Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wordpress compares to other vendors in security performance

View Risk Score →

Software

wordpress
112
wordpress wordpress
24
wordpress profilegrid
7
wordpress wplms plugin
6
wordpress contest gallery
5
wordpress download manager
5
wordpress essential blocks
5
wordpress newsletters
4
wordpress armember plugin
3
wordpress betheme
3
wordpress calculated fields form
3
wordpress easy digital downloads
3
wordpress edwiser bridge
3
wordpress redirection for contact form 7
3
wordpress wpforo forum
3
wordpress academy lms plugin
2
wordpress advanced sermons
2
wordpress ai engine
2
wordpress ai engine plugin
2
wordpress analytify plugin
2
wordpress arforms form builder
2
wordpress arforms plugin
2
wordpress avada
2
wordpress avada builder
2
wordpress ba book everything
2
wordpress backup migration plugin
2
wordpress besa
2
wordpress bmi adult & kid calculator
2
wordpress bookly
2
wordpress booster for woocommerce
2
wordpress build app online plugin
2
wordpress clickwhale
2
wordpress community events
2
wordpress consulting
2
wordpress coupon affiliates
2
wordpress directorypress
2
wordpress download monitor
2
wordpress easy paypal buy now button plugin
2
wordpress easy social share buttons
2
wordpress edumall theme
2
wordpress essential addons for elementor
2
wordpress eventer - wordpress event & booking manager plugin
2
wordpress eventin
2
wordpress eventin plugin
2
wordpress file manager
2
wordpress file upload
2
wordpress forminator
2
wordpress jannah
2
wordpress jobmonster
2
wordpress js help desk
2

WordPress Real Estate Manager ProReal Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision

Risk 70
Severity
7.5
First published (updated )
CVE-2026-15142

WordPress Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All FormsInvisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter

Risk 44
Severity
7.2
First published (updated )
CVE-2026-16145

WordPress Object Sync for SalesforceObject Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

Risk 43
Severity
7.5
First published (updated )
CVE-2026-15162

WordPress W3 Total CacheW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

Risk 44
Severity
7.2
First published (updated )
CVE-2026-18109

WordPress SMEPay: UPI Gateway for WooCommerce pluginWordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Risk 43
Severity
7.5
First published (updated )
CVE-2026-66461
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress Booking ActivitiesWordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Risk 77
Severity
8.8
First published (updated )
CVE-2026-28176

WordPress MStore APIWordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

Risk 75
Severity
8.1
First published (updated )
CVE-2026-27543

WordPress WP Directory KitWP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

Risk 49
Severity
8.6
First published (updated )
CVE-2026-18474

WordPress Events ManagerEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Risk 60
Severity
8.1
First published (updated )
CVE-2026-18057

WordPress WP Photo Album PlusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

Risk 43
Severity
7.5
First published (updated )
CVE-2026-18049
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress WP Photo Album Plus WordPress pluginWP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

Risk 43
Severity
7.5
First published (updated )
CVE-2026-18048

WordPress EventinEventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint

Risk 54
Severity
8.2
First published (updated )
CVE-2026-13171

WordPress Salon booking systemSalon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard

Risk 43
Severity
7.5
First published (updated )
CVE-2026-17022

WordPress SqueezeSqueeze < 1.7.12 - Author+ Arbitrary File Upload

Risk 79
Severity
8.8
First published (updated )
CVE-2026-16985

WordPress Contact Form to Any APIContact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

Risk 43
Severity
7.5
First published (updated )
CVE-2026-18946
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress HT Contact FormHT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

Risk 43
Severity
7.5
First published (updated )
CVE-2026-14206

WordPress File ManagerBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

Risk 79
Severity
8.8
First published (updated )
CVE-2026-17540

WordPress NewslettersNewsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

Risk 75
Severity
8.1
First published (updated )
CVE-2026-16267

WordPress WordPressXSS

Risk 82
Severity
8.9
First published (updated )
CVE-2026-64638

WordPress MStore APIMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

Risk 75
Severity
8.1
First published (updated )
CVE-2026-16030
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress Content ViewsContent Views < 4.5 - Subscriber+ SQL Injection via preview_request

Risk 60
Severity
8.1
First published (updated )
CVE-2026-15361

WordPress WooCommerce Multilingual & MulticurrencyWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
First published (updated )
CVE-2026-66711

WordPress E2Pdf pluginWordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
First published (updated )
CVE-2026-66710

WordPress FacebookWordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
First published (updated )
CVE-2026-66705

WordPress Advanced AJAX Product FiltersWordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
First published (updated )
CVE-2026-66439
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WordPress AnsPress – Question and answerWordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Risk 48
Severity
7.1
First published (updated )
CVE-2026-65554

WordPress Jeg Elementor Kit pluginWordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

Risk 66
Severity
7.2
First published (updated )
CVE-2026-65549

WordPress Creative MailWordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

Risk 55
Severity
8.5
First published (updated )
CVE-2026-65547

WordPress AI Engine pluginWordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
First published (updated )
CVE-2026-65545

WordPress Super SocializerWordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
First published (updated )
CVE-2026-65544
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203