CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- sergiotoca stm gallery 1.9STM Gallery 1.9 <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- ruhul amin my album galleryMy Album Gallery <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title6.4 Medium
- bruterdregz contact us simple formContact Us Simple Form <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- mitchoyoshitaka stumble! for wordpressStumble! for WordPress <= 1.1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- fpcorso testimonial masterTestimonial Master <= 0.2.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- tomiup wp recipe managerWP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field6.4 Medium
- ahecht ah shortcodesAH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute6.4 Medium
- jseto travel bucket list – wish to goTravel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- aaextensions aa block countryAA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header5.3 Medium
- davidangel photofadePhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- djanym optional emailOptional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover9.8 Critical
- fulippo wp status notifierWP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- eastsidecode wp enable webpWP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload8.8 High
- zanderz recrasRecras WordPress plugin <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute6.4 Medium
- mtcaptcha wordpress pluginMTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- moosend landing pagesMoosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option Deletion5.3 Medium
- anwerashif xsharexShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter4.3 Medium
- webrndexperts latest registered usersLatest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export7.5 High
- rankology seo and analytics toolRankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation2.7 Low
- kentothemes latest tabsLatest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update4.3 Medium
- codeclouds unifyUnify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter5.3 Medium
- sharethis dashboard for google analyticsShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure4.7 Medium
- airesvsg acf to rest apiACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification4.3 Medium
- hayyatapps stylish order form builderStylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter6.4 Medium
- smjrifle svg map by smjrifleSVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting6.1 Medium
- tfrommen page keysPage Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter4.4 Medium
- solwininfotech user activity logUser Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login7.5 High
- curlbroken TLS options for threaded LDAPS6.3 Medium
- nokia sr linuxJSON RPC authentication bypass in Nokia SR Linux6.4 Medium
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by an improper service binding configuration2.2 Low
- audrasjb key figuresKey Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render4.4 Medium
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification5.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion5.4 Medium
- premmerce woocommerce customers managerPremmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting6.1 Medium
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by improper authentication and missing CSRF protection2.9 Low
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by an insufficient session expiration vulnerability2.0 Low
- liangshao flashcard plugin for wordpressFlashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal6.5 Medium
- ipaymu payment gateway for woocommerceiPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure8.2 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload6.1 Medium
- moneyspace money spaceMoney Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure8.6 High
- nsthemes ns ie compatibility fixerNS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- anjan011 simple user meta editorSimple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field4.4 Medium
- wpcommerz twinklesmtp – email service provider for wordpresstwinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings4.4 Medium
- helpdeskcom helpdesk contact formHelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args4.3 Medium
- hblpay payment gateway for woocommerceHBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter6.1 Medium
- metodiew quote commentsQuote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update4.3 Medium
- anilankola newsletter email subscribeNewsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builderBit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay6.5 Medium
- unknown frontend file manager pluginFrontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion7.7 High
- unknown relevanssi, relevanssi premium +1 moreRelevanssi (Free < 4.26.0, Premium < 2.29.0) - Contributor+ SQLi4.9 Medium
- Show moreLoading…