Threat Entry Updated 2026-06-26

CVE-2026-56014 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in Master Slider

UNKNOWN WordPress component

CVE-2026-56014

HIGH CVSS 7.1 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-56006 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in H5P

UNKNOWN WordPress component

CVE-2026-56006

HIGH CVSS 7.1 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-56050 - PPOM for WooCommerce Plugin

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.

PLUGIN PPOM for WooCommerce

CVE-2026-56050

MEDIUM CVSS 6.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-56013 - WordPress component

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce

UNKNOWN WordPress component

CVE-2026-56013

MEDIUM CVSS 6.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-56023 - WordPress component

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce

UNKNOWN WordPress component

CVE-2026-56023

MEDIUM CVSS 5.4 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54849 - WordPress component

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce

UNKNOWN WordPress component

CVE-2026-54849

CRITICAL CVSS 9.3 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54848 - APIExperts Square for WooCommerce Plugin

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

PLUGIN APIExperts Square for WooCommerce

CVE-2026-54848

HIGH CVSS 8.3 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-56005 - WordPress component

Subscriber Cross Site Scripting (XSS) in WP Activity Log

UNKNOWN WordPress component

CVE-2026-56005

HIGH CVSS 7.1 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54843 - WordPress component

Unauthenticated SQL Injection in MDTF

UNKNOWN WordPress component

CVE-2026-54843

CRITICAL CVSS 9.3 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54845 - WordPress component

Unauthenticated Local File Inclusion in MDTF

UNKNOWN WordPress component

CVE-2026-54845

HIGH CVSS 8.1 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54842 - Royal MCP Plugin

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

PLUGIN Royal MCP

CVE-2026-54842

HIGH CVSS 8.1 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-54844 - WordPress component

Unauthenticated Broken Access Control in CheckView Automated Testing

UNKNOWN WordPress component

CVE-2026-54844

HIGH CVSS 7.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54841 - WordPress component

Unauthenticated Sensitive Data Exposure in Vitepos

UNKNOWN WordPress component

CVE-2026-54841

HIGH CVSS 7.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54836 - YMC Filter Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

PLUGIN YMC Filter

CVE-2026-54836

CRITICAL CVSS 9.3 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54838 - WordPress component

Subscriber SQL Injection in WC Vendors Marketplace

UNKNOWN WordPress component

CVE-2026-54838

HIGH CVSS 8.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-54830 - WordPress component

Unauthenticated Broken Access Control in Five Star Restaurant Reservations

UNKNOWN WordPress component

CVE-2026-54830

HIGH CVSS 7.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54829 - WP Photo Album Plus Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

PLUGIN WP Photo Album Plus

CVE-2026-54829

HIGH CVSS 7.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54823 - WordPress component

Contributor Remote Code Execution (RCE) in Widget Options

UNKNOWN WordPress component

CVE-2026-54823

CRITICAL CVSS 9.9 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54822 - WordPress component

Subscriber SQL Injection in SALESmanago & Leadoo

UNKNOWN WordPress component

CVE-2026-54822

HIGH CVSS 8.5 2026-06-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-54828 - WordPress component

Unauthenticated Broken Access Control in Motors

UNKNOWN WordPress component

CVE-2026-54828

HIGH CVSS 7.5 2026-06-25

Risk Score

Open Full Technical Breakdown