CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- mikado-themes hendonWordPress Hendon theme < 1.7 - Local File Inclusion vulnerability8.1 High
- mikado-themes curlyWordPress Curly theme < 3.3 - Local File Inclusion vulnerability8.1 High
- mikado-themes optimizeWordPress Optimize theme < 2.4 - Local File Inclusion vulnerability8.1 High
- mikado-themes wellspringWordPress Wellspring theme < 2.8 - Local File Inclusion vulnerability8.1 High
- taskbuilderWordPress Taskbuilder plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- purethemes listeo coreWordPress Listeo Core plugin < 2.0.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- aitpro bulletproof securityWordPress BulletProof Security plugin <= 6.9 - Sensitive Data Exposure vulnerability7.5 High
- vernon systems limited ehive searchWordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- themesuite automotive listingsWordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerability9.3 Critical
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.8.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- shahjahan jewel fluent supportWordPress Fluent Support plugin <= 1.10.4 - Broken Access Control vulnerability6.5 Medium
- zozothemes corpkitWordPress Corpkit theme <= 2.0 - Local File Inclusion vulnerability7.5 High
- zozothemes corpkitWordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability9.9 Critical
- themegoods grand restaurantWordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- vankarwai loboWordPress Lobo theme < 2.8.6 - SQL Injection vulnerability8.5 High
- elated-themes neo ocularWordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability8.1 High
- wofficeio woffice coreWordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- wofficeio wofficeWordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability7.1 High
- hclsoftware travelerWordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability6.5 Medium
- astoundify jobifyWordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- arraytics timeticsWordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability8.8 High
- beeteam368 vidmovWordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability7.7 High
- aruba.it dev aruba hispeed cacheWordPress Aruba HiSpeed Cache plugin < 3.0.3 - Broken Access Control vulnerability6.5 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability9.8 Critical
- contentstudioWordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability9.1 Critical
- lambertgroup famous - responsive image and video grid gallery wordpress pluginWordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup countdown with image or video backgroundWordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ricetheme felan frameworkWordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability9.3 Critical
- ricetheme felan frameworkWordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability9.8 Critical
- amentotech workreap (theme's plugin)WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability8.5 High
- nk nk themes helperWordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- loopus wp virtual assistantWordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- loopus wp attractive donations system - easy stripe & paypal donationsWordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnerability7.5 High
- vanquish woocommerce orders & customers exporterWordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability8.5 High
- qantumthemes typifyWordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability8.1 High
- thememove mitechWordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability8.1 High
- thememove moodyWordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability8.1 High
- tmrw-studio atlasWordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability8.1 High
- themelogi navianWordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerability8.1 High
- thememove brookWordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability8.1 High
- thememove aerolandWordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability8.1 High
- kaira blockonsWordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability7.5 High
- brandexponents oshineWordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerability8.1 High
- sizam rehub frameworkWordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability7.5 High
- bhubbard real estate proWordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- e-plugins listinghubWordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jwsthemes ochahouseWordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerability8.1 High
- magentech rozy - flower shopWordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability8.1 High
- carmelo intern membership management systemcode-projects Intern Membership Management System add_admin.php sql injection5.1 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details6.5 Medium
- Show moreLoading…