Skip to content
OpenAdvisories

Archive

June 2026

Vulnerabilities first published in this month (UTC), newest first.

← May 2026 2026 / June July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

3,083 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-57649

    WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

    Studio Wombat Shoppable Images Lite
  • Medium 5.4
    CVE-2026-57646

    WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

    Majestic Support Majestic Support
  • Medium 4.3
    CVE-2026-57640

    WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

    stylemix MasterStudy LMS
  • Medium 6.5
    CVE-2026-57641

    WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

    contempoinc Real Estate 7
  • Medium 6.5
    CVE-2026-57638

    WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

    WP ManageNinja Fluent Booking
  • Medium 4.3
    CVE-2026-57637

    WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

    Tyche Softwares Abandoned Cart Lite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57635

    WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

    FunnelKit FunnelKit Payment Gateway for Stripe WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-57634

    WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

    WP Folio Team PPWP
  • Medium 5.3
    CVE-2026-57633

    WordPress WCBoost &#8211; Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.

    WCBoost WCBoost &#8211; Products Compare
  • Medium 5.4
    CVE-2026-57632

    WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.

    Omnisend Email Marketing for WooCommerce by Omnisend Web / CMS
  • Medium 5.3
    CVE-2026-57630

    WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

    Creative Themes Blocksy Companion Pro
  • Medium 6.5
    CVE-2026-57629

    WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

    StatCounter StatCounter
  • Medium 4.9
    CVE-2026-57627

    WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

    Themeum Kirki
  • Medium 4.3
    CVE-2026-57622

    WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

    Arraytics WPCafe
  • Medium 6.5
    CVE-2026-57617

    WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

    SeedProd SeedProd Pro
  • Medium 6.5
    CVE-2026-57618

    WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

    themeisle Neve PRO
  • Medium 6.5
    CVE-2026-57431

    WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

    Mervin Praison Featured Image
  • Medium 4.3
    CVE-2026-57430

    WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability

    Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

    SEOPress Free SEOPress PRO
  • Medium 6.5
    CVE-2026-57324

    WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

    villatheme GIFT4U
  • Medium 5.8
    CVE-2026-57323

    WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

    bPlugins Flash & HTML5 Video
  • Medium 6.5
    CVE-2026-57318

    WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

    Gemini Labs Site Reviews
  • Medium 6.5
    CVE-2026-57316

    WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

    roxnor GetGenie
  • Medium 6.5
    CVE-2026-57313

    WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

    surecart SureCart
  • Medium 5.8
    CVE-2026-56066

    WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

    ShortPixel ShortPixel Adaptive Images
  • Medium 6.5
    CVE-2026-56048

    WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.

    Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-56046

    WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

    Cridio Studio ListingPro
  • Medium 6.4
    CVE-2026-56026

    WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

    Chris Carlevato utm.codes
  • Medium 6.5
    CVE-2026-52701

    WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

    ThemeGrill User Registration
  • Medium 6.5
    CVE-2025-68075

    WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

    Kerry BNE Testimonials
  • Medium 5.3
    CVE-2026-24547

    WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

    SiteGround SiteGround Email Marketing
  • Medium 6.5
    CVE-2025-68074

    WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

    GhozyLab Image Carousel
  • Medium 5.3
    CVE-2025-66123

    WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

    About Envato BookPro
  • Medium 5.3
    CVE-2025-64637

    WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

    Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

    Opal_WP Auros Core
  • Medium 5.3
    CVE-2025-64636

    WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

    rhewlif Donation Thermometer
  • Medium 4.3
    CVE-2025-63079

    WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability

    Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

    bdthemes Live Copy Paste for Elementor
  • Medium 4.3
    CVE-2025-63078

    WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

    jetmonsters Restaurant Menu by MotoPress
  • Medium 5.4
    CVE-2025-63041

    WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability

    Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

    Code Amp Forget About Shortcode Buttons
  • Medium 6.5
    CVE-2026-4339

    SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

    Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode …

    Mattermost Mattermost
  • Medium 6.8
    CVE-2026-9699

    Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

    Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key vi…

    Mattermost Mattermost
  • Medium 5.5
    CVE-2026-45256

    Missing permission check in thr_kill2(2)

    When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The sy…

    FreeBSD FreeBSD