tag
Plugin
High
YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937
CVE-2026-1937·
YayMail – WooCommerce Email Customizer plugin for WordPress
unpatched
High
WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415
CVE-2026-5415·
WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA)
unpatched
High
WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180
CVE-2026-3180·
WordPress "Contest Gallery" plugin
unpatched
Critical
WordPress "Import and Export Users and Customers" Plugin Privilege Escalation (CVE-2026-3629)
CVE-2026-3629·
Import and Export Users and Customers (WordPress plugin)
unpatched
Critical
WooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540)
CVE-2026-27542 (bundled with CVE-2026-27540)·
WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress
unpatched
Critical
UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)
CVE-2026-10795·
UpdraftPlus (WordPress backup plugin) — UpdraftCentral remote RPC feature
unpatched
Critical
Snow Monkey Forms — Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)
CVE-2026-1056·
Snow Monkey Forms (WordPress plugin)
unpatched
High
Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912
CVE-2026-11912·
Simple File List WordPress plugin
patched
High
Prodigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)
CVE-2026-0926·
Prodigy Commerce (WordPress plugin)
unpatched
High
Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)
CVE-2026-4350·
Perfmatters WordPress plugin
unpatched
Medium
NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)
CVE-2026-3228·
NextScripts: Social Networks Auto-Poster (WordPress plugin)
unpatched
High
LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083)
CVE-2026-49083·
LatePoint Calendar Booking plugin for WordPress
unpatched
Critical
LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)
CVE-2026-0920·
LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit)
unpatched
High
Hustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911)
CVE-2026-0911·
Hustle (wordpress-popup) plugin by WPMU DEV
unpatched
Critical
Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)
CVE-2026-10580·
Hippoo Mobile App for WooCommerce (WordPress plugin)
unpatched
Medium
ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600·
ElementsKit Elementor Addons (WordPress plugin)
patched
Critical
Branda White Label & Branding Plugin Unauthenticated Account Takeover — CVE-2026-11551
CVE-2026-11551·
Branda White Label & Branding WordPress plugin
patched