CVEs published in November 2026
7,953 vulnerabilities, 680 critical, 12 exploited.
- wpmet metformWordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability4.3 Medium
- moreconvert mc woocommerce wishlistWordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability5.3 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability5.4 Medium
- leap13 premium blocks – gutenberg blocks for wordpressWordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability5.3 Medium
- markus wiesenhofer contact form 7 – post fieldsWordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability5.4 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability5.4 Medium
- suplugins superb addons: blocks, patterns & theme designerWordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- moreconvert mc woocommerce wishlistWordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow9.4 Critical
- shahjahan jewel fluent bookingWordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability5.3 Medium
- bootstrapped ventures wp recipe makerWordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability4.3 Medium
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability5.3 Medium
- wpmet wp socialWordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- infomaniak network vod infomaniakWordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability4.3 Medium
- wedevs wedocsWordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability5.3 Medium
- unknown wp-lister lite for amazonWordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability5.3 Medium
- yith woocommerce subscriptionWordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability5.3 Medium
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability5.3 Medium
- nasirahmed advanced form integration — connect forms to 300+ appsAdvanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters8.1 High
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow9.4 Critical
- openbmb internet of agentsOpenBMB Internet of Agents Message app.py fetch_chat_record access control6.9 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint7.2 High
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute6.4 Medium
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode4.3 Medium
- wpchill strong testimonialsStrong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter7.2 High
- rubengc gamipress – gamification plugin to reward points, badges & ranks in wordpress, now with aiGamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter6.5 Medium
- webtoffee wp backup and migrationWebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography5.7 Medium
- vanquish83 vanquish upload files for woocommerceVanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter5.9 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form6.4 Medium
- quarka qa assistants – driven by dataQA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters8.8 High
- agenwebsite shipping – plugin ongkos kirim & generate resi otomatis semua kurir indonesiaAgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard7.2 High
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer6.4 Medium
- paystack woocommerce payment gatewayPaystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint5.3 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter5.3 Medium
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters6.4 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field6.4 Medium
- unitecms unlimited elements for elementorUnlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget7.2 High
- expresstech quiz and survey master (qsm) – quiz maker & survey makerQuiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter6.5 Medium
- red hat openshift ai (rhoai)Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltrationNo score
- unknown komfortkasse for woocommerceKomfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF8.8 High
- unknown ileads sms gateway by exsileExsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update8.8 High
- unknown event tickets with ticket scannerEvent Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search6.3 Medium
- unknown event tickets with ticket scannerEvent Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend4.2 Medium
- unknown magic linkMagic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation8.8 High
- unknown add from server liteAdd From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload6.8 Medium
- unknown fiber adminFiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update5.3 Medium
- Show moreLoading…