Title	CVE ID	CVSS	Vector	Date
YITH WooCommerce Zoom Magnifier <= 2.52.0 - Unauthenticated Information Exposure	CVE-2026-28169	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	August 5, 2026
Create <= 2.6.0 - Unauthenticated Sensitive Information Exposure	CVE-2026-65490	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	July 22, 2026
YT Player – Embed and Customize Video Players <= 2.0.9 - Missing Authorization	CVE-2026-27422	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
WP Fast Total Search – The Power of Indexed Search <= 1.81.282 - Missing Authorization	CVE-2026-27418	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.6.5 - Missing Authorization	CVE-2026-65485	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
Event Post <= 6.1.0 - Missing Authorization	CVE-2026-65486	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
Query Wrangler <= 1.5.57 - Missing Authorization	CVE-2026-65491	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 22, 2026
ShinyStat Analytics 1.0.12 - 1.0.17 - Unauthenticated Information Exposure	CVE-2026-11351	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	July 8, 2026
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure	CVE-2026-27349	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	May 21, 2026
Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization	CVE-2026-27424	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	May 20, 2026
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization	CVE-2026-25440	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	April 22, 2026
FOX <= 1.4.5 - Missing Authorization	CVE-2026-39501	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	March 27, 2026
Instantio <= 3.3.30 - Unauthenticated Information Exposure	CVE-2026-39571	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	March 25, 2026
Premmerce Redirect Manager <= 1.0.12 - Missing Authorization	CVE-2026-32541	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	March 20, 2026
Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection	CVE-2026-24993	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	March 18, 2026
Doofinder for WooCommerce <= 2.10.13 - Unauthenticated Information Exposure	CVE-2026-39542	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	March 13, 2026
Filr – Secure document library <= 1.2.13 - Authenticated (Contributor+) Arbitrary File Uploads	CVE-2026-28133	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	February 26, 2026
Advanced WooCommerce Product Sales Reporting <= 4.1.2 - Unauthenticated Information Exposure	CVE-2026-24992	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	January 23, 2026
Broadstreet Ads <= 1.52.1 - Missing Authorization	CVE-2025-69311	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	January 19, 2026
Travelfic Toolkit <= 1.3.3 - Missing Authorization	CVE-2026-24940	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 26, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation