# WPZOOM vulnerabilities Source: https://junglewise.ai/threats/vendors/wpzoom Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 14:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wpzoom.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in WPZOOM: 2 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125766, was published on 11 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 2 - Last 30 days: 5 - Last 90 days: 7 - All time: 11 (0 critical, 0 exploited in the wild) ## About WPZOOM WPZOOM is a developer of themes and plugins for the WordPress content management system. ## Latest WPZOOM vulnerabilities - [CVE-2026-125766: WPZOOM Social Feed Widget & Block sensitive data exposure](https://junglewise.ai/threats/cve-2026-125766-insertion-of-sensitive-information-into-sent-data-vulnerability) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-121612: WPZOOM WPBruiser goodbye-captcha broken authentication](https://junglewise.ai/threats/cve-2026-121612-weak-authentication-vulnerability-in-wpzoom-wpbruiser-no-captcha) (medium, CVSS 4.3, published 9 Nov 2026) - [CVE-2026-115282: Recipe Card Blocks Lite authorization bypass in recipe print](https://junglewise.ai/threats/cve-2026-115282-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does) (info, published 29 Oct 2026) - [CVE-2026-115281: WordPress Recipe Card Blocks Lite SQL injection in shortcode attribute](https://junglewise.ai/threats/cve-2026-115281-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does) (info, published 28 Oct 2026) - [CVE-2026-110514: WPZOOM Portfolio Lite arbitrary post type conversion via IDOR](https://junglewise.ai/threats/cve-2026-110514-the-wpzoom-portfolio-lite-wordpress-plugin-before-1-4-34-does) (info, published 21 Oct 2026) - [CVE-2026-100149: WPZOOM Connect plugin sensitive information exposure via signature validation bypass](https://junglewise.ai/threats/cve-2026-100149-the-wpzoom-connect-ai-chat-click-to-chat-social-icons-share) (medium, CVSS 5.3, published 3 Oct 2026) - [CVE-2026-66639: WPZOOM Forms Contact Form Plugin XSS vulnerability](https://junglewise.ai/threats/cve-2026-66639-wpzoom-forms-contact-form-plugin-xss-vulnerability) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-57712: WPZOOM Portfolio reflected XSS in WordPress plugin](https://junglewise.ai/threats/cve-2026-57712-wpzoom-portfolio-reflected-xss-in-wordpress-plugin) (high, CVSS 7.1, published 13 Jul 2026) - [CVE-2026-39597: WPZOOM Addons for Elementor unauthenticated XSS](https://junglewise.ai/threats/cve-2026-39597-wpzoom-addons-for-elementor-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-49069: WPZOOM Portfolio Reflected XSS](https://junglewise.ai/threats/cve-2026-49069-wpzoom-portfolio-reflected-xss) (high, CVSS 7.1, published 10 Jun 2026) - [CVE-2026-3011: WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes](https://junglewise.ai/threats/cve-2026-3011-wpzoom-recipe-card-blocks-lite-stored-xss-in-recipe-attributes) (medium, CVSS 6.4, published 8 Jun 2026) ## Most severe WPZOOM vulnerabilities - [CVE-2026-57712: WPZOOM Portfolio reflected XSS in WordPress plugin](https://junglewise.ai/threats/cve-2026-57712-wpzoom-portfolio-reflected-xss-in-wordpress-plugin) (high, CVSS 7.1, published 13 Jul 2026) - [CVE-2026-39597: WPZOOM Addons for Elementor unauthenticated XSS](https://junglewise.ai/threats/cve-2026-39597-wpzoom-addons-for-elementor-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-49069: WPZOOM Portfolio Reflected XSS](https://junglewise.ai/threats/cve-2026-49069-wpzoom-portfolio-reflected-xss) (high, CVSS 7.1, published 10 Jun 2026) - [CVE-2026-66639: WPZOOM Forms Contact Form Plugin XSS vulnerability](https://junglewise.ai/threats/cve-2026-66639-wpzoom-forms-contact-form-plugin-xss-vulnerability) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-3011: WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes](https://junglewise.ai/threats/cve-2026-3011-wpzoom-recipe-card-blocks-lite-stored-xss-in-recipe-attributes) (medium, CVSS 6.4, published 8 Jun 2026) - [CVE-2026-100149: WPZOOM Connect plugin sensitive information exposure via signature validation bypass](https://junglewise.ai/threats/cve-2026-100149-the-wpzoom-connect-ai-chat-click-to-chat-social-icons-share) (medium, CVSS 5.3, published 3 Oct 2026) - [CVE-2026-125766: WPZOOM Social Feed Widget & Block sensitive data exposure](https://junglewise.ai/threats/cve-2026-125766-insertion-of-sensitive-information-into-sent-data-vulnerability) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-121612: WPZOOM WPBruiser goodbye-captcha broken authentication](https://junglewise.ai/threats/cve-2026-121612-weak-authentication-vulnerability-in-wpzoom-wpbruiser-no-captcha) (medium, CVSS 4.3, published 9 Nov 2026) - [CVE-2026-115282: Recipe Card Blocks Lite authorization bypass in recipe print](https://junglewise.ai/threats/cve-2026-115282-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does) (info, published 29 Oct 2026) - [CVE-2026-115281: WordPress Recipe Card Blocks Lite SQL injection in shortcode attribute](https://junglewise.ai/threats/cve-2026-115281-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does) (info, published 28 Oct 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 200% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## WPZOOM technologies - [WPZOOM Recipe Card Blocks Lite](https://junglewise.ai/threats/technologies/recipe-card-blocks-lite): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "WPZOOM vulnerabilities", https://junglewise.ai/threats/vendors/wpzoom, 11 November 2026.