Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

1,804 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-24358

    WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.

    ExpressTech Systems Quiz And Survey Master
  • Medium 6.5
    CVE-2026-24361

    WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-review allows Stored XSS.This issue affects LearnPress – Course Review: from n/a through <= 4.1.9.

    ThimPress LearnPress – Course Review
  • Medium 4.4
    CVE-2026-24360

    WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.

    Craig Hewitt Seriously Simple Podcasting
  • Medium 5.4
    CVE-2026-24365

    WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Manager for WooCommerce: from n/a through < 3.6.0.

    StoreApps Stock Manager for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-24366

    WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= …

    YITHEMES YITH WooCommerce Request A Quote Web / CMS
  • Medium 4.9
    CVE-2026-24356

    WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a through <= 4.3.0.

    roxnor GetGenie
  • Medium 4.3
    CVE-2026-24353

    WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability

    Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.9.

    WPEverest User Registration
  • Medium 6.5
    CVE-2026-24355

    WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2…

    Fave Themes Houzez Theme - Functionality
  • Medium 6.5
    CVE-2026-24354

    WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through <= 6.1.

    PenciDesign Penci Shortcodes & Performance
  • Medium 4.3
    CVE-2026-24357

    WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through <= 10.2.4.

    Brecht WP Recipe Maker
  • Medium 5.3
    CVE-2026-23974

    WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.

    uxper Golo
  • Medium 5.9
    CVE-2026-23976

    WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This issue affects Modula Image Gallery: from n/a through <= 2.13.4.

    WP Chill Modula Image Gallery
  • Medium 5.4
    CVE-2026-22483

    WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a through <= 9.0.12.

    winkm89 teachPress
  • Medium 4.3
    CVE-2026-22481

    WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BD Courier Order Ratio Checker: from n/a through…

    Rasedul Haque Rumi BD Courier Order Ratio Checker
  • Medium 5.3
    CVE-2026-22469

    WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This issue affects DeepDigital: from n/a through <= 1.0.2.

    mwtemplates DeepDigital
  • Medium 4.9
    CVE-2026-22482

    WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.

    wbolt.com IMGspider
  • Medium 4.3
    CVE-2026-22472

    WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.

    hassantafreshi Easy Form Builder
  • Medium 4.3
    CVE-2026-22468

    WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Absolute Addons For Elementor: from n/a through <= 1.0.14.

    AbsolutePlugins Absolute Addons For Elementor
  • Medium 4.3
    CVE-2026-22462

    WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Request Forgery.This issue affects Add Polylang support for Customizer: from n/a through <= 1.4.5.

    richardevcom Add Polylang support for Customizer
  • Medium 6.5
    CVE-2026-22463

    WordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored XSS.This issue affects Form to Chat App: from n/a through <= 1.2.5.

    Micro.company Form to Chat App
  • Medium 4.3
    CVE-2026-22466

    WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.

    Chandni Patel WP MapIt
  • Medium 5.3
    CVE-2026-22461

    WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.

    WebAppick CTX Feed
  • Medium 4.3
    CVE-2026-22450

    WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.

    Select-Themes Don Peppe
  • Medium 4.3
    CVE-2026-22447

    WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a through <= 1.8.1.

    Select-Themes Prowess
  • Medium 4.3
    CVE-2026-22458

    WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: from n/a through <= 1.5.

    Mikado-Themes Wanderland
  • Medium 5.4
    CVE-2026-22411

    WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.

    Mikado-Themes Dolcino
  • Medium 5.4
    CVE-2026-22426

    WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.

    Elated-Themes Sweet Jane
  • Medium 5.3
    CVE-2026-22445

    WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.

    Proptech Plugin Apimo Connector
  • Medium 5.4
    CVE-2026-22409

    WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.

    Mikado-Themes Justicia
  • Medium 5.4
    CVE-2026-22430

    WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.

    Mikado-Themes Verdure
  • Medium 5.4
    CVE-2026-22407

    WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.

    Mikado-Themes Roam
  • Medium 5.4
    CVE-2026-22404

    WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.

    Mikado-Themes Innovio
  • Medium 5.4
    CVE-2026-22406

    WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.

    Mikado-Themes Overton
  • Medium 5.4
    CVE-2026-22396

    WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.

    Mikado-Themes Fiorello
  • Medium 5.4
    CVE-2026-22393

    WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.

    Mikado-Themes Curly
  • Medium 5.4
    CVE-2026-22400

    WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.

    Mikado-Themes Holmes
  • Medium 5.4
    CVE-2026-22398

    WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.

    Mikado-Themes Fleur
  • Medium 5.9
    CVE-2026-22388

    WordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored XSS.This issue affects Owl Carousel WP: from n/a through <= 2.2.2.

    Imran Emu Owl Carousel WP
  • Medium 5.4
    CVE-2026-22391

    WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.

    Mikado-Themes Cocco
  • Medium 5.4
    CVE-2026-22382

    WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.

    Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme Web / CMS