Wordpress-Plugin

WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901) newCVE-2025-49901webCRITICAL 9.8Patched2026-07-06StoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441) new EPSS 39%CVE-2025-7441webCRITICAL 9.8Unpatched2026-07-06Simple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580) newCVE-2025-53580webCRITICAL 9.8Patched2026-07-06RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209) newCVE-2025-9209webCRITICAL 9.8Unpatched2026-07-06GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777) newCVE-2025-22777webCRITICAL 9.8Patched2026-07-06Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342) newCVE-2025-13342webCRITICAL 9.8Patched2026-07-06WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791) newCVE-2026-40791webHIGH 7.2Patched2026-07-05WordPress Download Manager 3.3.5.2 — Unauthenticated IDOR (CVE-2026-39676) newCVE-2026-39676webMEDIUMUnverified2026-07-05WordPress Breeze Cache Plugin — Unauthenticated Arbitrary File Upload (CVE-2026-3844) new EPSS 28%CVE-2026-3844webCRITICALUnverified2026-07-05User Registration Advanced Fields WordPress Plugin Unauthenticated Arbitrary File Upload (CVE-2026-4882) newCVE-2026-4882webCRITICAL 9.8Unverified2026-07-05Piotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload RCE (CVE-2026-4885) newCVE-2026-4885webCRITICALUnverified2026-07-05Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776) newCVE-2026-40776 / Patchstack PSID 85de025d71e7webHIGH 7.5Patched2026-07-05