CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- taxcloud for woocommerceWordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability6.5 Medium
- tangiblewp listivo coreWordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerability8.1 High
- wpeverest user registrationWordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability8.2 High
- tangiblewp myhome coreWordPress MyHome Core plugin <= 4.1.0 - Local File Inclusion vulnerability7.5 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability6.5 Medium
- booking activities team activitiesWordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerability8.1 High
- themegoods grand tourWordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- designingmedia hostikoWordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- scriptsbundle adforest elementorWordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- scriptsbundle adforestWordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability8.1 High
- mailerlite – woocommerce integrationWordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability9.3 Critical
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability9.1 Critical
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerability7.1 High
- peachpayments peach payments gatewayWordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability6.5 Medium
- elated-themes the aisleWordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability8.1 High
- mikado-themes powerliftWordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability8.1 High
- tickeraWordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability6.5 Medium
- mikado-themes biagiottiWordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerability8.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- angel costa wp seo searchWordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- cleversoft anonWordPress Anon theme <= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes kids heavenWordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability8.8 High
- themeton consult aidWordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability9.8 Critical
- bzotheme mellaWordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability8.1 High
- bslthemes myourWordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability8.1 High
- foreverpinetree thenaWordPress TheNa theme <= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- merkulove crumberWordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability5.4 Medium
- merkulove comparimager for elementorWordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability5.4 Medium
- merkulove scrollerWordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability5.4 Medium
- merkulove uper for elementorWordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability5.4 Medium
- merkulove audier for elementorWordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability5.4 Medium
- merkulove motionger for elementorWordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability5.4 Medium
- merkulove searcher for elementorWordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability5.4 Medium
- merkulove carter for elementorWordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability5.4 Medium
- merkulove imager for elementorWordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability5.4 Medium
- marco milesi anac xml viewerWordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- sizam rehub frameworkWordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerability4.3 Medium
- themegoods grand restaurant theme elements for elementorWordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- johan jonk stenström cookies and content security policyWordPress Cookies and Content Security Policy plugin <= 2.34 - Sensitive Data Exposure vulnerability5.3 Medium
- wproyal bardWordPress Bard theme <= 2.229 - Broken Access Control vulnerability4.3 Medium
- fuelthemes werkstatt pluginWordPress WerkStatt plugin plugin <= 1.6.6 - Local File Inclusion vulnerability7.5 High
- kapil paul payment gateway bkash for wcWordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerability5.3 Medium
- smartdatasoft pool servicesWordPress Pool Services theme <= 3.3 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- mario peshev wp-crm systemWordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability5.4 Medium
- seoseon europe s.l affiliate link trackerWordPress Affiliate Link Tracker plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- blazethemes news eventWordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes blogmaticWordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerability9.9 Critical
- electronWordPress Electron theme <= 1.8.2 - Broken Access Control vulnerability6.5 Medium
- mikado-themes depotWordPress Depot theme <= 1.16 - Local File Inclusion vulnerability8.1 High
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability6.5 Medium
- Show moreLoading…