tag
Ajax
Critical
WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)
CVE-2025-12057·
WavePlayer (WordPress plugin)
unpatched
High
YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937
CVE-2026-1937·
YayMail – WooCommerce Email Customizer plugin for WordPress
unpatched
High
WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415
CVE-2026-5415·
WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA)
unpatched
Critical
WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)
CVE-2026-12416, CVE-2026-12417·
SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416)
unpatched
Critical
WebStack WordPress Theme Unauthenticated Arbitrary File Upload RCE — CVE-2026-1555
CVE-2026-1555·
WebStack theme for WordPress
unpatched
Critical
User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492)
CVE-2026-1492·
User Registration & Membership WordPress plugin (Custom Registration Form Builder, Login Form, User Profile, Content Restriction & Membership)
unpatched
High
Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912
CVE-2026-11912·
Simple File List WordPress plugin
patched
High
Schema & Structured Data for WP & AMP Unauthenticated Unrestricted File Upload (CVE-2026-9067)
CVE-2026-9067·
Schema & Structured Data for WP & AMP (WordPress plugin, schema-and-structured-data-for-wp)
unpatched
High
Prodigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)
CVE-2026-0926·
Prodigy Commerce (WordPress plugin)
unpatched
High
OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417
CVE-2026-24417·
OpenSTAManager (devcode-it/openstamanager)
patched
High
OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416
CVE-2026-24416·
OpenSTAManager (devcode-it/openstamanager)
patched
Critical
midi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306)
CVE-2026-1306·
midi-Synth WordPress plugin
unpatched
High
LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083)
CVE-2026-49083·
LatePoint Calendar Booking plugin for WordPress
unpatched
Critical
LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)
CVE-2026-0920·
LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit)
unpatched
High
JetSearch WordPress Plugin Unauthenticated SQL Injection (CVE-2026-49079)
CVE-2026-49079·
JetSearch plugin for WordPress
unpatched
Medium
EventPrime WordPress Plugin Unauthenticated Arbitrary File Upload — CVE-2026-1657
CVE-2026-1657·
EventPrime (WordPress plugin)
patched
High
Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018)
CVE-2026-9018·
Easy Elements for Elementor – Addons & Website Templates (easy-elements WordPress plugin)
patched
Medium
Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036)
CVE-2026-34036·
Dolibarr ERP/CRM
unpatched
Critical
AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729
CVE-2026-1729·
AdForest theme for WordPress
unpatched