Title	CVE ID	CVSS	Vector	Date
Gillion <= 4.13 - Missing Authorization	CVE-2026-66477	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 27, 2026
Mailster - Email Newsletter Plugin for WordPress <= 4.1.17 - Authenticated (Editor+) Arbitrary File Upload	CVE-2026-27064	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	July 22, 2026
ListingPro Plugin <= 2.9.10 - Missing Authorization	CVE-2026-65478	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
Reviewer <= 3.14.2 - Missing Authorization	CVE-2026-65479	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
QuickCal <= 1.0.16 - Missing Authorization	CVE-2026-27377	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
Photography <= 7.7.6 - Missing Authorization	CVE-2026-65487	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
WorkScout-Core <= 1.7.08 - Cross-Site Request Forgery	CVE-2026-57786	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 2, 2026
Booked - Appointment Booking for WordPress <= 3.0.0 - Cross-Site Request Forgery	CVE-2026-57747	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	July 2, 2026
Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization	CVE-2026-57746	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 2, 2026
ez Form Calculator Premium <= 2.14.1.2 - Missing Authorization	CVE-2026-57750	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 2, 2026
CWS SVGicons <= 1.5.5 - Authenticated (Contributor+) SQL Injection	CVE-2026-57787	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	July 2, 2026
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.0 - Authenticated (Contributor+) PHP Object Injection	CVE-2026-27060	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	June 30, 2026
BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference	CVE-2025-66123	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	June 26, 2026
BookPro <= 1.1.0 - Unauthenticated Arbitrary File Deletion	CVE-2026-27400	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	June 12, 2026
Booknetic <= 4.8.5 - Missing Authorization	CVE-2026-25439	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	June 1, 2026
Support Board < 3.8.9 - Unauthenticated Privilege Escalation	CVE-2026-27395	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 1, 2026
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation	CVE-2026-27407	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	May 28, 2026
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Unauthenticated PHP Object Injection	CVE-2026-27053	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	May 28, 2026
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 - Unauthenticated PHP Object Injection	CVE-2026-27333	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	May 28, 2026
Support Ticket Management System <= 1.9 - Unauthenticated Privilege Escalation	CVE-2025-69179	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 28, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation