WordPress vulnerabilities

Latest WordPress CVEs

Newest publication first · page 24 of 40 · showing the latest 1,000

1. CVE-2026-122001 Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF

   Published 2026-11-07

   High·CVSS 8.8 EPSS 0.13%

   The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create...

2. CVE-2026-121866 Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update

   Published 2026-11-07

   High·CVSS 8.8 EPSS 0.23%

   The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate...

3. CVE-2026-121858 Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search

   Published 2026-11-07

   Medium·CVSS 6.3 EPSS 0.18%

   The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its...

4. CVE-2026-121857 Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend

   Published 2026-11-07

   Medium·CVSS 4.2 EPSS 0.12%

   The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner Wor...

5. CVE-2026-121796 Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload

   Published 2026-11-07

   Medium·CVSS 6.8 EPSS 0.29%

   The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

6. CVE-2026-121492 Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.22%

   The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms w...

7. CVE-2026-121848 Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation

   Published 2026-11-07

   High·CVSS 8.8 EPSS 0.29%

   The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.

8. CVE-2026-118534 Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR

   Published 2026-11-07

   Medium·CVSS 4.3 EPSS 0.19%

   The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to creat...

9. CVE-2026-121379 Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

   Published 2026-11-07

   Critical·CVSS 9.6 EPSS 0.30%

   The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-c...

10. CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

    Published 2026-11-07

    Critical·CVSS 9.0 EPSS 0.40%

    The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled an...

11. CVE-2026-121380 Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

    Published 2026-11-07

    Medium·CVSS 5.3 EPSS 0.25%

    The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

12. CVE-2026-119073 Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination

    Published 2026-11-07

    Medium·CVSS 6.8 EPSS 0.29%

    The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

13. CVE-2026-118532 Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field

    Published 2026-11-07

    Medium·CVSS 6.5 EPSS 0.24%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete...

14. CVE-2026-118529 Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout

    Published 2026-11-07

    Low·CVSS 3.1 EPSS 0.16%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature an...

15. CVE-2026-118528 Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR

    Published 2026-11-07

    Medium·CVSS 4.3 EPSS 0.20%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level a...

16. CVE-2026-118530 Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action

    Published 2026-11-07

    Medium·CVSS 5.0 EPSS 0.21%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the networ...

17. CVE-2026-118533 Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt

    Published 2026-11-07

    Medium·CVSS 4.3 EPSS 0.20%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and pa...

18. CVE-2025-15708 Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug

    Published 2026-11-07

    Low·CVSS 3.5 EPSS 0.17%

    The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilte...

19. CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

    Published 2026-11-07

    Low·CVSS 2.7 EPSS 0.17%

    The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted...

20. CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

    Published 2026-11-07

    Low·CVSS 2.7 EPSS 0.17%

    The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a refe...

21. CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

    Published 2026-11-07

    Low·CVSS 2.7 EPSS 0.19%

    The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuse...

22. CVE-2026-117525 FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

    Published 2026-11-07

    High·CVSS 7.5 EPSS 0.25%

    The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the s...

23. CVE-2026-117588 WP Google Review Slider < 18.11 - Google API Settings Update via CSRF

    Published 2026-11-07

    Medium·CVSS 4.3 EPSS 0.11%

    The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into foll...

24. CVE-2026-120043 Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter

    Published 2026-11-07

    High·CVSS 7.5 EPSS 0.40%

    The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

25. CVE-2026-110534 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name

    Published 2026-11-07

    Medium·CVSS 6.4 EPSS 0.26%

    The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subs...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.