Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wordpress compares to other vendors in security performance

View Risk Score →

Software

wordpress
112
wordpress wordpress
26
wordpress profilegrid
6
wordpress wplms plugin
6
wordpress contest gallery
5
wordpress download manager
5
wordpress newsletters
5
wordpress essential blocks
4
wordpress wp mailster
4
wordpress ai engine
3
wordpress armember plugin
3
wordpress betheme
3
wordpress calculated fields form
3
wordpress easy digital downloads
3
wordpress file manager
3
wordpress redirection for contact form 7
3
wordpress wpforo forum
3
wordpress 12 step meeting list
2
wordpress academy lms plugin
2
wordpress advanced sermons
2
wordpress ai engine plugin
2
wordpress analytify plugin
2
wordpress arforms form builder
2
wordpress arforms plugin
2
wordpress avada
2
wordpress avada builder
2
wordpress ba book everything
2
wordpress backup migration plugin
2
wordpress bear plugin
2
wordpress besa
2
wordpress bmi adult & kid calculator
2
wordpress bookly
2
wordpress booster for woocommerce
2
wordpress build app online plugin
2
wordpress cf7 views – complete entry management for contact form 7
2
wordpress charitable plugin
2
wordpress classified listing
2
wordpress clickwhale
2
wordpress community events
2
wordpress consulting
2
wordpress coupon affiliates
2
wordpress directorypress
2
wordpress document gallery
2
wordpress dofollow case by case
2
wordpress download monitor
2
wordpress easy paypal buy now button plugin
2
wordpress easy social share buttons
2
wordpress edwiser bridge
2
wordpress essential addons for elementor
2
wordpress eventin
2

WordPress WP MailsterWordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

First published (updated )
CVE-2026-105061

WordPress WP User ProfilesWordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Risk 79
Severity
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

First published (updated )
CVE-2026-105058

WordPress Form Block PluginWordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

First published (updated )
CVE-2026-104814

WordPress Import and export users and customersWordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Risk 66
Severity
7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

First published (updated )
CVE-2026-104757

WordPress Haaken themeWordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

First published (updated )
CVE-2026-104747

WordPress picu pluginWordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Risk 51
Severity
7.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

First published (updated )
CVE-2026-104406

WordPress picu pluginWordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

First published (updated )
CVE-2026-104395

WordPress Charitable pluginWordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

First published (updated )
CVE-2026-104394

WordPress BEAR PluginWordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Risk 51
Severity
7.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

First published (updated )
CVE-2026-95526

WordPress Progress PlannerWordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Risk 79
Severity
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

First published (updated )
CVE-2026-62072

WordPress Sermon'e pluginWordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

First published (updated )
CVE-2026-48199

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy ConsentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

First published (updated )
CVE-2026-42636

WordPress WooCommerce Simple AuctionsWordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

First published (updated )
CVE-2026-42635

WordPress Video Background Block – Use video as background in the sectionWordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

First published (updated )
CVE-2026-42634

WordPress Snapshotify – All-in-One Backup & Restore & MigrateWordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

First published (updated )
CVE-2026-42413

WordPress WXD Backup LiteWordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

First published (updated )
CVE-2026-41560

WordPress CF7 Views – Complete Entry Management for Contact Form 7WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

First published (updated )
CVE-2026-40807

WordPress Blog, Posts and Category Filter for ElementorWordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

First published (updated )
CVE-2026-40806

WordPress Advanced Posts Listing – Show Post List EasilyWordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

First published (updated )
CVE-2026-39796

WordPress Simple File ListWordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Risk 49
Severity
8.6
Path Traversal
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

First published (updated )
CVE-2026-39792

WordPress Document GalleryWordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1.1 versions.

First published (updated )
CVE-2026-39781

WordPress Tabs pluginWordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Risk 65
Severity
8
Code Injection
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

First published (updated )
CVE-2026-39776

WordPress ChallanWordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Risk 66
Severity
7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

First published (updated )
CVE-2026-39765

WordPress Jobs for WordPressWordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

Risk 44
Severity
7.7
Path Traversal
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

First published (updated )
CVE-2026-39752

WordPress WofficeWordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

Risk 55
Severity
8.5
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

First published (updated )
CVE-2026-39747

WordPress Database for CF7WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

First published (updated )
CVE-2026-39731

WordPress Instapage PluginWordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

Risk 44
Severity
7.2
SSRF
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

First published (updated )
CVE-2026-39728

WordPress HTTP Requests ManagerWordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

First published (updated )
CVE-2026-39724

WordPress PDF Smart Viewer for ElementorWordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Risk 44
Severity
7.2
SSRF
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

First published (updated )
CVE-2026-39719

WordPress WooCommerce LotteryWordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

Risk 51
Severity
7.5
SQL Injection
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

First published (updated )
CVE-2026-32580

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203