CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- edge-themes overworldWordPress Overworld theme <= 1.3 - Local File Inclusion vulnerability8.1 High
- elated-themes töbelWordPress Töbel theme <= 1.6 - Local File Inclusion vulnerability8.1 High
- lambertgroup universal video playerWordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- magentech maxshopWordPress MaxShop theme <= 3.6.20 - Local File Inclusion vulnerability8.1 High
- webgeniuslab irecco coreWordPress iRecco Core plugin <= 1.3.6 - Local File Inclusion vulnerability8.1 High
- fooevents for woocommerceWordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability8.5 High
- goalthemes vangoWordPress Vango theme <= 1.3.3 - Local File Inclusion vulnerability8.1 High
- goalthemes rashyWordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerability8.1 High
- goalthemes lindoWordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerability8.1 High
- goalthemes dekoroWordPress Dekoro theme <= 1.0.7 - Local File Inclusion vulnerability8.1 High
- goalthemes bfresWordPress Bfres theme <= 1.2.1 - Local File Inclusion vulnerability8.1 High
- goalthemes baillyWordPress Bailly theme <= 1.3.4 - Local File Inclusion vulnerability8.1 High
- goalthemes hyoriWordPress Hyori theme <= 1.3.6 - Local File Inclusion vulnerability8.1 High
- goalthemes pippoWordPress Pippo theme <= 1.2.3 - Local File Inclusion vulnerability8.1 High
- strongholdthemes tech life cptWordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability8.8 High
- strongholdthemes dental care cptWordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability8.8 High
- elated-themes search & goWordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability8.1 High
- xpeedstudio bajaar - highly customizable woocommerce wordpress themeWordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability8.1 High
- qantumthemes kentharadioWordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes onelifeWordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability8.8 High
- shahjahan jewel fluentformWordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- happymonster happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability8.5 High
- zozothemes miionWordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerability9.9 Critical
- zozothemes miionWordPress Miion theme <= 1.2.7 - Local File Inclusion vulnerability7.5 High
- harmonic design hdformsWordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability8.6 High
- solacewp solaceWordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability6.5 Medium
- blazethemes blogzeeWordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes blogisticWordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability9.9 Critical
- temash barberryWordPress Barberry theme <= 2.9.9.87 - Local File Inclusion vulnerability8.1 High
- aivahthemes hostme v2WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability7.5 High
- jegtheme jnews - videoWordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jegtheme jnews - pay writerWordPress JNews - Pay Writer plugin <= 11.0.0 - Local File Inclusion vulnerability7.5 High
- jegtheme jnews - frontend submitWordPress JNews - Frontend Submit plugin <= 11.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - PHP Object Injection vulnerability8.8 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - Arbitrary File Download vulnerability7.5 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability8.6 High
- kriesi enfoldWordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- designthemes vivaghWordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability8.8 High
- cjjparadoxmax synergy project managerWordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability5.8 Medium
- vrpr wdv one page docsWordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability6.5 Medium
- shoutoutglobal shoutoutWordPress ShoutOut plugin <= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- arevico wp simple redirectWordPress WP Simple Redirect plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- extremeidea bidorbuy store integratorWordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- scalenutWordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability7.5 High
- saad iqbal appexpertsWordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerability8.5 High
- nocreativity dooodlWordPress Dooodl plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lazycoders llc lazytasksWordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability9.8 Critical
- woofer696 dinaturWordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- infility globalWordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- agmorpheus syntax highlighter compressWordPress Syntax Highlighter Compress plugin <= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…