Title	CVE ID	CVSS	Vector	Date
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-59553	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 24, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-65510	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 23, 2026
Participants Database <= 2.7.8.3 - Unauthenticated Arbitrary File Deletion	CVE-2026-59555	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	July 22, 2026
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion	CVE-2026-57696	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	July 20, 2026
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-61947	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 16, 2026
Booking and Rental Manager <= 2.6.9 - Missing Authorization	CVE-2026-57404	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 8, 2026
SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion	CVE-2026-57401	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	July 8, 2026
Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting	CVE-2026-57402	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 8, 2026
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57409	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 8, 2026
WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection	CVE-2026-57371	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 7, 2026
Booktics <= 1.0.21 - Unauthenticated PHP Object Injection	CVE-2026-57621	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	June 29, 2026
Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-42663	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	May 3, 2026
WP Custom Admin Interface <= 7.42 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2026-32521	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	March 20, 2026
TotalPoll for Polls and Contests <= 4.12.0 - Authenticated (Contributor+) Remote Code Execution	CVE-2026-27044	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	March 16, 2026
Photo Contest \| Competition \| Video Contest <= 2.9.1 - Authenticated (Author+) PHP Object Injection	CVE-2026-0677	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	March 10, 2026
Educare <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2025-67978	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	January 28, 2026
Wired Impact Volunteer Management <= 2.8 - Missing Authorization	CVE-2026-24997	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	January 24, 2026
WP Docs <= 2.2.8 - Missing Authorization	CVE-2026-24990	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	January 21, 2026
RealPress – Real Estate Plugin <= 1.1.0 - Cross-Site Request Forgery	CVE-2026-27050	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	January 13, 2026
Delay Redirects <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2026-24632	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	January 9, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation