CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- casey bisson wpcasWordPress wpCAS plugin <= 1.07 - Cross Site Scripting (XSS) vulnerability7.1 High
- ichurakov paid downloadsWordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability9.3 Critical
- frank corso quote masterWordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- remi corson easy theme optionsWordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- expresstechsoftware memberpress discord addonWordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- matiskiba ravpageWordPress Ravpage plugin <= 2.33 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- averta depicter sliderWordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability6.5 Medium
- themegoods craftWordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods dotlifeWordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods hotellerWordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods photographyWordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability8.1 High
- icegramWordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability6.5 Medium
- ninja team gdpr ccpa compliance supportWordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability6.5 Medium
- merv barrett easy property listingsWordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability6.5 Medium
- e-plugins hotel listingWordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability7.6 High
- e-plugins institutions directoryWordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability7.6 High
- e-plugins hospital doctor directoryWordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability7.6 High
- arraytics eventinWordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability8.8 High
- themehunk contact form & lead form elementor builderWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability6.5 Medium
- codisto omnichannel for woocommerceWordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability7.1 High
- chris simmons wp backitupWordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability6.5 Medium
- tabbyai tabby checkoutWordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability7.5 High
- cleverreach® wpWordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerability9.3 Critical
- wp messiah frontis blocksWordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability7.3 High
- wanotifier notifierWordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability6.5 Medium
- cleverplugins seo boosterWordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability6.5 Medium
- ilmosys order listener for woocommerceWordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability9.4 Critical
- antideo email validatorWordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability7.5 High
- onepay sri lanka payment gateway for woocommerceWordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability6.5 Medium
- vollstart event tickets with ticket scannerWordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability9.0 Critical
- cardpaysolutions payment gateway authorize.net cim for woocommerceWordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability6.5 Medium
- dmytro shteflyuk codecolorerWordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerability7.1 High
- bojansliskovicglscroatiacom gls shipping for woocommerce, gls shipping for woocommerce +1 moreWordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- netgsmWordPress Netgsm plugin <= 2.9.63 - Cross Site Scripting (XSS) vulnerability7.1 High
- codeless slider templatesWordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability6.5 Medium
- mndpsingh287 wp mailWordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- event espresso 4 decafWordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability6.5 Medium
- deetronix booking ultra proWordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability6.5 Medium
- kapil chugh my post orderWordPress My Post Order plugin <= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- renatoatshown shown connectorWordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability6.5 Medium
- garidium g-ffl checkoutWordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability10.0 Critical
- inspirythemes real homes crmWordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- e-plugins lawyer directoryWordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability7.6 High
- e-plugins lawyer directoryWordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability8.8 High
- favethemes homey coreWordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- ovatheme movie bookingWordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability8.6 High
- marco van wieren wpo365WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- purethemes workscout-coreWordPress WorkScout-Core plugin <= 1.7.06 - Cross Site Scripting (XSS) vulnerability7.1 High
- purethemes workscoutWordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…