Title	CVE ID	CVSS	Vector	Date
NewsPlus Shortcodes <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57798	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
TheGem Theme Elements <= 5.11.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57804	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Aalto <= 1.8 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57788	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
SetSail - Travel Agency WordPress Theme <= 2.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57801	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Struktur - Creative Agency WordPress Theme <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57802	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Nuss - Hotel Booking WordPress <= 1.3.6 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57799	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Overworld - eSports and Gaming WordPress Theme <= 1.5 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57800	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Flow <= 1.8 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57793	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Brook - Agency Business Creative WordPress Theme <= 2.9.0 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57791	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Aqua <= 5.1.2 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57789	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Billey <= 2.1.8 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57790	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Golo Framework <= 1.7.3 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57794	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Kitchor <= 1.4.3 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57795	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Leedo <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57796	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Tonda <= 2.5 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57805	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Struktur Core <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57803	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
Dør - Modern Architecture and Interior Design Theme <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion	CVE-2026-57792	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 2, 2026
WPeMatico RSS Feed Fetcher <= 2.8.17 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57349	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 1, 2026
SpaLab \| Beauty Salon WordPress <= 6.7 - Unauthenticated Stored Cross-Site Scripting	CVE-2025-69154	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	June 30, 2026
Trendy Travel <= 6.7 - Reflected Cross-Site Scripting	CVE-2025-69153	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	June 30, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation