CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- wpdirectorykit wp directory kitWP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action5.3 Medium
- devsoftbaltic surveyjs: drag & drop form builderSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning4.3 Medium
- wpdiscover timeline event historyTimeline Event History <= 3.2 - Reflected Cross-Site Scripting6.1 Medium
- devsoftbaltic surveyjs: drag & drop form builderSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming4.3 Medium
- mainichiweb friendly functions for welcartFriendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- freemp javascript notifierJavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- mehtevas responsive header pluginResponsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters4.4 Medium
- leadbi plugin for wordpressLeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute6.4 Medium
- devsoftbaltic surveyjs: drag & drop form builderSurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation4.3 Medium
- codemacher cm css columnsCM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute6.4 Medium
- shahinurislam meta-box gallerymetaMeta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption4.4 Medium
- roxnor metform – contact form, survey, quiz, & custom form builder for elementorMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value3.7 Low
- rtowebsites adminquickbarAdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- neop postaliciousPostalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- shahinurislam meta-box gallerymetaMeta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management4.3 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update4.3 Medium
- hallsofmontezuma moderate selected postsModerate Selected Posts <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field7.2 High
- shazdeh administrative shortcodesAdministrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes6.4 Medium
- zero1zerouk login page editorLogin Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- ostin654 justclick registration pluginJustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF6.1 Medium
- themeruby multi authors – assign multiple writers to postsThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes6.4 Medium
- marcinlawrowski wise analyticsWise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter5.3 Medium
- lovor cookie consent for developersCookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields4.4 Medium
- aminhashemy gzseoGZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting6.4 Medium
- wizit gateway for woocommerceWizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation5.3 Medium
- sauravrox set bulk post categoriesSet Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update4.3 Medium
- teamzt zt captchaZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update4.3 Medium
- tandubhai alchemist ajax uploadAlchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion5.3 Medium
- aiktpAIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions5.4 Medium
- robiulawal40 alpha blocksAlpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta6.4 Medium
- cantothemes canto testimonialsCanto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute6.4 Medium
- andddd wp-clanwarsWP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- kometschuh same category postsSame Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder5.4 Medium
- bramdnl star review managerStar Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- waqasvickey0071 wp youtube video galleryWP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- irisideatechsolutions kalrav ai agentKalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action9.8 Critical
- wpmessiah frontis blocks — block library for the block editorFrontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- vektor,inc. vk google job posting managerVK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field6.4 Medium
- adzbierajewski alex user counterAlex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- stefanristic simple crypto shortcodesSimple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- shazdeh administrative shortcodesAdministrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute7.5 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP9.8 Critical
- adonisjs http-serverC++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read7.5 High
- color iccdeviccDEV has Heap Buffer Overflow in icCurvesFromXml()8.8 High
- avahiAvahi has Uncontrolled Recursion in lookup_handle_cname function6.5 Medium
- color iccdeviccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()7.1 High
- color iccdeviccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()7.1 High
- color iccdeviccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()7.1 High
- color iccdeviccDEV has Undefined Behavior in icSigCalcOp()7.1 High
- Show moreLoading…