CVE-2026-17149myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 09/09/2026 Severity Medium CVE-2026-15009Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 08/16/2026 Severity Medium CVE-2026-6627WPFormify <= 1.1.1 - Missing Authorization Exploitation status Not known exploited Fix Affected product W WPFormify – Stripe Payments with Form and Checkout Published 08/05/2026 Severity High CVE-2026-11995Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action() Exploitation status Not known exploited Fix Affected product G Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Published 08/01/2026 Severity Medium CVE-2026-12144Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter Exploitation status Not known exploited Fix Affected product W Wholesale for WooCommerce Published 07/29/2026 Severity High CVE-2026-12738WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action Exploitation status Not known exploited Fix Affected product W WP Easy Pay – Payment and Donation form Builder for Square Published 07/11/2026 Severity Medium CVE-2026-12097User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification Exploitation status Not known exploited Fix Affected product U User Management Published 07/08/2026 Severity Medium CVE-2026-8607myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 06/17/2026 Severity Medium CVE-2026-7430Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Exploitation status Not known exploited Fix Affected product P Post Snippets – Custom WordPress Code Snippets Customizer Published 05/29/2026 Severity Medium CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 05/01/2026 Severity Medium CVE-2026-3090Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 03/18/2026 Severity High CVE-2026-2559Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 03/18/2026 Severity Medium CVE-2026-1674Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() Exploitation status Not known exploited Fix Affected product G Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Published 03/04/2026 Severity Medium CVE-2026-0550myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 02/14/2026 Severity Medium CVE-2026-0832New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure Exploitation status Not known exploited Fix Affected product N New User Approve Published 01/28/2026 Severity High CVE-2025-12718Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay Exploitation status Not known exploited Fix Affected product Q Quick Contact Form Published 01/17/2026 Severity Medium CVE-2025-12361myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 12/19/2025 Severity Medium CVE-2025-12362myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 12/13/2025 Severity Medium CVE-2025-12887Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 12/03/2025 Severity Medium CVE-2025-12770New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling Exploitation status Not known exploited Fix Affected product N New User Approve Published 11/19/2025 Severity Medium CVE-2025-11833Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 11/01/2025 Severity Critical CVE-2025-11244Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing Exploitation status Not known exploited Fix Affected product P Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content Published 10/25/2025 Severity Low CVE-2025-9219Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 09/03/2025 Severity Medium CVE-2025-0818Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 08/13/2025 Severity Medium CVE-2025-3453Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content Published 04/17/2025 Severity Medium CVE-2024-13844Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 03/08/2025 Severity Medium CVE-2024-13805Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 03/07/2025 Severity Medium CVE-2024-13713WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection Exploitation status Not known exploited Fix Affected product W WPExperts Square For GiveWP Published 02/21/2025 Severity Medium CVE-2025-0521Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 02/18/2025 Severity High CVE-2024-13333Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product A Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin Published 01/17/2025 Severity High CVE-2024-11201myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 12/06/2024 Severity Medium CVE-2024-11391Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 12/03/2024 Severity High CVE-2024-10187myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 11/08/2024 Severity Medium CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks Exploitation status Not known exploited Fix Affected product W WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce Published 10/16/2024 Severity Medium CVE-2024-8725Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 09/26/2024 Severity Medium CVE-2024-8126Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 09/26/2024 Severity High CVE-2024-8704Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 09/26/2024 Severity High CVE-2024-8658myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade Exploitation status Not known exploited Fix Affected product P Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Published 09/25/2024 Severity Medium CVE-2024-5861WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection Exploitation status Not known exploited Fix Affected product W WP Easy Pay – Payment and Donation form Builder for Square Published 07/24/2024 Severity Medium CVE-2024-5598Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing Exploitation status Not known exploited Fix Affected product A Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Published 06/29/2024 Severity High CVE-2024-1639License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product L License Manager for WooCommerce Published 06/21/2024 Severity Medium CVE-2024-5207POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 05/30/2024 Severity High CVE-2024-0437Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content Published 05/14/2024 Severity Medium CVE-2024-0656Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content Published 02/20/2024 Severity Medium CVE-2023-6875POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 01/11/2024 Severity Critical CVE-2023-7027POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 01/03/2024 Severity High CVE-2023-6629POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 01/03/2024 Severity Medium CVE-2021-4422POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 07/12/2023 Severity Medium CVE-2023-3082Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email Exploitation status Not known exploited Fix Affected product P Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Published 07/12/2023 Severity High CVE-2021-4411WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product W WP Easy Pay – Payment and Donation form Builder for Square Published 07/12/2023 Severity Medium CVE-2019-25150Email Templates <= 1.3 - HTML Injection Exploitation status Not known exploited Fix Affected product E Email Templates Customizer and Designer for WordPress and WooCommerce Published 06/07/2023 Severity High 
