Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.5 CVE-2026-57635

WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability_CVE-2026-57635

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce

FunnelKit FunnelKit Payment Gateway for Stripe WooCommerce n/a CVE
MEDIUM 4.3 CVE-2026-57634

WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability_CVE-2026-57634

Contributor Insecure Direct Object References (IDOR) in PPWP

WP Folio Team PPWP n/a CVE
MEDIUM 5.3 CVE-2026-57633

WordPress WCBoost – Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability_CVE-2026-57633

Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare

WCBoost WCBoost – Products Compare n/a CVE
MEDIUM 5.4 CVE-2026-57632

WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability_CVE-2026-57632

Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend

Omnisend Email Marketing for WooCommerce by Omnisend n/a CVE
MEDIUM 5.3 CVE-2026-57630

WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability_CVE-2026-57630

Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro

Creative Themes Blocksy Companion Pro n/a CVE
MEDIUM 6.5 CVE-2026-57629

WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability_CVE-2026-57629

Contributor Cross Site Scripting (XSS) in StatCounter

StatCounter StatCounter n/a CVE
MEDIUM 4.9 CVE-2026-57627

WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability_CVE-2026-57627

Subscriber Server Side Request Forgery (SSRF) in Kirki

Themeum Kirki n/a CVE
MEDIUM 4.3 CVE-2026-57622

WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability_CVE-2026-57622

Subscriber Broken Access Control in WPCafe

Arraytics WPCafe n/a CVE
MEDIUM 6.5 CVE-2026-57618

WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability_CVE-2026-57618

Contributor Cross Site Scripting (XSS) in Neve PRO

Themeisle Neve PRO n/a CVE
MEDIUM 6.5 CVE-2026-57617

WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability_CVE-2026-57617

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

SeedProd LLC. SeedProd Pro n/a CVE