CVEs published in November 2026
7,953 vulnerabilities, 680 critical, 12 exploited.
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme curcyWordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability5.3 Medium
- magepeople inc. wpbookinglyWordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- openbmb internet of agentsOpenBMB Internet of Agents Agent Registry app.py register missing authentication6.9 Medium
- realmag777 active woot products tables for woocommerce. 100% freeActive Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute6.4 Medium
- oxilab flipbox – awesomes flip boxes image overlayFlipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter6.4 Medium
- themehigh checkout field editor for woocommerce (pro)Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action9.1 Critical
- codename065 download managerDownload Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]7.2 High
eazipcrates.ioeazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows8.6 High- relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability5.3 Medium
- cozmoslabs translatepressWordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- No product listedRRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process9.8 Critical
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property5.4 Medium
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonialsReal Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter4.7 Medium
- quttera threatsign – web malware scanner for wordpressQuttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header7.2 High
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source7.2 High
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionUser Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input7.2 High
- antoineh football poolFootball Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message6.4 Medium
- funnelkit payment gateway for stripe woocommerce, teamfunnelkit funnelkit payment gateway for stripe woocommerce +1 moreFunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter7.5 High
- naimurrahmannahid naimur email otp verification for woocommerceNaimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization9.8 Critical
- andy moyle church adminChurch Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter7.2 High
- wpchill modula image gallery – photo grid & video galleryModula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter6.4 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert8.1 High
- westguard ws form lite – drag & drop contact form builderWS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value7.2 High
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonialsReal Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain5.4 Medium
- happyforms proHappyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter7.2 High
- themegrill registration form for woocommerceRegistration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout9.8 Critical
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter7.2 High
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonialsReal Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter5.4 Medium
- rubengc automatorwp – no-code workflow automation, integration & webhooks plugin, now with aiAutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option7.5 High
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta8.1 High
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute6.4 Medium
- wpvibes dynific addons for elementor (formerly anywhere elementor)Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter6.5 Medium
- cbutlerjr wp-members membership pluginWP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field6.4 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta7.2 High
- amelia booking for appointments and events calendar – amelia proAmelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys7.5 High
- mpol wp imageviewerWP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute6.4 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter9.1 Critical
- oxilab image hover effects ultimate ( image gallery, effects, lightbox, comparison & magnifier )Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Par…4.9 Medium
- happyforms proHappyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header7.2 High
- faboba falang multilanguage for wordpressFalang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook6.4 Medium
- jackdewey link libraryLink Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter7.2 High
- wpvibes dynific addons for elementor (formerly anywhere elementor)Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer6.5 Medium
- wp desk autopay dla woocommerceWordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability5.3 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability5.3 Medium
- hivepressWordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability4.3 Medium
- ahmad js help deskWordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…