Title	CVE ID	CVSS	Vector	Date
Breakdance <= 2.6.1 - Missing Authorization	CVE-2026-65551	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 28, 2026
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 - Missing Authorization	CVE-2026-65502	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 28, 2026
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2026-65449	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 22, 2026
Appointment Booking Plugin for WooCommerce – WpBookingly \| All-in-One Service Manager <= 1.2.9 - Missing Authorization	CVE-2026-25444	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	May 26, 2026
Travelly – Tour & Travel Booking Manager for WooCommerce \| Tour & Hotel Booking Solution <= 2.1.5 - Missing Authorization	CVE-2026-27331	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	May 26, 2026
File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal	CVE-2026-25397	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 23, 2026
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 - Missing Authorization	CVE-2026-25327	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 23, 2026
Contact Manager <= 9.1 - Reflected Cross-Site Scripting	CVE-2026-32517	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 23, 2026
VikRestaurants Table Reservations and Take-Away <= 1.5.2 - Reflected Cross-Site Scripting	CVE-2026-25025	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 23, 2026
WP Telegram Widget and Join Link <= 2.2.13 - Reflected Cross-Site Scripting	CVE-2026-23807	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 23, 2026
RSFirewall! <= 1.1.45 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-25341	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	March 23, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting	CVE-2026-25383	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 23, 2026
Bit SMTP – Easy SMTP Solution with Email Logs <= 1.2.2 - Missing Authorization	CVE-2026-32519	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 20, 2026
Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting	CVE-2026-25361	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 20, 2026
Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization	CVE-2026-25317	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 18, 2026
Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite	CVE-2026-1217	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	March 17, 2026
Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter	CVE-2026-3512	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 17, 2026
Automated FedEx live/manual rates with shipping labels – HPOS supported <= 5.1.8 - Missing Authorization	CVE-2026-25456	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 17, 2026
WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter	CVE-2026-3222	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	March 10, 2026
WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection	CVE-2026-1644	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	March 6, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation