Skip to content
OpenAdvisories

Archive

13 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /13 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

346 results · Feed

  • High 7.1
    CVE-2026-57409

    WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for W…

    RealMag777 Active Products Tables for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-57697

    WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.

    Metagauss ProfileGrid
  • Critical 9.3
    CVE-2026-57714

    WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.

    latepoint LatePoint
  • High 7.1
    CVE-2026-57394

    WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.14.

    Tribulant Software Newsletters
  • High 7.1
    CVE-2026-57417

    WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

    RexTheme Cart Lift
  • High 7.1
    CVE-2026-57715

    WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.

    WP ManageNinja Fluent CRM
  • High 7.1
    CVE-2026-57421

    WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.

    CRM Perks CRM Perks Forms
  • Critical 9.3
    CVE-2026-57726

    WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

    Themeum Kirki
  • High 7.5
    CVE-2026-57705

    WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

    Nexcess Event Tickets
  • Critical 9.8
    CVE-2026-57738

    WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

    axiomthemes 777
  • High 7.1
    CVE-2026-57734

    WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

    tagDiv tagDiv Composer
  • Critical 9.9
    CVE-2026-57710

    WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.

    Quantum Cloud WoowBot Pro Max
  • Medium 6.5
    CVE-2026-57408

    WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 4.0.2.

    Peach Payments Peach Payments Gateway
  • Critical 9.3
    CVE-2026-57707

    WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a thro…

    Quantum Cloud Simple Business Directory Pro
  • Medium 6.5
    CVE-2026-57420

    WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

    Netrr Author Box WP Lens
  • High 7.2
    CVE-2026-57407

    WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.

    WP Swings PDF Generator for WordPress Web / CMS
  • Medium 6.5
    CVE-2026-57395

    WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

    themefic Tourfic
  • High 7.1
    CVE-2026-57712

    WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.

    WPZOOM WPZOOM Portfolio
  • High 7.1
    CVE-2026-57396

    WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

    Flintop Free Gifts for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57728

    WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.

    UX-themes Flatsome
  • High 7.1
    CVE-2026-57732

    WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.

    tagDiv tagDiv Opt-In Builder
  • High 7.1
    CVE-2026-57668

    WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.

    Basix NEX-Forms
  • High 7.1
    CVE-2026-57398

    WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.8.3.

    WebCodingPlace Real Estate Manager Pro
  • High 7.1
    CVE-2026-57422

    WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundl…

    villatheme Bopo – WooCommerce Product Bundle Builder Web / CMS
  • Critical 10.0
    CVE-2026-57719

    WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.

    CodeRevolution Aimogen Pro
  • Medium 6.5
    CVE-2026-57391

    WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.

    Tangible Loops & Logic
  • High 7.5
    CVE-2026-57729

    WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.

    UX-themes Flatsome
  • High 7.1
    CVE-2026-57718

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affect…

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
  • High 7.1
    CVE-2026-57706

    WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan, Inc. Dokan dokan-lite allows Reflected XSS.This issue affects Dokan: from n/a through <= 5.0.6.

    Dokan Dokan
  • Medium 5.8
    CVE-2026-57691

    WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a th…

    Eli Anti-Malware Security and Brute-Force Firewall
  • Critical 9.8
    CVE-2026-57724

    WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

    Themeum Kirki
  • Critical 9.3
    CVE-2026-57739

    WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <…

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter
  • Medium 6.5
    CVE-2026-57412

    WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through <= 4.6.9.

    Codemenschen Gift Vouchers
  • Medium 6.5
    CVE-2026-57418

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.

    Bold Grid Client Invoicing by Sprout Invoices
  • Medium 6.5
    CVE-2026-57694

    WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.

    Themeum Tutor LMS
  • Medium 6.5
    CVE-2026-57414

    WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce &#8211; WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce &#8211; WoowBot: fr…

    Quantum Cloud ChatBot for eCommerce &#8211; WoowBot
  • High 7.1
    CVE-2026-57416

    WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

    SiteGround SiteGround Email Marketing
  • High 7.1
    CVE-2026-57411

    WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views &#8211; Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views &#8211; Complete Entry Manage…

    Aman CF7 Views &#8211; Complete Entry Management for Contact Form 7
  • High 7.1
    CVE-2026-57405

    WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.

    ThemeHunk Open Shop
  • Medium 6.5
    CVE-2026-57698

    WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <…

    villatheme Abandoned Cart Recovery for WooCommerce Web / CMS