Title	CVE ID	CVSS	Vector	Date
Shirt Product Designer for WooCommerce 1.0.4 - Missing Authorization	CVE-2026-81794	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	September 9, 2026
Premium Packages – Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-73190	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 18, 2026
MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting	CVE-2026-66655	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 11, 2026
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization	CVE-2026-66453	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 7, 2026
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization	CVE-2026-66451	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 5, 2026
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder < 2.9.1 - Authenticated (Contributor+) Privilege Escalation	CVE-2026-57386	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 7, 2026
ElementInvader Addons for Elementor <= 1.4.3 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57376	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 7, 2026
iNET Webkit 1.2.4 - Authenticated (Contributor+) SQL Injection	CVE-2026-57752	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	July 2, 2026
WPAdverts – Classifieds Plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57366	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 1, 2026
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 - Reflected Cross-Site Scripting	CVE-2026-57357	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 1, 2026
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization	CVE-2026-57332	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 29, 2026
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 - Unauthenticated SQL Injection	CVE-2026-54819	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	June 17, 2026
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization	CVE-2026-48969	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 3, 2026
Product Filter Widget for Elementor <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-45437	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	June 1, 2026
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-42683	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	May 20, 2026
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization	CVE-2026-42671	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	May 13, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization	CVE-2026-42669	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	May 12, 2026
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.14 - Missing Authorization	CVE-2026-42670	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	May 12, 2026
Salon Booking System – Free Version <= 10.30.25 - Missing Authorization	CVE-2026-42666	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	May 10, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation