Title	CVE ID	CVSS	Vector	Date
Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection	CVE-2025-68060	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	May 7, 2026
Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download	CVE-2026-40724	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	April 16, 2026
Datalogics Ecommerce Delivery – Datalogics <= 2.6.62 - Unauthenticated Privilege Escalation	CVE-2026-39583	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 8, 2026
WP BASE Booking of Appointments, Services and Events <= 5.9.0 - Unauthenticated Privilege Escalation	CVE-2026-39587	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 8, 2026
WP-BusinessDirectory – Business directory plugin for WordPress <= 4.0.0 - Authenticated (Subscriber+) Arbitrary File Upload	CVE-2026-39591	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	April 8, 2026
iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation	CVE-2026-34901	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	April 7, 2026
Lumise Product Designer < 2.0.9 - Unauthenticated SQL Injection	CVE-2026-25371	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	March 20, 2026
Wishlist Member <= 3.29.0 - Authenticated (Subscriber+) Arbitrary File Upload	CVE-2026-25446	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	March 18, 2026
Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion	CVE-2026-25443	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	March 18, 2026
Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 - Reflected Cross-Site Scripting	CVE-2026-25438	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 18, 2026
ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution	CVE-2026-25470	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	March 16, 2026
Addi – Cuotas que se adaptan a ti <= 2.0.4 - Missing Authorization	CVE-2026-27073	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 10, 2026
ionCube Tester Plus <= 1.3 - Unauthenticated Arbitrary File Download	CVE-2025-69411	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	March 4, 2026
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting	CVE-2025-69324	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	February 4, 2026
AppExperts <= 1.4.5 - Authenticated (Subscriber+) SQL Injection	CVE-2025-68881	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	January 22, 2026
Fraud Prevention For Woocommerce <= 2.3.2 - Authenticated (Subscriber+) Information Exposure	CVE-2026-24553	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	January 22, 2026
Dinatur <= 1.18 - Unauthenticated Stored Cross-Site Scripting	CVE-2025-68866	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	January 21, 2026
Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection	CVE-2025-68017	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	January 16, 2026
Audiomack <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2025-49357	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	December 31, 2025
Curator.io <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2025-62742	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	December 31, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation