Skip to content
OpenAdvisories

Archive

2 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /2 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

278 results · Feed

  • High 7.1
    CVE-2026-57678

    WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

    ThemePunch Slider Revolution
  • High 8.8
    CVE-2026-56037

    WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.

    Themify Themify Popup
  • High 8.8
    CVE-2026-57766

    WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.

    XplodedThemes WPIDE – File Manager & Code Editor
  • High 8.5
    CVE-2026-57765

    WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability

    Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.

    Levelfourdevelopment WP EasyCart
  • Medium 6.5
    CVE-2026-57764

    WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

    Surbma Surbma | Yoast SEO Breadcrumb Shortcode
  • Medium 6.5
    CVE-2026-57763

    WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

    Gordon Böhme Structured Content
  • Medium 5.9
    CVE-2026-57762

    WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

    Andrew Fiebert Simple URLs
  • High 7.1
    CVE-2026-57761

    WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

    BlueAstralThemes SEOWP
  • High 8.8
    CVE-2026-57759

    WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.

    Metagauss ProfileGrid
  • High 7.1
    CVE-2026-57758

    WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.

    BeRocket Permalink Manager for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57757

    WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

    ploudapp pCloud WP Backup
  • High 8.5
    CVE-2026-57756

    WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability

    Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

    友人a丶 nicen-localize-image
  • Medium 6.5
    CVE-2026-57755

    WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

    Misbah WP Mosaic Gallery &#8211; Advanced Gallery
  • Medium 6.5
    CVE-2026-57754

    WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.

    Livemesh Livemesh Addons for WPBakery Page Builder
  • Medium 5.3
    CVE-2026-57753

    WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

    Nathanbarry Kit (formerly ConvertKit) for WooCommerce Web / CMS
  • High 8.5
    CVE-2026-57752

    WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability

    Contributor SQL Injection in iNET Webkit 1.2.4 versions.

    iNET iNET Webkit Browsers
  • High 8.1
    CVE-2026-57751

    WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

    Heateor Support Heateor Social Login
  • Medium 5.3
    CVE-2026-57750

    WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

    Keksdieb ez Form Calculator Premium
  • High 7.5
    CVE-2026-57748

    WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability

    Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

    Shopify Help Center Shopify
  • High 7.5
    CVE-2026-57749

    WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability

    Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.

    ThemeBoy SportsPress Pro
  • Medium 6.5
    CVE-2026-57747

    WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

    ThemeREX Booked
  • High 7.1
    CVE-2026-57746

    WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Booked <= 3.0.0 versions.

    ThemeREX Booked
  • Medium 6.5
    CVE-2026-57731

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

    UX-themes Flatsome
  • Medium 4.3
    CVE-2026-57730

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

    UX-themes Flatsome
  • Medium 4.3
    CVE-2026-57690

    WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

    fuelthemes Werkstatt
  • Medium 4.3
    CVE-2026-57689

    WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

    fuelthemes Werkstatt
  • High 8.2
    CVE-2026-57688

    WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

    Gurmehub POS Entegratör
  • High 8.5
    CVE-2026-57687

    WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability

    Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

    hiroaki-miyashita Custom Field Template
  • High 7.1
    CVE-2026-57686

    WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

    wpxpo WowAddons
  • Medium 4.3
    CVE-2026-57685

    WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

    drfuri Martfury - WooCommerce Marketplace WordPress Theme Web / CMS
  • Medium 6.5
    CVE-2026-57684

    WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

    tranmautritam TheFox
  • Critical 9.3
    CVE-2026-57683

    WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

    Epsiloncool WP Fast Total Search
  • High 7.1
    CVE-2026-57682

    WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

    Quantum Cloud Simple Link Directory
  • Medium 6.4
    CVE-2026-57681

    WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

    Paolo GeoDirectory
  • Critical 9.3
    CVE-2026-57679

    WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability

    Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

    ahmadgb GeekyBot
  • Medium 6.5
    CVE-2026-57680

    WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

    Themeum Kirki
  • Critical 9.8
    CVE-2026-57677

    WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

    Novalnet Novalnet Payment Gateway for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57675

    WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

    Jacob N. Breetvelt WP Photo Album Plus
  • High 7.1
    CVE-2026-57674

    WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

    Arraytics Timetics
  • High 7.1
    CVE-2026-57673

    WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

    Optimole Optimole