{"items":[{"id":"CVE-2026-125836","published":"2026-11-12T07:37:39.738Z","updated":"2026-11-12T07:38:39.567Z","title":"WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Nicu Micle","product":"Simple JWT Login","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125785","published":"2026-11-12T00:12:02.005Z","updated":"2026-11-12T00:13:02.392Z","title":"WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125786","published":"2026-11-12T00:11:00.501Z","updated":"2026-11-12T00:12:01.381Z","title":"WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125787","published":"2026-11-12T00:09:32.263Z","updated":"2026-11-12T00:10:32.490Z","title":"WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ExpressTech","product":"Quiz And Survey Master","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125838","published":"2026-11-11T13:47:25.031Z","updated":"2026-11-11T15:04:51.234Z","title":"WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Quality","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125839","published":"2026-11-11T13:46:29.120Z","updated":"2026-11-11T15:05:10.463Z","title":"WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"ElitePress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125840","published":"2026-11-11T13:44:59.478Z","updated":"2026-11-11T15:05:26.455Z","title":"WordPress Rambo theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Rambo","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125841","published":"2026-11-11T13:44:01.109Z","updated":"2026-11-11T15:05:44.439Z","title":"WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Heroic","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125842","published":"2026-11-11T13:39:46.424Z","updated":"2026-11-11T15:06:00.860Z","title":"WordPress Wallstreet Agency theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Wallstreet Agency","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125843","published":"2026-11-11T13:26:16.081Z","updated":"2026-11-11T13:46:47.119Z","title":"WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Spasalon","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125844","published":"2026-11-11T13:25:35.957Z","updated":"2026-11-11T13:49:26.123Z","title":"WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"vice","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125845","published":"2026-11-11T13:24:44.320Z","updated":"2026-11-11T13:49:26.275Z","title":"WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"vdequator","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125846","published":"2026-11-11T13:23:57.338Z","updated":"2026-11-11T13:49:26.433Z","title":"WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Mazino","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125847","published":"2026-11-11T13:23:23.134Z","updated":"2026-11-11T13:47:56.953Z","title":"WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"vdperanto","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125848","published":"2026-11-11T13:22:44.427Z","updated":"2026-11-11T13:49:26.586Z","title":"WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Leo","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125849","published":"2026-11-11T13:21:29.942Z","updated":"2026-11-11T13:49:26.773Z","title":"WordPress Shk Corporate theme <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Shk Corporate","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125850","published":"2026-11-11T13:16:11.697Z","updated":"2026-11-11T13:49:26.962Z","title":"WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"webriti","product":"Appointment Dark","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125046","published":"2026-11-11T13:02:24.506Z","updated":"2026-11-11T15:06:16.899Z","title":"WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"John-Michael L'Allier","product":"Create","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125708","published":"2026-11-11T13:01:17.688Z","updated":"2026-11-11T13:42:15.014Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125746","published":"2026-11-11T13:00:40.487Z","updated":"2026-11-11T15:06:32.648Z","title":"WordPress Back In Stock Notifier for WooCommerce plugin <= 7.5.2 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ProPluginsLab","product":"Back In Stock Notifier for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125454","published":"2026-11-11T12:59:38.477Z","updated":"2026-11-11T13:42:31.161Z","title":"WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP Chill","product":"Passster","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125767","published":"2026-11-11T12:53:23.741Z","updated":"2026-11-11T15:06:48.807Z","title":"WordPress Hubbub Lite plugin <= 1.36.3.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NerdPress","product":"Hubbub Lite","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125766","published":"2026-11-11T12:42:38.734Z","updated":"2026-11-11T15:07:05.321Z","title":"WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPZOOM","product":"WPZOOM Social Feed Widget & Block","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123480","published":"2026-11-11T12:41:33.649Z","updated":"2026-11-11T13:42:47.382Z","title":"WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Fullworks Plugins","product":"Display Eventbrite Events","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125448","published":"2026-11-11T12:41:11.637Z","updated":"2026-11-11T15:07:24.388Z","title":"WordPress Kali Forms plugin <= 2.4.31 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kaliforms","product":"Kali Forms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123481","published":"2026-11-11T12:40:46.952Z","updated":"2026-11-11T15:07:40.974Z","title":"WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Extended","product":"The Ultimate WordPress Toolkit – WP Extended","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125763","published":"2026-11-11T12:40:25.056Z","updated":"2026-11-11T15:07:56.635Z","title":"WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125743","published":"2026-11-11T12:40:02.640Z","updated":"2026-11-11T13:43:05.673Z","title":"WordPress Elementor Addon Elements plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125436","published":"2026-11-11T12:39:38.057Z","updated":"2026-11-11T15:08:12.885Z","title":"WordPress The Post Grid plugin <= 7.9.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Mamunur Rashid","product":"The Post Grid","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125433","published":"2026-11-11T12:39:14.195Z","updated":"2026-11-11T13:43:22.830Z","title":"WordPress Futurio Extra plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"FuturioWP","product":"Futurio Extra","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124416","published":"2026-11-11T12:38:52.064Z","updated":"2026-11-11T15:08:29.559Z","title":"WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125778","published":"2026-11-11T12:38:33.446Z","updated":"2026-11-11T15:08:46.964Z","title":"WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124263","published":"2026-11-11T12:38:14.639Z","updated":"2026-11-11T13:41:25.754Z","title":"WordPress Locatoraid Store Locator plugin <= 3.9.75 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"plainware","product":"Locatoraid Store Locator","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125431","published":"2026-11-11T12:37:36.519Z","updated":"2026-11-11T15:09:02.494Z","title":"WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"Food Menu – Restaurant Menu & Online Ordering for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124261","published":"2026-11-11T12:37:06.142Z","updated":"2026-11-11T15:09:18.796Z","title":"WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125776","published":"2026-11-11T12:36:04.025Z","updated":"2026-11-11T15:09:34.839Z","title":"WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125450","published":"2026-11-11T12:35:19.626Z","updated":"2026-11-11T13:43:38.319Z","title":"WordPress SureRank plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureRank","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125762","published":"2026-11-11T12:34:54.965Z","updated":"2026-11-11T13:43:54.529Z","title":"WordPress Premium Addons for Elementor plugin <= 4.11.116 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"LeapWorx","product":"Premium Addons for Elementor","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125045","published":"2026-11-11T12:34:30.029Z","updated":"2026-11-11T13:44:11.544Z","title":"WordPress Create plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"John-Michael L'Allier","product":"Create","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125446","published":"2026-11-11T12:12:13.426Z","updated":"2026-11-11T13:49:27.147Z","title":"WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"WisdmLabs","product":"Edwiser Bridge","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125445","published":"2026-11-11T12:11:19.290Z","updated":"2026-11-11T13:42:56.420Z","title":"WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125782","published":"2026-11-11T12:10:50.961Z","updated":"2026-11-11T15:09:51.270Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125435","published":"2026-11-11T12:09:56.241Z","updated":"2026-11-11T15:10:10.945Z","title":"WordPress PowerPack Addons for Elementor plugin <= 3.1.3 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"IdeaBox Creations","product":"PowerPack Addons for Elementor","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124411","published":"2026-11-11T12:09:07.149Z","updated":"2026-11-11T13:44:26.951Z","title":"WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"SureCart","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124417","published":"2026-11-11T12:07:59.222Z","updated":"2026-11-11T15:10:27.257Z","title":"WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124269","published":"2026-11-11T12:07:04.363Z","updated":"2026-11-11T15:10:43.528Z","title":"WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124262","published":"2026-11-11T12:06:42.710Z","updated":"2026-11-11T15:10:59.630Z","title":"WordPress Ad Inserter plugin <= 2.8.19 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Igor Funa","product":"Ad Inserter","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124421","published":"2026-11-11T12:01:13.331Z","updated":"2026-11-11T15:11:15.851Z","title":"WordPress ZoloBlocks plugin <= 2.8.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BdThemes","product":"ZoloBlocks","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124255","published":"2026-11-11T12:00:27.184Z","updated":"2026-11-11T15:11:31.322Z","title":"WordPress Events Made Easy plugin <= 3.3.5 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Franky","product":"Events Made Easy","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124753","published":"2026-11-11T11:57:51.190Z","updated":"2026-11-11T15:11:47.464Z","title":"WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125680","published":"2026-11-11T11:57:03.218Z","updated":"2026-11-11T13:44:43.831Z","title":"WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bold Themes","product":"Bold Page Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125437","published":"2026-11-11T11:56:14.907Z","updated":"2026-11-11T15:12:02.981Z","title":"WordPress Simply Schedule Appointments plugin <= 1.6.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"NSquared","product":"Simply Schedule Appointments","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121028","published":"2026-11-11T11:55:40.977Z","updated":"2026-11-11T15:12:18.443Z","title":"WordPress Strong Testimonials plugin <= 3.3.17 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Strong Testimonials","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121574","published":"2026-11-11T11:54:58.331Z","updated":"2026-11-11T15:12:34.065Z","title":"WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Chill","product":"Passster","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125761","published":"2026-11-11T11:49:26.425Z","updated":"2026-11-11T13:45:01.054Z","title":"WordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"YITH","product":"YITH WooCommerce Ajax Search","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121770","published":"2026-11-11T11:48:40.016Z","updated":"2026-11-11T13:43:13.772Z","title":"WordPress VISeek plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"VillaTheme","product":"VISeek","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121014","published":"2026-11-11T11:48:21.956Z","updated":"2026-11-11T15:12:51.144Z","title":"WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"WP Job Portal","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124408","published":"2026-11-11T11:48:02.421Z","updated":"2026-11-11T11:48:02.965Z","title":"WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Arraytics","product":"WPCafe","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123473","published":"2026-11-11T11:47:34.378Z","updated":"2026-11-11T13:45:16.530Z","title":"WordPress Happy Addons for Elementor plugin <= 3.51.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"weDevs","product":"Happy Addons for Elementor","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121773","published":"2026-11-11T11:47:14.131Z","updated":"2026-11-11T13:45:32.169Z","title":"WordPress GenerateBlocks plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"GeneratePress","product":"GenerateBlocks","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124752","published":"2026-11-11T11:46:54.089Z","updated":"2026-11-11T13:45:47.923Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125438","published":"2026-11-11T11:46:35.250Z","updated":"2026-11-11T11:47:37.567Z","title":"WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125434","published":"2026-11-11T11:43:57.597Z","updated":"2026-11-11T11:44:01.358Z","title":"WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125777","published":"2026-11-11T11:43:29.706Z","updated":"2026-11-11T11:44:30.269Z","title":"WordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Profile Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125439","published":"2026-11-11T11:42:40.970Z","updated":"2026-11-11T11:43:41.842Z","title":"WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Kit","product":"Kit (formerly ConvertKit)","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124413","published":"2026-11-11T11:42:22.809Z","updated":"2026-11-11T11:42:23.286Z","title":"WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125455","published":"2026-11-11T11:40:12.062Z","updated":"2026-11-11T13:46:03.282Z","title":"WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bold Themes","product":"Bold Page Builder","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125451","published":"2026-11-11T11:38:57.130Z","updated":"2026-11-11T13:46:18.931Z","title":"WordPress B Blocks plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"B Blocks","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115600","published":"2026-11-11T11:37:55.884Z","updated":"2026-11-11T11:38:56.942Z","title":"WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DEV Institute","product":"Restrict User Access – Membership Plugin with Force","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125784","published":"2026-11-11T11:37:28.145Z","updated":"2026-11-11T13:49:27.309Z","title":"WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Magnigenie","product":"RestroPress","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122671","published":"2026-11-11T11:36:36.358Z","updated":"2026-11-11T11:37:37.241Z","title":"WordPress e2pdf plugin <= 1.32.65 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"E2Pdf.com","product":"e2pdf","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125781","published":"2026-11-11T11:35:59.280Z","updated":"2026-11-11T13:46:34.367Z","title":"WordPress Event post plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"NOUS Ouvert Utile et Simple","product":"Event post","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-125444","published":"2026-11-11T11:35:24.163Z","updated":"2026-11-11T11:35:37.446Z","title":"WordPress King Addons for Elementor plugin <= 51.1.87 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"King Addons","product":"King Addons for Elementor","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124271","published":"2026-11-11T11:35:01.367Z","updated":"2026-11-11T11:36:02.437Z","title":"WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"DEV Institute","product":"Restrict User Access – Membership Plugin with Force","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-78287","published":"2026-11-11T11:00:22.307Z","updated":"2026-11-11T11:00:22.307Z","title":"WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":10,"vendor":"Staggs","product":"STAGGS","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124253","published":"2026-11-11T11:00:21.878Z","updated":"2026-11-11T13:47:08.627Z","title":"WordPress Calculated Fields Form plugin <= 5.5.2.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"codepeople","product":"Calculated Fields Form","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123478","published":"2026-11-11T11:00:21.338Z","updated":"2026-11-11T13:47:25.725Z","title":"WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Meow Apps","product":"AI Engine","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124256","published":"2026-11-11T10:00:11.299Z","updated":"2026-11-11T13:47:42.076Z","title":"WordPress Delivery & Pickup Date Time for WooCommerce plugin <= 1.3.90 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"CodeRockz","product":"Delivery &amp; Pickup Date Time for WooCommerce","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124257","published":"2026-11-11T10:00:10.763Z","updated":"2026-11-11T13:47:59.651Z","title":"WordPress BP Better Messages plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124250","published":"2026-11-11T10:00:10.232Z","updated":"2026-11-11T13:48:16.365Z","title":"WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"AyeCode Ltd","product":"GeoDirectory","kev":false,"epss":null,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124251","published":"2026-11-10T16:05:34.588Z","updated":"2026-11-10T16:41:56.015Z","title":"WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"XplodedThemes","product":"WPIDE – File Manager & Code Editor","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120834","published":"2026-11-09T18:09:30.298Z","updated":"2026-11-09T18:09:30.298Z","title":"WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerability","severity":"HIGH","score":7.3,"vendor":"Tobias","product":"WP2LEADS","kev":false,"epss":0.00219,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121769","published":"2026-11-09T18:09:29.847Z","updated":"2026-11-10T19:11:38.093Z","title":"WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"axew3.com","product":"WP w3all phpBB","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121573","published":"2026-11-09T18:09:29.828Z","updated":"2026-11-09T18:49:00.540Z","title":"WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Melapress","product":"WP Activity Log","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121576","published":"2026-11-09T17:00:20.536Z","updated":"2026-11-09T17:14:45.380Z","title":"WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"AtlasAiDev","product":"MCP Server for WordPress","kev":false,"epss":0.00308,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122664","published":"2026-11-09T17:00:20.460Z","updated":"2026-11-09T17:24:30.136Z","title":"WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"VideoWhisper.com","product":"Broadcast Live Video","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123482","published":"2026-11-09T17:00:20.037Z","updated":"2026-11-09T17:24:30.274Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121612","published":"2026-11-09T17:00:20.004Z","updated":"2026-11-09T17:24:30.419Z","title":"WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WPZOOM","product":"WPBruiser {no- Captcha anti-Spam}","kev":false,"epss":0.00232,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122673","published":"2026-11-09T13:00:10.291Z","updated":"2026-11-09T15:23:35.694Z","title":"WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Wpmet","product":"ShopEngine","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120854","published":"2026-11-09T12:09:35.086Z","updated":"2026-11-09T15:24:14.544Z","title":"WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability","severity":"HIGH","score":7.5,"vendor":"iubenda","product":"iubenda","kev":false,"epss":0.00359,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120856","published":"2026-11-09T12:09:35.076Z","updated":"2026-11-09T15:24:32.272Z","title":"WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Rymera Web Co","product":"Invoice Gateway for WooCommerce – Invoice Payment Gateway","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123460","published":"2026-11-09T11:00:11.032Z","updated":"2026-11-09T15:25:23.925Z","title":"WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Nickboss","product":"WordPress File Upload","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122661","published":"2026-11-09T11:00:11.003Z","updated":"2026-11-09T15:25:39.871Z","title":"WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121722","published":"2026-11-09T11:00:10.544Z","updated":"2026-11-09T15:25:56.311Z","title":"WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"WP E-Signature","product":"Formidable Forms Signature Online Contract Automation","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119515","published":"2026-11-09T11:00:10.538Z","updated":"2026-11-09T15:26:12.734Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00212,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122665","published":"2026-11-09T11:00:09.897Z","updated":"2026-11-09T15:26:29.522Z","title":"WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122666","published":"2026-11-09T11:00:09.559Z","updated":"2026-11-09T15:26:45.605Z","title":"WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Kitae Park","product":"Mang Board WP","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119524","published":"2026-11-09T11:00:09.463Z","updated":"2026-11-09T15:27:02.182Z","title":"WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123476","published":"2026-11-09T11:00:09.093Z","updated":"2026-11-09T15:27:20.324Z","title":"WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"fifu.app","product":"Featured Image from URL","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120855","published":"2026-11-09T11:00:09.020Z","updated":"2026-11-09T15:27:37.907Z","title":"WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"TemplateInvaders","product":"TI WooCommerce Wishlist","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121570","published":"2026-11-09T11:00:08.604Z","updated":"2026-11-09T15:27:55.195Z","title":"WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Chill","product":"RSVP and Event Management","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123475","published":"2026-11-09T11:00:08.537Z","updated":"2026-11-09T15:28:11.719Z","title":"WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"PT Norther Lights Production","product":"MapSVG","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121782","published":"2026-11-09T11:00:08.025Z","updated":"2026-11-09T15:28:27.759Z","title":"WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120838","published":"2026-11-09T11:00:07.969Z","updated":"2026-11-09T15:28:43.990Z","title":"WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Plugins360 Labs","product":"All-in-One Video Gallery","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119483","published":"2026-11-09T10:00:15.159Z","updated":"2026-11-09T15:29:00.564Z","title":"WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"10Web","product":"Form Maker by 10Web","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119497","published":"2026-11-09T10:00:15.038Z","updated":"2026-11-09T15:29:16.023Z","title":"WordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpWax","product":"Directorist","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119505","published":"2026-11-09T10:00:14.669Z","updated":"2026-11-09T15:29:31.649Z","title":"WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123463","published":"2026-11-09T10:00:14.579Z","updated":"2026-11-09T15:29:48.047Z","title":"WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Wham","product":"Checkout Files Upload for WooCommerce","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121763","published":"2026-11-09T10:00:14.148Z","updated":"2026-11-09T15:30:03.667Z","title":"WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Hummingbird","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66675","published":"2026-11-09T10:00:14.089Z","updated":"2026-11-09T15:30:19.023Z","title":"WordPress Motors plugin <= 1.4.128 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119514","published":"2026-11-09T10:00:13.688Z","updated":"2026-11-09T15:30:35.547Z","title":"WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Webful Creations","product":"RepairBuddy","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123484","published":"2026-11-09T10:00:13.623Z","updated":"2026-11-09T15:30:53.056Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121764","published":"2026-11-09T10:00:13.225Z","updated":"2026-11-09T15:31:10.783Z","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"FolioVision","product":"FV Flowplayer Video Player","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119504","published":"2026-11-09T10:00:13.153Z","updated":"2026-11-09T15:31:27.045Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"DynamiApps","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119503","published":"2026-11-09T10:00:12.748Z","updated":"2026-11-09T15:31:43.159Z","title":"WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Welcart","product":"Welcart e-Commerce","kev":false,"epss":0.00275,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54863","published":"2026-11-09T10:00:12.677Z","updated":"2026-11-09T15:31:59.594Z","title":"WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Mamunur Rashid","product":"Review Schema","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123465","published":"2026-11-09T10:00:12.237Z","updated":"2026-11-09T15:32:15.756Z","title":"WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00335,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121780","published":"2026-11-09T10:00:12.233Z","updated":"2026-11-09T15:32:31.937Z","title":"WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Gijo Varghese","product":"Flying Images","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111403","published":"2026-11-09T10:00:11.601Z","updated":"2026-11-09T15:32:48.769Z","title":"WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Inventory","product":"WP Inventory Manager","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121760","published":"2026-11-09T10:00:11.599Z","updated":"2026-11-09T15:33:05.889Z","title":"WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"HIGH","score":7.5,"vendor":"weDevs","product":"weDocs","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119506","published":"2026-11-09T00:37:53.164Z","updated":"2026-11-09T14:09:08.747Z","title":"WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.1,"vendor":"DynamiApps","product":"Frontend Admin by DynamiApps","kev":false,"epss":0.00302,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61987","published":"2026-11-08T16:00:13.836Z","updated":"2026-11-08T18:55:18.493Z","title":"WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM – Frontend Manager for WooCommerce","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114186","published":"2026-11-08T16:00:13.418Z","updated":"2026-11-08T18:55:18.626Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.00154,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114189","published":"2026-11-08T16:00:13.383Z","updated":"2026-11-08T18:55:18.760Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability","severity":"HIGH","score":8.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109900","published":"2026-11-08T16:00:12.923Z","updated":"2026-11-08T18:55:18.891Z","title":"WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.6,"vendor":"Melapress","product":"Melapress Role Editor","kev":false,"epss":0.00338,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120858","published":"2026-11-08T16:00:12.890Z","updated":"2026-11-08T18:55:19.029Z","title":"WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WP ManageNinja LLC","product":"FluentForm","kev":false,"epss":0.00207,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109899","published":"2026-11-08T16:00:12.349Z","updated":"2026-11-08T18:55:19.168Z","title":"WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"Melapress","product":"Melapress Role Editor","kev":false,"epss":0.00222,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114188","published":"2026-11-08T16:00:12.348Z","updated":"2026-11-08T18:55:19.303Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123472","published":"2026-11-07T17:26:44.830Z","updated":"2026-11-07T18:05:57.603Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119522","published":"2026-11-07T17:26:14.308Z","updated":"2026-11-07T18:19:02.043Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123461","published":"2026-11-07T17:24:12.806Z","updated":"2026-11-07T18:19:19.847Z","title":"WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"FOX","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120836","published":"2026-11-07T17:23:37.515Z","updated":"2026-11-07T18:21:27.916Z","title":"WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":6.5,"vendor":"eLightUp","product":"Meta Box – WordPress Custom Fields Framework","kev":false,"epss":0.0029,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124258","published":"2026-11-07T17:22:23.738Z","updated":"2026-11-07T18:26:28.583Z","title":"WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00242,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123860","published":"2026-11-07T12:47:17.885Z","updated":"2026-11-08T18:55:19.570Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123861","published":"2026-11-07T12:43:53.043Z","updated":"2026-11-07T18:26:28.745Z","title":"WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability","severity":"MEDIUM","score":5.3,"vendor":"CrocoBlock","product":"JetFormBuilder – Hierarchical Select","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120839","published":"2026-11-07T12:43:21.399Z","updated":"2026-11-07T18:26:28.923Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00412,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120841","published":"2026-11-07T12:42:33.813Z","updated":"2026-11-07T18:26:29.092Z","title":"WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability","severity":"HIGH","score":8.8,"vendor":"Magepeople inc.","product":"WpTravelly","kev":false,"epss":0.00412,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121777","published":"2026-11-07T12:41:23.603Z","updated":"2026-11-09T13:45:58.597Z","title":"WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cool Plugins","product":"Cool Formkit Lite","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123467","published":"2026-11-07T12:40:37.332Z","updated":"2026-11-07T18:26:29.227Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122659","published":"2026-11-07T12:40:06.898Z","updated":"2026-11-07T18:26:29.365Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121579","published":"2026-11-07T12:39:43.632Z","updated":"2026-11-07T18:05:57.745Z","title":"WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121575","published":"2026-11-07T12:39:13.305Z","updated":"2026-11-07T18:26:29.496Z","title":"WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP User Manager","product":"WP User Manager","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122660","published":"2026-11-07T12:38:48.962Z","updated":"2026-11-07T18:26:29.625Z","title":"WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123483","published":"2026-11-07T12:37:39.979Z","updated":"2026-11-09T13:45:38.939Z","title":"WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Crocoblock","product":"JetFormBuilder","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123183","published":"2026-11-07T12:36:14.140Z","updated":"2026-11-09T16:56:04.008Z","title":"WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"PluginUs.Net","product":"Active Products Tables for WooCommerce","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123474","published":"2026-11-07T12:35:49.136Z","updated":"2026-11-07T18:26:29.756Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121775","published":"2026-11-07T12:34:57.797Z","updated":"2026-11-07T18:26:29.889Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123462","published":"2026-11-07T12:34:29.645Z","updated":"2026-11-07T18:26:30.034Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122669","published":"2026-11-07T12:33:16.603Z","updated":"2026-11-07T18:05:57.879Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122663","published":"2026-11-07T12:32:48.988Z","updated":"2026-11-07T18:26:30.226Z","title":"WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VillaTheme","product":"CURCY","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121784","published":"2026-11-07T12:32:21.394Z","updated":"2026-11-07T18:05:58.012Z","title":"WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Magepeople inc.","product":"WpBookingly","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123477","published":"2026-11-07T12:31:41.803Z","updated":"2026-11-07T18:05:58.153Z","title":"WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Crocoblock","product":"JetEngine","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119498","published":"2026-11-07T11:59:49.573Z","updated":"2026-11-07T18:26:30.510Z","title":"WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","kev":false,"epss":0.00351,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121765","published":"2026-11-07T11:59:18.951Z","updated":"2026-11-07T18:05:58.746Z","title":"WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Cozmoslabs","product":"TranslatePress","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121571","published":"2026-11-07T10:43:00.672Z","updated":"2026-11-07T18:26:31.299Z","title":"WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Desk","product":"Autopay dla WooCommerce","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119496","published":"2026-11-07T10:42:25.139Z","updated":"2026-11-09T22:41:54.016Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123470","published":"2026-11-07T10:41:57.797Z","updated":"2026-11-09T13:45:15.725Z","title":"WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"HivePress","product":"HivePress","kev":false,"epss":0.00226,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119513","published":"2026-11-07T10:40:44.537Z","updated":"2026-11-07T18:26:31.428Z","title":"WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Ahmad","product":"JS Help Desk","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123468","published":"2026-11-07T10:40:25.729Z","updated":"2026-11-07T18:26:31.557Z","title":"WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"Motors","kev":false,"epss":0.00202,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120857","published":"2026-11-07T10:39:37.731Z","updated":"2026-11-11T03:57:57.652Z","title":"WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"VideoWhisper.com","product":"2Way VideoCalls and Random Chat","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123148","published":"2026-11-07T10:38:47.933Z","updated":"2026-11-07T18:26:31.691Z","title":"WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"TMS","product":"IvyForms","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120837","published":"2026-11-07T10:38:04.753Z","updated":"2026-11-07T18:26:31.838Z","title":"WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Everest Forms","product":"Everest Forms","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121724","published":"2026-11-07T10:33:47.544Z","updated":"2026-11-07T18:26:31.985Z","title":"WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WebberZone","product":"Contextual Related Posts","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120364","published":"2026-11-07T10:32:12.907Z","updated":"2026-11-07T18:06:02.383Z","title":"WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Untapwp","product":"Vidplex","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119523","published":"2026-11-07T10:31:51.308Z","updated":"2026-11-07T18:26:32.121Z","title":"WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119525","published":"2026-11-07T10:26:38.378Z","updated":"2026-11-07T18:26:32.255Z","title":"WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP Desk","product":"Dropshipping XML for WooCommerce","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120365","published":"2026-11-07T10:26:11.841Z","updated":"2026-11-07T18:06:02.538Z","title":"WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Aguila Technologies","product":"WP Customer Area","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119478","published":"2026-11-07T10:19:33.802Z","updated":"2026-11-07T18:26:32.388Z","title":"WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"StylemixThemes","product":"MasterStudy LMS","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119508","published":"2026-11-07T10:19:12.514Z","updated":"2026-11-07T18:26:32.553Z","title":"WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00229,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119492","published":"2026-11-07T10:17:32.001Z","updated":"2026-11-07T18:26:32.711Z","title":"WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119501","published":"2026-11-07T10:16:34.151Z","updated":"2026-11-07T18:06:02.691Z","title":"WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"BdThemes","product":"Element Pack Elementor Addons","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121783","published":"2026-11-07T10:14:14.440Z","updated":"2026-11-07T18:26:32.883Z","title":"WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Passionate Programmer Peter","product":"WP Data Access","kev":false,"epss":0.00158,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119490","published":"2026-11-07T10:13:30.275Z","updated":"2026-11-09T22:42:00.846Z","title":"WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Made with Fuel Ltd.","product":"Better Notifications for WP","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119486","published":"2026-11-07T10:12:15.663Z","updated":"2026-11-07T18:36:38.624Z","title":"WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WP ManageNinja LLC","product":"FluentBoards","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119500","published":"2026-11-07T10:11:35.425Z","updated":"2026-11-07T18:06:02.853Z","title":"WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"bPlugins","product":"Flash & HTML5 Video","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120840","published":"2026-11-07T10:11:13.974Z","updated":"2026-11-07T18:36:38.765Z","title":"WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"ThemeGrill","product":"User Registration","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120842","published":"2026-11-07T10:10:23.132Z","updated":"2026-11-07T18:36:38.917Z","title":"WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"SureForms","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119520","published":"2026-11-07T10:08:56.559Z","updated":"2026-11-07T18:06:03.012Z","title":"WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Brainstorm Force","product":"Spectra","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119494","published":"2026-11-07T10:08:28.998Z","updated":"2026-11-11T03:56:16.622Z","title":"WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Gemini Labs","product":"Site Reviews","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120850","published":"2026-11-07T10:07:25.343Z","updated":"2026-11-07T18:06:03.316Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119493","published":"2026-11-07T10:02:35.608Z","updated":"2026-11-07T18:06:03.489Z","title":"WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Metaphor Creations, LLC","product":"Ditty","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119507","published":"2026-11-07T09:32:03.635Z","updated":"2026-11-09T22:42:16.643Z","title":"WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPDeveloper","product":"NotificationX","kev":false,"epss":0.00311,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119473","published":"2026-11-07T09:30:03.347Z","updated":"2026-11-09T16:55:04.720Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119465","published":"2026-11-07T09:28:22.807Z","updated":"2026-11-07T18:36:39.059Z","title":"WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WPVibes","product":"Elementor Addon Elements","kev":false,"epss":0.00316,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121762","published":"2026-11-07T09:27:39.697Z","updated":"2026-11-07T18:36:40.531Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.00177,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123464","published":"2026-11-07T09:15:20.726Z","updated":"2026-11-07T18:06:04.148Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119502","published":"2026-11-07T09:14:43.488Z","updated":"2026-11-07T18:36:40.665Z","title":"WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"BdThemes","product":"Ultimate Store Kit Elementor Addons","kev":false,"epss":0.00299,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122668","published":"2026-11-07T09:14:18.820Z","updated":"2026-11-07T18:36:40.811Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120853","published":"2026-11-07T09:13:56.417Z","updated":"2026-11-07T18:36:40.944Z","title":"WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120852","published":"2026-11-07T09:13:00.557Z","updated":"2026-11-09T13:44:09.258Z","title":"WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Brainstorm Force","product":"CartFlows","kev":false,"epss":0.00236,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123469","published":"2026-11-07T09:12:38.521Z","updated":"2026-11-09T14:32:27.349Z","title":"WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Liquid Web / StellarWP","product":"The Events Calendar","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119491","published":"2026-11-07T09:12:13.459Z","updated":"2026-11-07T18:36:41.078Z","title":"WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"David Lingren","product":"Media LIbrary Assistant","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-61990","published":"2026-11-07T09:11:48.682Z","updated":"2026-11-09T13:43:47.389Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119484","published":"2026-11-07T09:11:20.814Z","updated":"2026-11-07T18:36:41.217Z","title":"WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":6.3,"vendor":"Supsystic","product":"Photo Gallery by Supsystic","kev":false,"epss":0.00121,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120847","published":"2026-11-07T09:10:16.635Z","updated":"2026-11-07T18:36:41.351Z","title":"WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Wpmet","product":"Metform","kev":false,"epss":0.00243,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119511","published":"2026-11-07T09:09:48.677Z","updated":"2026-11-07T18:36:41.487Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.00282,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121766","published":"2026-11-07T09:09:21.425Z","updated":"2026-11-07T18:36:41.620Z","title":"WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123466","published":"2026-11-07T09:08:23.000Z","updated":"2026-11-07T18:36:41.763Z","title":"WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"LeapWorx","product":"Premium Blocks – Gutenberg Blocks for WordPress","kev":false,"epss":0.00256,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121768","published":"2026-11-07T09:05:00.105Z","updated":"2026-11-07T18:06:04.309Z","title":"WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Markus Wiesenhofer","product":"Contact Form 7 &#8211; Post Fields","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-52713","published":"2026-11-07T09:03:26.066Z","updated":"2026-11-07T18:36:41.908Z","title":"WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"ThimPress","product":"LearnPress","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119467","published":"2026-11-07T09:02:27.952Z","updated":"2026-11-11T06:56:07.894Z","title":"WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WPVibes","product":"AnyWhere Elementor","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-66669","published":"2026-11-07T09:01:51.291Z","updated":"2026-11-07T18:36:42.203Z","title":"WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability","severity":"HIGH","score":8.8,"vendor":"Suplugins","product":"Superb Addons: Blocks, Patterns &amp; Theme Designer","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119510","published":"2026-11-07T09:00:25.855Z","updated":"2026-11-07T18:06:04.464Z","title":"WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Saeed","product":"MC Woocommerce Wishlist","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121781","published":"2026-11-07T08:56:31.769Z","updated":"2026-11-07T18:36:42.341Z","title":"WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP ManageNinja LLC","product":"Fluent Booking","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119489","published":"2026-11-07T08:55:48.421Z","updated":"2026-11-07T18:06:04.624Z","title":"WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Bootstrapped Ventures","product":"WP Recipe Maker","kev":false,"epss":0.0013,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120849","published":"2026-11-07T08:53:25.327Z","updated":"2026-11-10T20:22:19.796Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120848","published":"2026-11-07T08:51:59.575Z","updated":"2026-11-07T18:06:04.788Z","title":"WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WC Lovers","product":"WCFM Marketplace","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-124274","published":"2026-11-07T08:50:22.538Z","updated":"2026-11-07T18:36:42.483Z","title":"WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00176,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122675","published":"2026-11-07T08:49:27.020Z","updated":"2026-11-07T18:36:42.623Z","title":"WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Wpmet","product":"Wp Social","kev":false,"epss":0.00091,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121761","published":"2026-11-07T08:49:00.698Z","updated":"2026-11-10T20:21:45.304Z","title":"WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Infomaniak Network","product":"VOD Infomaniak","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121767","published":"2026-11-07T08:48:16.421Z","updated":"2026-11-09T13:43:25.394Z","title":"WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"weDevs","product":"weDocs","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121778","published":"2026-11-07T08:44:53.759Z","updated":"2026-11-07T18:36:42.759Z","title":"WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WP Lab","product":"WP-Lister Lite for Amazon","kev":false,"epss":0.00187,"kevAdded":null,"exploit":false},{"id":"CVE-2026-121779","published":"2026-11-07T08:43:09.390Z","updated":"2026-11-07T18:36:42.901Z","title":"WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability","severity":"MEDIUM","score":5.3,"vendor":"YITH","product":"YITH WooCommerce Subscription","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39733","published":"2026-11-07T08:42:42.190Z","updated":"2026-11-09T13:42:57.076Z","title":"WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability","severity":"MEDIUM","score":5.3,"vendor":"properfraction","product":"ProfilePress","kev":false,"epss":0.00194,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27356","published":"2026-11-06T22:31:02.728Z","updated":"2026-11-10T20:33:22.359Z","title":"WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"ibericode","product":"MC4WP","kev":false,"epss":0.00247,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120845","published":"2026-11-06T22:30:37.452Z","updated":"2026-11-07T18:06:10.465Z","title":"WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Smush Image Compression and Optimization","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-123471","published":"2026-11-06T22:30:15.072Z","updated":"2026-11-09T13:17:54.060Z","title":"WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"myCred","product":"myCred","kev":false,"epss":0.00237,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120851","published":"2026-11-06T22:29:15.977Z","updated":"2026-11-07T18:36:43.319Z","title":"WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"PublishPress","product":"PublishPress Revisions","kev":false,"epss":0.00198,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119519","published":"2026-11-06T22:28:51.886Z","updated":"2026-11-07T18:36:43.449Z","title":"WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WProyal","product":"Royal Elementor Addons","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-122670","published":"2026-11-06T22:28:26.764Z","updated":"2026-11-07T18:36:43.583Z","title":"WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.4,"vendor":"WP SYNTEX","product":"Polylang","kev":false,"epss":0.00179,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115431","published":"2026-11-06T13:00:09.664Z","updated":"2026-11-06T15:20:56.089Z","title":"WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability","severity":"HIGH","score":7.1,"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","kev":false,"epss":0.00238,"kevAdded":null,"exploit":false},{"id":"CVE-2026-115952","published":"2026-11-06T13:00:09.134Z","updated":"2026-11-06T14:59:55.656Z","title":"WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"WPMU DEV","product":"Forminator","kev":false,"epss":0.0017,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109883","published":"2026-11-06T12:09:26.993Z","updated":"2026-11-06T15:00:13.234Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-109884","published":"2026-11-06T12:09:26.933Z","updated":"2026-11-06T22:33:32.248Z","title":"WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Elementor","product":"Elementor Website Builder","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119516","published":"2026-11-06T08:00:31.536Z","updated":"2026-11-07T18:36:44.024Z","title":"WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Mamunur Rashid","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","kev":false,"epss":0.00386,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119472","published":"2026-11-06T08:00:31.526Z","updated":"2026-11-06T15:04:01.911Z","title":"WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"David Anderson","product":"Redux Framework","kev":false,"epss":0.00161,"kevAdded":null,"exploit":false},{"id":"CVE-2026-120844","published":"2026-11-06T08:00:31.435Z","updated":"2026-11-06T17:34:39.032Z","title":"WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability","severity":"CRITICAL","score":9.8,"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","kev":false,"epss":0.00331,"kevAdded":null,"exploit":false},{"id":"CVE-2026-39744","published":"2026-11-06T08:00:31.106Z","updated":"2026-11-06T15:04:17.337Z","title":"WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"WC Lovers","product":"WCFM Membership","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119488","published":"2026-11-06T08:00:31.083Z","updated":"2026-11-06T15:04:31.805Z","title":"WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"Shamim Rajani","product":"Pie Register","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-119499","published":"2026-11-06T08:00:30.965Z","updated":"2026-11-06T15:24:52.802Z","title":"WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability","severity":"HIGH","score":7.5,"vendor":"BAKKBONE Australia","product":"FloristPress","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false}]}