Title	CVE ID	CVSS	Vector	Date
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service	CVE-2026-81285	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	August 27, 2026
Easy Elementor Addons – Addons Pack for Elementor Page Builder <= 2.3.7 - Cross-Site Request Forgery	CVE-2026-28164	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	August 20, 2026
WPComplete <= 2.9.5.6 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-66599	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 20, 2026
Smart Popup by Supsystic <= 1.13.0 - Missing Authorization	CVE-2026-73381	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 18, 2026
Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass	CVE-2026-73379	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 18, 2026
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection	CVE-2026-73376	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	August 18, 2026
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-73375	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 18, 2026
Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization	CVE-2026-73377	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 18, 2026
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection	CVE-2026-73380	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	August 18, 2026
Contact Form by Supsystic < 1.10.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-73378	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 18, 2026
Breeze Cache <= 2.5.12 - Missing Authorization to Unauthenticated Arbitrary Content Deletion	CVE-2026-73356	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 14, 2026
Kadence Starter Templates — Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service	CVE-2026-73997	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	August 14, 2026
Travelfic Toolkit <= 1.5.1 - Missing Authorization	CVE-2026-28186	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 13, 2026
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2026-28182	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 13, 2026
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization	CVE-2026-28181	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 13, 2026
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting	CVE-2026-73357	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 12, 2026
Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection	CVE-2026-28149	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	August 12, 2026
Smart Online Order for Clover <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-66700	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 10, 2026
SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-66698	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 10, 2026
Colissimo shipping methods for WooCommerce <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-66697	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 10, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation