2026 CVEs (page 553)
Page 553 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39671 | High | 7.1 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Reque… |
CVE-2026-39670 | Medium | 6.0 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual… |
CVE-2026-39669 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a… |
CVE-2026-39668 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-39667 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.T… |
CVE-2026-39666 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Bas… |
CVE-2026-39665 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DO… |
CVE-2026-39664 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39663 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39662 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorre… |
CVE-2026-39658 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39657 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39656 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-39654 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitema… |
CVE-2026-39653 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configure… |
CVE-2026-39652 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39651 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-39650 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39649 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39648 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-39647 | Medium | 5.4 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side… |
CVE-2026-39646 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This iss… |
CVE-2026-39645 | Medium | 5.4 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.T… |
CVE-2026-39644 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39643 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2026-39641 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a thro… |
CVE-2026-39640 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a throu… |
CVE-2026-39639 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-39638 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affect… |
CVE-2026-39637 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from… |
CVE-2026-39636 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-element… |
CVE-2026-39635 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine… |
CVE-2026-39634 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfol… |
CVE-2026-39633 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Re… |
CVE-2026-39632 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a th… |
CVE-2026-39631 | Medium | 4.9 | 2026-04-08 | Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39630 | Medium | 6.4 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images… |
CVE-2026-39629 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affect… |
CVE-2026-39628 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issu… |
CVE-2026-39627 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from… |
CVE-2026-39626 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affe… |
CVE-2026-39625 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affe… |
CVE-2026-39624 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bi… |
CVE-2026-39623 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP… |
CVE-2026-39622 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39621 | High | 8.8 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: f… |
CVE-2026-39620 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appoint… |
CVE-2026-39619 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: fro… |
CVE-2026-39618 | Medium | 4.3 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <=… |
CVE-2026-39617 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from… |
CVE-2026-39616 | Medium | 5.3 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2026-39615 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored… |
CVE-2026-39614 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39613 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allo… |
CVE-2026-39612 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39611 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PH… |
CVE-2026-39610 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39609 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39608 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39607 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-39606 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-39605 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39604 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored… |
CVE-2026-39603 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Pho… |
CVE-2026-39602 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39592 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-39588 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Ac… |
CVE-2026-39586 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This i… |
CVE-2026-39585 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics… |
CVE-2026-39575 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapp… |
CVE-2026-39572 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-… |
CVE-2026-39571 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Dat… |
CVE-2026-39570 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive… |
CVE-2026-39569 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39566 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedde… |
CVE-2026-39565 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-39564 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive… |
CVE-2026-39563 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39562 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-39561 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39544 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows P… |
CVE-2026-39543 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-39542 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensi… |
CVE-2026-39541 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-39538 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core… |
CVE-2026-39536 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Se… |
CVE-2026-39535 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-39528 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39526 | Medium | 5.4 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-39521 | Medium | 4.9 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Cont… |
CVE-2026-39520 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs… |
CVE-2026-39517 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.Th… |
CVE-2026-39516 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retr… |
CVE-2026-39510 | Low | 2.7 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting… |
CVE-2026-39509 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39508 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons ad… |
CVE-2026-39506 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39505 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-39504 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39501 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |