L Injection and Remote Code Execution in WordPress REST API","title_mitre":"WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","products":["WordPress"],"meta_published_doy":198,"vendor":"WordPress","cve_id":"CVE-2026-63030","impact_score":9.8,"impact_severity":"CRITICAL","highest_score":476054},{"title_generated":"Unauthenticated File Upload Vulnerability in Bricksforge Plugin for WordPress","title_mitre":"Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter","products":["Bricksforge"],"meta_published_doy":281,"vendor":"WordPress","cve_id":"CVE-2026-85097","impact_score":9.8,"impact_severity":"CRITICAL","highest_score":134075},{"title_generated":"Local File Inclusion in WordPress Leading to Remote Code Execution","title_mitre":null,"products":["WordPress"],"meta_published_doy":265,"vendor":"WordPress","cve_id":"CVE-2026-87902","impact_score":8.1,"impact_severity":"HIGH","highest_score":117245},{"title_generated":"Unrestricted File Upload Vulnerability in Elementor Pro by Elementor","title_mitre":"WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability","products":["Elementor Pro"],"meta_published_doy":231,"vendor":"WordPress","cve_id":"CVE-2026-32475","impact_score":9,"impact_severity":"CRITICAL","highest_score":59561},{"title_generated":"File Write Vulnerability in W3 Total Cache Plugin for WordPress","title_mitre":"W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key","products":["W3 Total Cache"],"meta_published_doy":231,"vendor":"WordPress","cve_id":"CVE-2026-18051","impact_score":10,"impact_severity":"CRITICAL","highest_score":58676},{"title_generated":"Privilege Escalation Vulnerability in Pods Plugin for WordPress","title_mitre":"Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router","products":["Pods – Custom Content Types And Fields"],"meta_published_doy":227,"vendor":"WordPress","cve_id":"CVE-2026-19598","impact_score":9.8,"impact_severity":"CRITICAL","highest_score":53885},{"title_generated":"Arbitrary File Upload Vulnerability in Forminator Forms Plugin by WordPress","title_mitre":"Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration","products":["Forminator Forms – Contact Form, Payment Form & Custom Form Builder"],"meta_published_doy":230,"vendor":"WordPress","cve_id":"CVE-2026-15748","impact_score":9.8,"impact_severity":"CRITICAL","highest_score":50398},{"title_generated":"Privilege Escalation in Modular DS by Modular Solutions","title_mitre":"WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability","products":["Modular Ds"],"meta_published_doy":14,"vendor":"WordPress","cve_id":"CVE-2026-23550","impact_score":10,"impact_severity":"CRITICAL","highest_score":32141},{"title_generated":"Unrestricted File Upload Vulnerability in Woocommerce Wholesale Lead Capture by Rymera Web Co","title_mitre":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","products":["WooCommerce Wholesale Lead Capture"],"meta_published_doy":78,"vendor":"WordPress","cve_id":"CVE-2026-27540","impact_score":9,"impact_severity":"CRITICAL","highest_score":31866},{"title_generated":"Authentication Bypass Vulnerability in User Profile Builder Plugin for WordPress","title_mitre":"User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter","products":["User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor"],"meta_published_doy":227,"vendor":"WordPress","cve_id":"CVE-2026-15826","impact_score":9.8,"impact_severity":"CRITICAL","highest_score":26468},{"title_generated":"Deserialization Vulnerability in GiveWP by StellarWP","title_mitre":"WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability","prod

Vulnerability Published:

Sort By:

6 October 2026

Unauthenticated SQL Injection in Newsletter Subscription Form by WordPress