CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- xlplugins nextmove liteWordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- bestwebsoft multilanguage by bestwebsoftWordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability4.3 Medium
- marynixie related posts thumbnails plugin for wordpressWordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- zohocrm zoho crm lead magnetWordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability5.4 Medium
- livemesh addons for wpbakery page builderWordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability5.3 Medium
- yasir129 turn yoast seo faq block to accordionWordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cargus ecommerce cargusWordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerability5.3 Medium
- topdevs smart product viewerWordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability4.3 Medium
- kutsy ajax hits counter + popular posts widgetWordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability5.4 Medium
- hyyan abo fakher woocommerce polylang integrationWordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability6.5 Medium
- themeum tutor lms bunnynet integrationWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- sumup payment gateway for woocommerceWordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability5.3 Medium
- wp swings points and rewards for woocommerceWordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability5.4 Medium
- ecwid by lightspeed ecommerce shopping cart shopping cartWordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability4.3 Medium
- wp messiah ai image alt text generator for wpWordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability4.3 Medium
- jahid hasan admin login url changeWordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerability4.3 Medium
- genetech products pie registerWordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability5.3 Medium
- cop ux flatWordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nelio software contentWordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability8.5 High
- boxnow box now deliveryWordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability4.3 Medium
- wisdmlabs edwiser bridgeWordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerability5.4 Medium
- sully media library file sizeWordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerability4.3 Medium
- wp travel travelWordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability5.3 Medium
- briarinc anything order by termsWordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability4.3 Medium
- inet webkitWordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerability6.5 Medium
- bplugins b accordionWordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability6.5 Medium
- israpil textmetricsWordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerability4.3 Medium
- ashan perera lifepressWordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerability4.3 Medium
- ryviu – product reviews for woocommerceWordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability5.3 Medium
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability5.4 Medium
- cloudinaryWordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability5.4 Medium
- crm perks integration for contact form 7 hubspotWordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerability5.3 Medium
- antoniobg abg rich pinsWordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wen solutions contact form 7 getresponse extensionWordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability5.3 Medium
- wpdive elementcampWordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability5.3 Medium
- artplacer widgetWordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dotstore fraud prevention for woocommerceWordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability4.3 Medium
- monetagwp monetag official pluginWordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability5.4 Medium
- kaira blockonsWordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- prince radio playerWordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- harmonic design hd quizWordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability4.3 Medium
- horea radu materialis companionWordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability4.3 Medium
- john james jacoby wp term orderWordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- mkscripts download after emailWordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability5.3 Medium
- prince integrate google driveWordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability5.4 Medium
- abcdatos protección de datos – rgpdWordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability5.3 Medium
- omnipressteam omnipressWordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability7.5 High
- webpushrWordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability5.3 Medium
- Show moreLoading…