.1
First published (updated )
CVE-2026-18057

WordPress WP Photo Album PlusWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

Risk 38
Severity
6.1
First published (updated )
CVE-2026-17013

WordPress WP Photo Album PlusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

Risk 43
Severity
7.5
First published (updated )
CVE-2026-18049
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress WP Photo Album Plus WordPress pluginWP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

Risk 43
Severity
7.5
First published (updated )
CVE-2026-18048

WordPress WP Travel EngineWP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

Risk 27
Severity
5.3
First published (updated )
CVE-2026-16737

WordPress Patterns KitPatterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

Risk 34
Severity
5.4
First published (updated )
CVE-2026-15249

WordPress EventinEventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint

Risk 54
Severity
8.2
First published (updated )
CVE-2026-13171

WordPress EventinEventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

Risk 22
Severity
4.3
First published (updated )
CVE-2026-13177
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203