CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-23693 – ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
https://notcve.org/view.php?id=CVE-2026-23693
23 Feb 2026 — ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. ... An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site. Las v... • https://wordpress.org/plugins/elementskit-lite • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-1937 – YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
https://notcve.org/view.php?id=CVE-2026-1937
17 Feb 2026 — The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. • https://plugins.trac.wordpress.org/browser/yaymail/tags/4.3.2/src/Models/MigrationModel.php#L143 • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-1490 – Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation
https://notcve.org/view.php?id=CVE-2026-1490
14 Feb 2026 — The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. • https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/ApbctWP/RemoteCalls.php#L69 • CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-8572 – Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
https://notcve.org/view.php?id=CVE-2025-8572
13 Feb 2026 — The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. • https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124 • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 12%CPEs: 1EXPL: 0CVE-2026-1306 – midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
https://notcve.org/view.php?id=CVE-2026-1306
13 Feb 2026 — The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. • https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynth.php#L110 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2026-1729 – AdForest <= 6.0.12 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2026-1729
11 Feb 2026 — The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. • https://themeforest.net/item/adforest-classified-wordpress-theme/19481695 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 17%CPEs: 1EXPL: 1CVE-2026-1357 – Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2026-1357
10 Feb 2026 — The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. • https://packetstorm.news/files/id/215570 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-1056 – Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal
https://notcve.org/view.php?id=CVE-2026-1056
27 Jan 2026 — The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. • https://plugins.trac.wordpress.org/browser/snow-monkey-forms/tags/12.0.3/App/Model/Directory.php#L58 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-13374 – Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
https://notcve.org/view.php?id=CVE-2025-13374
23 Jan 2026 — The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. • https://github.com/d0n601/CVE-2025-13374 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-24531 – WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2026-24531
23 Jan 2026 — The Prowess theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.3. • https://patchstack.com/database/Wordpress/Theme/prowess/vulnerability/wordpress-prowess-theme-2-3-local-file-inclusion-vulnerability? • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •