Skip to content
OpenAdvisories

Archive

July 2026

Vulnerabilities first published in this month (UTC), newest first.

← June 2026 2026 / July August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

3,541 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-65467

    WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

    Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

    Crocoblock. Jetimpex JetEngine
  • Medium 5.3
    CVE-2026-65468

    WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 4.9
    CVE-2026-65466

    WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

    Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 6.5
    CVE-2026-65465

    WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

    Crocoblock. Jetimpex JetElements For Elementor
  • Medium 5.4
    CVE-2026-65464

    WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

    Nexcess GiveWP
  • Medium 5.4
    CVE-2026-65463

    WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

    masteriyo Masteriyo - LMS
  • Medium 4.3
    CVE-2026-65460

    WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

    zarinpal Zarinpal Gateway
  • Medium 4.3
    CVE-2026-65457

    WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

    yoomoney ЮKassa для WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-65458

    WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.

    Chouby Polylang Polylang Pro
  • Medium 4.3
    CVE-2026-65456

    WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.

    PickPlugins Product Slider for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-65452

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 5.3
    CVE-2026-65453

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 6.5
    CVE-2026-65449

    WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

    RomanCode MapSVG
  • Medium 5.4
    CVE-2026-61981

    WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

    Quantum Cloud Simple Link Directory Pro
  • Medium 4.3
    CVE-2026-61973

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 5.3
    CVE-2026-61972

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 6.5
    CVE-2026-61946 Public exploit

    WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

    Easy Appointments Easy Appointments
  • Medium 6.5
    CVE-2026-59524

    WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

    Sandhills Development Easy Digital Downloads
  • Medium 6.5
    CVE-2026-59522

    WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

    wedevs WP ERP
  • Medium 6.5
    CVE-2026-59513

    WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

    masteriyo Masteriyo - LMS
  • Medium 6.5
    CVE-2026-57808

    WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

    Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

    Saad Iqbal WP EasyPay
  • Medium 6.5
    CVE-2026-57717

    WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

    Knit Pay Knit Pay
  • Medium 5.3
    CVE-2026-57716

    WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

    videowhisper Broadcast Live Video
  • Medium 6.3
    CVE-2026-57703

    WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.5
    CVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

    WP Desk Autopay dla WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57384

    WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.

    Membership Software WishList Member X
  • Medium 6.5
    CVE-2026-57373

    WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability

    Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

    Wisetr Funnel Kit Funnel Builder PRO
  • Medium 4.3
    CVE-2026-27423

    WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

    Roland Barker Participants Database
  • Medium 5.3
    CVE-2026-27422

    WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

    bPlugins YT Player
  • Medium 5.3
    CVE-2026-27418

    WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

    Epsiloncool WP Fast Total Search
  • Medium 6.5
    CVE-2026-27403

    WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

    NerdPress Hubbub Lite
  • Medium 5.3
    CVE-2026-27399

    WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

    WebWizards MarketKing
  • Medium 5.4
    CVE-2026-27391

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 4.3
    CVE-2026-27392

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Contributor Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 6.7
    CVE-2026-27377

    WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

    Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

    axiomthemes QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-27355

    WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2026-27372

    WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

    Pepro Dev. Group PeproDev Ultimate Invoice
  • Medium 5.4
    CVE-2026-25427

    WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

    DigitalME eRoom
  • Medium 5.3
    CVE-2026-25466

    WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

    WPGMaps WP Go Maps
  • Medium 4.3
    CVE-2026-25424

    WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

    Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

    mediavine Mediavine Control Panel