CVEs published in November 2026
7,953 vulnerabilities, 680 critical, 12 exploited.
- stylemixthemes motorsWordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability4.3 Medium
- videowhisper.com 2way videocalls and random chatWordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability5.3 Medium
- tms ivyformsWordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability5.3 Medium
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability4.3 Medium
- ajay contextual related postsWordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability4.3 Medium
- untapwp vidplexWordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability5.3 Medium
- wp desk dropshipping xml for woocommerceWordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability4.3 Medium
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability4.3 Medium
- mamunur rashid radius booking — booking calendar for appointments & servicesWordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability5.3 Medium
- metaphor creations, llc dittyWordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability4.3 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow9.4 Critical
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- made with fuel better notifications for wpWordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability5.3 Medium
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability4.3 Medium
- bplugins flash & html5 videoWordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability4.3 Medium
- brainstorm force sureformsWordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability5.3 Medium
- brainstorm force spectraWordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability5.3 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- metaphor creations, llc dittyWordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow9.4 Critical
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow9.4 Critical
- wpdeveloper notificationxWordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability5.3 Medium
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability4.3 Medium
- wpvibes elementor addon elementsWordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability5.3 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- tomdever wpforo forumwpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms6.4 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint7.5 High
- tomdever wpforo forumwpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter7.5 High
- tomdever wpforo forumwpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter7.5 High
- denishua wpjam basicWPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter8.1 High
- tomdever wpforo forumwpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter7.5 High
- john-dagelmore wpspeed – wordpress speed, cache & performance optimization (core web vitals, pagespeed 100)WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name6.4 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint6.5 Medium
- icopydoc yml for yandex marketYML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php5.3 Medium
- tomdever wpforo forumwpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter6.5 Medium
- dylanjkotze zephyr project managerZephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter5.4 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability4.3 Medium
- brainstorm force cartflowsWordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability5.3 Medium
- brainstorm force cartflowsWordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability5.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability5.3 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability4.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability4.3 Medium
- supsystic photo gallery by supsysticWordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability6.3 Medium
- Show moreLoading…