WordPress.com vulnerabilities

Products

• eShipper Commerce 1
• Gutenverse Form 1
• Quick Interest Slider 1

Latest WordPress.com CVEs

Newest publication first

1. CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

   Published 2026-08-20

   High·CVSS 8.5 EPSS 0.36%

   Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

2. CVE-2026-56040 WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-06-26

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

3. CVE-2026-56039 WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-06-26

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.