Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wordpress compares to other vendors in security performance

View Risk Score →

Software

wordpress
36
wordpress wordpress
7
wordpress wplms plugin
6
wordpress file upload
4
wordpress elementor
3
wordpress ninja forms
3
wordpress unlimited elements for elementor
3
wordpress ai engine plugin
2
wordpress automatic
2
wordpress build app online plugin
2
wordpress capella theme
2
wordpress church admin plugin
2
wordpress contact form 7
2
wordpress crm perks forms
2
wordpress defender security
2
wordpress directorypress
2
wordpress eventin
2
wordpress front end users
2
wordpress instawp connect
2
wordpress jobsearch
2
wordpress js help desk
2
wordpress js help desk plugin
2
wordpress js job manager plugin
2
wordpress makeaholic theme
2
wordpress moveto plugin
2
wordpress participants database
2
wordpress podlove podcast publisher
2
wordpress popup by supsystic
2
wordpress realhomes
2
wordpress sms alert order notifications – woocommerce
2
wordpress sunshine photo cart
2
wordpress teddy-bear-customize-addon
2
wordpress total donations
2
wordpress wechat social login plugin
2
wordpress woffice
2
wordpress woocommerce pdf vouchers
2
wordpress wp project manager
2
wordpress 69 clothing theme
1
wordpress acpt (premium)
1
wordpress acpt (pro) - custom post types plugin
1
wordpress activecampaign plugin
1
wordpress activedemand plugin
1
wordpress activity link preview for buddypress
1
wordpress addons & fields for woocommerce
1
wordpress adirectory
1
wordpress admin and site enhancements (ase) pro
1
wordpress advanced 301 and 302 redirect
1
wordpress advanced custom fields
1
wordpress advanced custom fields pro
1
wordpress advanced file manager
1

WordPress AI Content Generator MarketingAI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

First published (updated )
CVE-2026-85118

WordPress Photolia themeWordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

First published (updated )
CVE-2026-78535

WordPress Qwery themeWordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

First published (updated )
CVE-2026-78533

WordPress Jacqueline themeWordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

First published (updated )
CVE-2026-78531

WordPress Alliance themeWordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

First published (updated )
CVE-2026-78529

WordPress Kicker themeWordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

First published (updated )
CVE-2026-66569

WordPress Original ThemeWordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

First published (updated )
CVE-2026-66568

WordPress Anesta themeWordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

First published (updated )
CVE-2026-66567

WordPress FC UnitedWordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

First published (updated )
CVE-2026-66565

WordPress ShiftCV themeWordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

First published (updated )
CVE-2026-66564

WordPress Education Center themeWordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

First published (updated )
CVE-2026-66483

WordPress Windsor themeWordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

First published (updated )
CVE-2026-66563

WordPress Drone MediaWordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

First published (updated )
CVE-2026-66482

WordPress Creator LMS pluginWordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

Risk 82
Severity
9.9
Malicious File Upload
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

First published (updated )
CVE-2026-62129

WordPress Asia GardenWordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

First published (updated )
CVE-2026-62125

WordPress Law Office themeWordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

First published (updated )
CVE-2026-62120

WordPress WineShopWordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

First published (updated )
CVE-2026-62090

WordPress Equadio themeWordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

First published (updated )
CVE-2026-62087

WordPress Juno themeWordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

First published (updated )
CVE-2026-62086

WordPress Avala ThemeWordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

First published (updated )
CVE-2026-62077

WordPress Kalles themeWordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

First published (updated )
CVE-2026-62076

WordPress Yacht Rental themeWordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

First published (updated )
CVE-2026-62054

WordPress Wine House ThemeWordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

First published (updated )
CVE-2026-62053

WordPress Tipsy themeWordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

First published (updated )
CVE-2026-62052

WordPress Splendour themeWordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

First published (updated )
CVE-2026-62050

WordPress Stargaze themeWordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

First published (updated )
CVE-2026-62051

WordPress DirectoryPressWordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

First published (updated )
CVE-2026-62032

WordPress Tailored ToolsWordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

Risk 78
Severity
9
Malicious File Upload
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

First published (updated )
CVE-2026-62025

WordPress Tonda MembershipWordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

First published (updated )
CVE-2026-62022

WordPress CleanSkinWordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

First published (updated )
CVE-2026-42723

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203