Skip to content
OpenAdvisories

Archive

July 2026

Vulnerabilities first published in this month (UTC), newest first.

← June 2026 2026 / July August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

3,541 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-65533

    WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

    wbolt.com Smart SEO Tool
  • Medium 5.9
    CVE-2026-65534

    WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

    Charlie Etienne Custom links in Elementor Image Carousel
  • Medium 4.8
    CVE-2026-65531

    WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

    Themeum Qubely
  • Medium 4.3
    CVE-2026-65530

    WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

    Templatespare TemplateSpare
  • Medium 6.5
    CVE-2026-65528

    WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

    bannersky BSK PDF Manager
  • Medium 5.3
    CVE-2026-65529

    WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For E…

    Iqonic Designs Graphina – Charts and Graphs For Elementor
  • Medium 6.5
    CVE-2026-65527

    WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

    lqd LIQUID SPEECH BALLOON
  • Medium 5.3
    CVE-2026-65525

    WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

    uxper Civi Framework
  • Medium 4.3
    CVE-2026-65524

    WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

    Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

    ThemeFusion Avada Custom Branding
  • Medium 6.5
    CVE-2026-65522

    WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

    pixelacehq Manual - Documentation, Knowledge Base & Education WordPress Theme Web / CMS
  • Medium 5.3
    CVE-2026-65521

    WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

    Mahmudul Hasan Arif WP Social Ninja
  • Medium 6.5
    CVE-2026-65519

    WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

    gt3themes Photo Gallery
  • Medium 6.5
    CVE-2026-65518

    WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

    Scott Paterson Accept Donations with PayPal & Stripe
  • Medium 6.5
    CVE-2026-65514

    WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

    codepeople Appointment Hour Booking
  • Medium 5.4
    CVE-2026-65512

    WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.

    melapress WP Activity Log WP Activity Log Premium
  • Medium 5.3
    CVE-2026-65506

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

    sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • Medium 5.3
    CVE-2026-65505

    WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

    bdthemes Ultimate Store Kit Elementor Addons
  • Medium 6.5
    CVE-2026-65503

    WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

    bdthemes Ultimate Store Kit Elementor Addons
  • Medium 5.3
    CVE-2026-65501

    WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

    vendidero Shiptastic for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-65498

    WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

    Complianz Complianz
  • Medium 6.5
    CVE-2026-65499

    WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

    Pepro Dev. Group PeproDev Ultimate Invoice
  • Medium 4.4
    CVE-2026-65496

    WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability

    Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

    Complianz Complianz
  • Medium 4.3
    CVE-2026-65491

    WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

    Jonathan Daggerhart Query Wrangler
  • Medium 5.3
    CVE-2026-65490

    WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0.

    John-Michael L'Allier Create
  • Medium 5.3
    CVE-2026-65489

    WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

    LA-Studio LA-Studio Element Kit for Elementor
  • Medium 5.3
    CVE-2026-65487

    WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

    ThemeGoods Photography
  • Medium 5.3
    CVE-2026-65486

    WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

    Bastien Ho Event post
  • Medium 6.3
    CVE-2026-65484

    WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

    AnalogWP Style Kits
  • Medium 5.3
    CVE-2026-65485

    WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

    Daniel Iser Content Control
  • Medium 5.9
    CVE-2026-65483

    WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

    HashThemes HashThemes Demo Importer
  • Medium 6.5
    CVE-2026-65482

    WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a thro…

    LA-Studio LA-Studio Element Kit for Elementor
  • Medium 6.5
    CVE-2026-65480

    WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

    CodexThemes TheGem
  • Medium 5.4
    CVE-2026-65479

    WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • Medium 5.4
    CVE-2026-65478

    WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

    Cridio Studio ListingPro
  • Medium 5.3
    CVE-2026-65476

    WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

    uxper Civi
  • Medium 5.3
    CVE-2026-65474

    WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

    WP ManageNinja Ninja Tables
  • Medium 5.3
    CVE-2026-65472

    WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

    Kit Kit (formerly ConvertKit)
  • Medium 6.5
    CVE-2026-65473

    WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

    Nexcess Virtue/Ascend/Pinnacle Toolkit
  • Medium 5.3
    CVE-2026-65469

    WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

    Strategy11 Team AWP Classifieds
  • Medium 6.5
    CVE-2026-65470

    WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

    WP ManageNinja Fluent Support