Skip to content
OpenAdvisories

Archive

13 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /13 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

120 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-61970

    WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

    themeisle Auto Featured Image (Auto Post Thumbnail)
  • Medium 5.3
    CVE-2026-61975

    WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.

    Crocoblock JetReviews
  • Medium 4.9
    CVE-2026-61952

    WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Edito…

    Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor Web / CMS
  • Medium 5.3
    CVE-2026-61983

    WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

    andy_moyle Church Admin
  • Medium 5.3
    CVE-2026-61985

    WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

    MagePeople Team Car Rental Manager
  • Medium 5.4
    CVE-2026-61958

    WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3…

    Saad Iqbal License Manager for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-61977

    WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

    Crocoblock JetSearch
  • Medium 5.3
    CVE-2026-57774

    WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

    vowelweb VW Food Corner
  • Medium 4.3
    CVE-2026-57797

    WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

    ThemeMove EduMall
  • Medium 6.5
    CVE-2026-57783

    WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.

    merkulove Speaker
  • Medium 5.3
    CVE-2026-57776

    WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

    vowelweb VW Wedding
  • Medium 5.3
    CVE-2026-57782

    WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.

    PressTigers Universal Clocks
  • Medium 5.3
    CVE-2026-57778

    WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a thr…

    wpdevart Booking calendar, Appointment Booking System
  • Medium 6.5
    CVE-2026-57812

    WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.

    N Squared Simply Schedule Appointments
  • Medium 5.3
    CVE-2026-57781

    WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.

    Sovlix MeetingHub
  • Medium 6.5
    CVE-2026-57780

    WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.

    Plugin Envision Envision Page Builder
  • Medium 5.3
    CVE-2026-57779

    WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.

    themebeez Fascinate
  • Medium 6.5
    CVE-2026-57406

    WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.

    roxnor FundEngine
  • Medium 6.5
    CVE-2026-57693

    WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <=…

    spacetime Ad Inserter
  • Medium 6.5
    CVE-2026-57424

    WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.

    Knit Pay Razorpay Payment Links for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57404

    WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through…

    MagePeople Team Booking and Rental Manager
  • Medium 6.5
    CVE-2026-57419

    WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <…

    Fahad Mahmood Stock Locations for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57408

    WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 4.0.2.

    Peach Payments Peach Payments Gateway
  • Medium 6.5
    CVE-2026-57420

    WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

    Netrr Author Box WP Lens
  • Medium 6.5
    CVE-2026-57395

    WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

    themefic Tourfic
  • Medium 6.5
    CVE-2026-57391

    WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.

    Tangible Loops & Logic
  • Medium 5.8
    CVE-2026-57691

    WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a th…

    Eli Anti-Malware Security and Brute-Force Firewall
  • Medium 6.5
    CVE-2026-57412

    WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through <= 4.6.9.

    Codemenschen Gift Vouchers
  • Medium 6.5
    CVE-2026-57418

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.

    Bold Grid Client Invoicing by Sprout Invoices
  • Medium 6.5
    CVE-2026-57694

    WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.

    Themeum Tutor LMS
  • Medium 6.5
    CVE-2026-57414

    WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce &#8211; WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce &#8211; WoowBot: fr…

    Quantum Cloud ChatBot for eCommerce &#8211; WoowBot
  • Medium 6.5
    CVE-2026-57698

    WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <…

    villatheme Abandoned Cart Recovery for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57392

    WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

    themefic Tourfic
  • Medium 6.5
    CVE-2026-57400

    WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from…

    WP Swings Event Tickets Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57393

    WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a…

    Edgar Rojas WooCommerce PDF Invoice Builder Web / CMS
  • Medium 6.4
    CVE-2026-57413

    WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through <= 2.1.4.

    bdthemes Instant Image Generator
  • Medium 6.5
    CVE-2026-57711

    WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

    PSM Plugins SupportCandy
  • Medium 6.5
    CVE-2026-57402

    WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund…

    WP Desk Flexible Refund and Return Order for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57364

    WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability

    Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue a…

    WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More
  • Medium 6.5
    CVE-2026-57365

    WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 &amp; v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 &amp; v3) for As…

    Hitesh Chandwani reCAPTCHA (v2 &amp; v3) for Asgaros Forum