Skip to content
OpenAdvisories

Archive

23 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /23 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

172 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-65487

    WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

    ThemeGoods Photography
  • Medium 5.3
    CVE-2026-65486

    WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

    Bastien Ho Event post
  • Medium 6.3
    CVE-2026-65484

    WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

    AnalogWP Style Kits
  • Medium 5.3
    CVE-2026-65485

    WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

    Daniel Iser Content Control
  • Medium 5.9
    CVE-2026-65483

    WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

    HashThemes HashThemes Demo Importer
  • Medium 6.5
    CVE-2026-65482

    WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a thro…

    LA-Studio LA-Studio Element Kit for Elementor
  • Medium 6.5
    CVE-2026-65480

    WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

    CodexThemes TheGem
  • Medium 5.4
    CVE-2026-65479

    WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • Medium 5.4
    CVE-2026-65478

    WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

    Cridio Studio ListingPro
  • Medium 5.3
    CVE-2026-65476

    WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

    uxper Civi
  • Medium 5.3
    CVE-2026-65474

    WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

    WP ManageNinja Ninja Tables
  • Medium 5.3
    CVE-2026-65472

    WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

    Kit Kit (formerly ConvertKit)
  • Medium 6.5
    CVE-2026-65473

    WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

    Nexcess Virtue/Ascend/Pinnacle Toolkit
  • Medium 5.3
    CVE-2026-65469

    WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

    Strategy11 Team AWP Classifieds
  • Medium 6.5
    CVE-2026-65470

    WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

    WP ManageNinja Fluent Support
  • Medium 4.9
    CVE-2026-65467

    WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

    Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

    Crocoblock. Jetimpex JetEngine
  • Medium 5.3
    CVE-2026-65468

    WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 4.9
    CVE-2026-65466

    WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

    Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 6.5
    CVE-2026-65465

    WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

    Crocoblock. Jetimpex JetElements For Elementor
  • Medium 5.4
    CVE-2026-65464

    WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

    Nexcess GiveWP
  • Medium 5.4
    CVE-2026-65463

    WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

    masteriyo Masteriyo - LMS
  • Medium 4.3
    CVE-2026-65460

    WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

    zarinpal Zarinpal Gateway
  • Medium 4.3
    CVE-2026-65457

    WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

    yoomoney ЮKassa для WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-65458

    WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.

    Chouby Polylang Polylang Pro
  • Medium 4.3
    CVE-2026-65456

    WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.

    PickPlugins Product Slider for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-65452

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 5.3
    CVE-2026-65453

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 6.5
    CVE-2026-65449

    WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

    RomanCode MapSVG
  • Medium 5.4
    CVE-2026-61981

    WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

    Quantum Cloud Simple Link Directory Pro
  • Medium 4.3
    CVE-2026-61973

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 5.3
    CVE-2026-61972

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 6.5
    CVE-2026-61946 Public exploit

    WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

    Easy Appointments Easy Appointments
  • Medium 6.5
    CVE-2026-59524

    WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

    Sandhills Development Easy Digital Downloads
  • Medium 6.5
    CVE-2026-59522

    WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

    wedevs WP ERP
  • Medium 6.5
    CVE-2026-59513

    WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

    masteriyo Masteriyo - LMS
  • Medium 6.5
    CVE-2026-57808

    WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

    Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

    Saad Iqbal WP EasyPay
  • Medium 6.5
    CVE-2026-57717

    WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

    Knit Pay Knit Pay
  • Medium 5.3
    CVE-2026-57716

    WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

    videowhisper Broadcast Live Video
  • Medium 6.3
    CVE-2026-57703

    WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.5
    CVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

    WP Desk Autopay dla WooCommerce Web / CMS