CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- winkm89 teachpressWordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wbolt.com imgspiderWordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- rasedul haque rumi bd courier order ratio checkerWordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability4.3 Medium
- hassantafreshi easy form builderWordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability4.3 Medium
- firestorm plugins professional real estateWordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerability7.6 High
- mwtemplates deepdigitalWordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- absoluteplugins absolute addons for elementorWordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability4.3 Medium
- chandni patel wp mapitWordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability4.3 Medium
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerability7.5 High
- micro.company form to chat appWordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- richardevcom add polylang support for customizerWordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- webappick ctx feedWordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability5.3 Medium
- mikado-themes wanderlandWordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability4.3 Medium
- select-themes don peppeWordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability4.3 Medium
- select-themes prowessWordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability4.3 Medium
- proptech plugin apimo connectorWordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability5.3 Medium
- mikado-themes verdureWordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- elated-themes sweet janeWordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes dolcinoWordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes justiciaWordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes roamWordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes overtonWordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes innovioWordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- pavothemes triplyWordPress Triply theme <= 2.4.7 - Local File Inclusion vulnerability7.5 High
- pavothemes freshioWordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerability7.5 High
- mikado-themes holmesWordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes fleurWordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes fiorelloWordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes curlyWordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- mikado-themes coccoWordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- imran emu owl carousel wpWordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- mikado-themes pawfriends - pet shop and veterinary wordpress themeWordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- aa-team searchazonWordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- smartdatasoft electrician - electrical service wordpressWordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- gregmolnar simple xml sitemapWordPress Simple XML Sitemap plugin <= 1.3 - CSRF to Stored XSS vulnerability7.1 High
- winkm89 teachpressWordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- linux4me2 menu in postWordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tasos fel civic cookie controlWordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability5.3 Medium
- subhansanjaya carousel horizontal posts content sliderWordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegoods grand spaWordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods grand magazineWordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- beaver builder builderWordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability7.5 High
- hossni mubarak jobwpWordPress JobWP plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- scriptsbundle carspotWordPress CarSpot theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 tableonWordPress TableOn plugin <= 1.0.4.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability6.5 Medium
- fuelthemes werkstattWordPress Werkstatt theme < 4.8.3 - Local File Inclusion vulnerability8.1 High
- wpxpo postxWordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability7.5 High
- xpro elementor addonsWordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability9.1 Critical
- broadstreet adsWordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerability7.6 High
- Show moreLoading…