CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability5.4 Medium
- e-plugins final userWordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability8.8 High
- e-plugins wp membershipWordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability8.8 High
- e-plugins wp membershipWordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability7.3 High
- bhubbard real estate proWordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability7.3 High
- e-plugins listinghubWordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability7.3 High
- e-plugins listihubWordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability7.3 High
- e-plugins fitness-trainerWordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability7.3 High
- e-plugins final userWordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability7.3 High
- e-plugins hospital doctor directoryWordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability7.3 High
- e-plugins hotel listingWordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability7.3 High
- e-plugins institutions directoryWordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability7.3 High
- e-plugins hospital doctor directoryWordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability8.8 High
- e-plugins institutions directoryWordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability8.8 High
- e-plugins lawyer directoryWordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability7.3 High
- themepassion ultra portfolioWordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerability8.5 High
- boopathi rajan wp test emailWordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- amentotech workreap coreWordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerability9.8 Critical
- fuelthemes northWordPress North theme <= 5.7.5 - Local File Inclusion vulnerability8.1 High
- fuelthemes northWordPress North theme <= 5.7.5 - PHP Object Injection vulnerability8.8 High
- wpwave hide my wpWordPress Hide My WP plugin <= 6.2.12 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- vibethemes wplmsWordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability8.6 High
- designthemes reservation pluginWordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability6.5 Medium
- themerex sound | musical instruments online storeWordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability9.8 Critical
- ancorathemes maltaWordPress Malta theme <= 1.3.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes hoboWordPress Hobo theme <= 1.0.10 - Local File Inclusion vulnerability8.1 High
- ancorathemes modern housewifeWordPress Modern Housewife theme <= 1.0.12 - Local File Inclusion vulnerability8.1 High
- ancorathemes yoloxWordPress Yolox theme <= 1.0.15 - Local File Inclusion vulnerability8.1 High
- ancorathemes pearson specterWordPress Pearson Specter theme <= 1.11.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes piqesWordPress Piqes theme <= 1.0.11 - Local File Inclusion vulnerability8.1 High
- ancorathemes priderWordPress Prider theme <= 1.1.3.1 - Local File Inclusion vulnerability8.1 High
- ancorathemes tantumWordPress TanTum theme <= 1.1.13 - Local File Inclusion vulnerability8.1 High
- ancorathemes tornadosWordPress Tornados theme <= 2.1 - Local File Inclusion vulnerability8.1 High
- ancorathemes mujiWordPress Muji theme <= 1.2.0 - Local File Inclusion vulnerability8.1 High
- ancorathemes tailsWordPress Tails theme <= 1.4.12 - Local File Inclusion vulnerability8.1 High
- ancorathemes indoor plantsWordPress Indoor Plants theme <= 1.2.7 - Local File Inclusion vulnerability8.1 High
- ancorathemes snow mountainWordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes pets landWordPress Pets Land theme <= 1.2.8 - Local File Inclusion vulnerability8.1 High
- ancorathemes weedlesWordPress Weedles theme <= 1.1.12 - Local File Inclusion vulnerability8.1 High
- ancorathemes movemeWordPress MoveMe theme <= 1.2.15 - Local File Inclusion vulnerability8.1 High
- ancorathemes ureachWordPress uReach theme <= 1.3.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes diveitWordPress DiveIt theme <= 1.4.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes partymakerWordPress PartyMaker theme <= 1.1.15 - Local File Inclusion vulnerability8.1 High
- edge-themes eldonWordPress Eldon theme <= 1.0 - Local File Inclusion vulnerability8.1 High
- e-plugins hotel listingWordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- seatheme bm content builderWordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability6.5 Medium
- highwarden super logos showcaseWordPress Super Logos Showcase plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup universal video playerWordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- fmeaddons registration & login with mobile phone number for woocommerceWordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability9.8 Critical
- cridiostudio listingpro reviewsWordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…