Skip to content
OpenAdvisories

Archive

2 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /2 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

278 results · Feed

  • High 7.1
    CVE-2026-57672

    WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

    Melograno Venture Studio wpDataTables
  • High 7.1
    CVE-2026-57671

    WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

    Perfmatters perfmatters
  • High 7.1
    CVE-2026-57670

    WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

    codepeople Google Maps CP
  • Medium 6.5
    CVE-2026-57669

    WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

    Vsourz Digital Advanced Contact form 7 DB
  • Critical 9.6
    CVE-2026-57625

    WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

    ASE Admin and Site Enhancements (ASE) Pro
  • Critical 10.0
    CVE-2026-57624

    WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

    Creative Themes Blocksy Companion Pro
  • Critical 9.0
    CVE-2026-57623

    WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

    Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

    Bold Grid W3 Total Cache
  • Critical 9.8
    CVE-2026-57621

    WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

    Arraytics Booktics
  • High 7.1
    CVE-2026-57426

    WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

    Chill Media Labs S.R.L. Modula - PRO
  • High 7.1
    CVE-2026-57366

    WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

    Greg Winiarski WPAdverts
  • High 7.1
    CVE-2026-57362

    WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

    Quantum Cloud ChatBot
  • High 7.1
    CVE-2026-57361

    WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

    Ays Pro Survey Maker
  • High 7.1
    CVE-2026-57360

    WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

    impleCode eCommerce Product Catalog
  • High 7.1
    CVE-2026-57359

    WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

    ReviewX ReviewX
  • High 7.1
    CVE-2026-57358

    WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

    SysBasics Customize My Account for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57357

    WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

    Search Atlas Group Search Atlas SEO
  • High 7.1
    CVE-2026-57356

    WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

    Moreconvert Team MC Woocommerce Wishlist Web / CMS
  • Medium 6.5
    CVE-2026-57355

    WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

    RadiusTheme Classified Listing
  • Medium 6.5
    CVE-2026-57354

    WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

    Crocoblock. Jetimpex JetReviews
  • Medium 6.5
    CVE-2026-57353

    WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

    Link Whisper Link Whisper Premium
  • Medium 4.8
    CVE-2026-57352

    WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

    villatheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57351

    WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

    Haktan Suren HandL UTM Grabber
  • High 7.1
    CVE-2026-57350

    WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

    Andy Fragen WP Debugging
  • High 7.2
    CVE-2026-57348

    WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

    Cozmoslabs Paid Member Subscriptions
  • High 7.1
    CVE-2026-57349

    WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

    etruel WPeMatico RSS Feed Fetcher
  • Medium 6.5
    CVE-2026-57347

    WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

    jetmonsters Hotel Booking Lite
  • High 7.1
    CVE-2026-57345

    WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

    Webraketen Internal Links Manager
  • High 7.1
    CVE-2026-57344

    WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

    RadiusTheme Classified Listing
  • High 7.1
    CVE-2026-57343

    WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

    contempoinc Real Estate 7
  • Medium 6.5
    CVE-2026-57342

    WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

    ShortPixel ShortPixel Adaptive Images
  • Medium 6.5
    CVE-2026-49779

    WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5.

    Addify Tax Exempt for WooCommerce Web / CMS
  • High 8.1
    CVE-2026-42382

    WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

    Elated-Themes Audrey
  • High 7.5
    CVE-2026-39448

    WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

    CoderPress NOWPayments for WooCommerce Web / CMS
  • Critical 9.1
    CVE-2026-27436

    WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability

    Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

    Rustaurius Five Star Business Profile and Schema
  • High 7.1
    CVE-2026-27430

    WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

    tranmautritam TheFox
  • Medium 6.5
    CVE-2026-27433

    WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

    StylemixThemes Motors
  • High 7.1
    CVE-2026-27426

    WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

    Themesuite Automotive Car Dealership Business
  • High 7.1
    CVE-2026-27425

    WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

    Themesuite Automotive Listings
  • Critical 9.9
    CVE-2026-27419

    WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

    Zozothemes Zegen
  • High 8.8
    CVE-2026-27414

    WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

    fuelthemes Werkstatt