https://vulnogram.org/ Most recent CVEs assigned by Wordfence (wordfence). https://vulnogram.org/seaview/icons/wordfence.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-82814 https://vulnogram.org/CVE-2026-82814 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeT… High Wed, 21 Oct 2026 01:30:35 GMT https://vulnogram.org/CVE-2026-93878 https://vulnogram.org/CVE-2026-93878 The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for… Medium Tue, 20 Oct 2026 06:54:42 GMT https://vulnogram.org/CVE-2026-93300 https://vulnogram.org/CVE-2026-93300 The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation… High Tue, 20 Oct 2026 05:39:17 GMT https://vulnogram.org/CVE-2026-111862 https://vulnogram.org/CVE-2026-111862 Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin… Critical Mon, 19 Oct 2026 16:35:59 GMT https://vulnogram.org/CVE-2026-110253 https://vulnogram.org/CVE-2026-110253 The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and i… Medium Sat, 17 Oct 2026 07:51:25 GMT https://vulnogram.org/CVE-2026-100316 https://vulnogram.org/CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping.… High Sat, 17 Oct 2026 07:51:25 GMT https://vulnogram.org/CVE-2026-109983 https://vulnogram.org/CVE-2026-109983 The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible… Medium Sat, 17 Oct 2026 07:51:25 GMT https://vulnogram.org/CVE-2026-111110 https://vulnogram.org/CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization… High Sat, 17 Oct 2026 07:51:24 GMT https://vulnogram.org/CVE-2026-92798 https://vulnogram.org/CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), wh… High Sat, 17 Oct 2026 03:43:31 GMT https://vulnogram.org/CVE-2026-103899 https://vulnogram.org/CVE-2026-103899 The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This… High Sat, 17 Oct 2026 03:43:30 GMT https://vulnogram.org/CVE-2026-109989 https://vulnogram.org/CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible fo… Medium Sat, 17 Oct 2026 03:43:30 GMT https://vulnogram.org/CVE-2026-107744 https://vulnogram.org/CVE-2026-107744 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorize… Medium Sat, 17 Oct 2026 03:43:30 GMT https://vulnogram.org/CVE-2026-111726 https://vulnogram.org/CVE-2026-111726 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for… Medium Sat, 17 Oct 2026 03:43:29 GMT https://vulnogram.org/CVE-2026-108123 https://vulnogram.org/CVE-2026-108123 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This ma… High Sat, 17 Oct 2026 03:43:29 GMT https://vulnogram.org/CVE-2026-92978 https://vulnogram.org/CVE-2026-92978 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… Medium Sat, 17 Oct 2026 03:43:29 GMT https://vulnogram.org/CVE-2026-109369 https://vulnogram.org/CVE-2026-109369 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This ma… Medium Sat, 17 Oct 2026 03:43:28 GMT https://vulnogram.org/CVE-2026-96660 https://vulnogram.org/CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all… High Sat, 17 Oct 2026 03:43:28 GMT https://vulnogram.org/CVE-2026-104736 https://vulnogram.org/CVE-2026-104736 The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed… Critical Sat, 17 Oct 2026 03:43:28 GMT https://vulnogram.org/CVE-2026-109368 https://vulnogram.org/CVE-2026-109368 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-le… Medium Sat, 17 Oct 2026 03:43:27 GMT https://vulnogram.org/CVE-2026-92715 https://vulnogram.org/CVE-2026-92715 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This ma… Medium Sat, 17 Oct 2026 03:43:27 GMT https://vulnogram.org/CVE-2026-107752 https://vulnogram.org/CVE-2026-107752 The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user sup… Medium Sat, 17 Oct 2026 03:43:27 GMT https://vulnogram.org/CVE-2026-109985 https://vulnogram.org/CVE-2026-109985 The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and… Medium Sat, 17 Oct 2026 03:43:26 GMT https://vulnogram.org/CVE-2026-110268 https://vulnogram.org/CVE-2026-110268 The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level acce… Medium Sat, 17 Oct 2026 03:43:26 GMT https://vulnogram.org/CVE-2026-111602 https://vulnogram.org/CVE-2026-111602 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes… Low Sat, 17 Oct 2026 02:31:07 GMT https://vulnogram.org/CVE-2026-110653 https://vulnogram.org/CVE-2026-110653 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write… Critical Sat, 17 Oct 2026 02:31:06 GMT https://vulnogram.org/CVE-2026-109208 https://vulnogram.org/CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 du… High Sat, 17 Oct 2026 02:31:06 GMT https://vulnogram.org/CVE-2026-111601 https://vulnogram.org/CVE-2026-111601 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This make… Medium Sat, 17 Oct 2026 02:31:06 GMT https://vulnogram.org/CVE-2026-104734 https://vulnogram.org/CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated a… High Sat, 17 Oct 2026 02:31:05 GMT https://vulnogram.org/CVE-2026-107762 https://vulnogram.org/CVE-2026-107762 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user control… High Sat, 17 Oct 2026 02:31:05 GMT https://vulnogram.org/CVE-2026-107763 https://vulnogram.org/CVE-2026-107763 The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f… Medium Sat, 17 Oct 2026 02:31:04 GMT https://vulnogram.org/CVE-2026-97470 https://vulnogram.org/CVE-2026-97470 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to in… Medium Fri, 16 Oct 2026 13:28:15 GMT https://vulnogram.org/CVE-2026-107648 https://vulnogram.org/CVE-2026-107648 The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, an… High Fri, 16 Oct 2026 11:28:51 GMT https://vulnogram.org/CVE-2026-107649 https://vulnogram.org/CVE-2026-107649 The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it pos… Medium Fri, 16 Oct 2026 09:26:38 GMT https://vulnogram.org/CVE-2026-110703 https://vulnogram.org/CVE-2026-110703 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient inp… Medium Fri, 16 Oct 2026 09:26:37 GMT https://vulnogram.org/CVE-2026-96768 https://vulnogram.org/CVE-2026-96768 The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for… High Fri, 16 Oct 2026 09:26:36 GMT https://vulnogram.org/CVE-2026-104003 https://vulnogram.org/CVE-2026-104003 The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which i… Medium Fri, 16 Oct 2026 08:27:43 GMT https://vulnogram.org/CVE-2026-92766 https://vulnogram.org/CVE-2026-92766 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack… High Fri, 16 Oct 2026 08:27:42 GMT https://vulnogram.org/CVE-2026-104726 https://vulnogram.org/CVE-2026-104726 The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for aut… Medium Fri, 16 Oct 2026 08:27:42 GMT https://vulnogram.org/CVE-2026-109224 https://vulnogram.org/CVE-2026-109224 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and includi… High Fri, 16 Oct 2026 08:27:42 GMT https://vulnogram.org/CVE-2026-93681 https://vulnogram.org/CVE-2026-93681 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping.… Medium Fri, 16 Oct 2026 08:27:41 GMT https://vulnogram.org/CVE-2026-111311 https://vulnogram.org/CVE-2026-111311 The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload func… High Fri, 16 Oct 2026 08:27:40 GMT https://vulnogram.org/CVE-2026-96870 https://vulnogram.org/CVE-2026-96870 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output esc… Medium Fri, 16 Oct 2026 07:44:03 GMT https://vulnogram.org/CVE-2026-100108 https://vulnogram.org/CVE-2026-100108 The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This mak… Medium Fri, 16 Oct 2026 07:44:03 GMT https://vulnogram.org/CVE-2026-100106 https://vulnogram.org/CVE-2026-100106 The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping.… Medium Fri, 16 Oct 2026 07:44:02 GMT https://vulnogram.org/CVE-2026-75903 https://vulnogram.org/CVE-2026-75903 The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the… High Fri, 16 Oct 2026 07:44:02 GMT https://vulnogram.org/CVE-2026-87111 https://vulnogram.org/CVE-2026-87111 The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insuffici… High Fri, 16 Oct 2026 07:44:01 GMT https://vulnogram.org/CVE-2026-92115 https://vulnogram.org/CVE-2026-92115 The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping wit… High Fri, 16 Oct 2026 06:41:08 GMT https://vulnogram.org/CVE-2026-15222 https://vulnogram.org/CVE-2026-15222 The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an… Medium Fri, 16 Oct 2026 06:41:08 GMT https://vulnogram.org/CVE-2026-109401 https://vulnogram.org/CVE-2026-109401 The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level acce… Low Fri, 16 Oct 2026 06:41:07 GMT https://vulnogram.org/CVE-2026-97640 https://vulnogram.org/CVE-2026-97640 The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (… High Fri, 16 Oct 2026 06:41:07 GMT