Skip to content
OpenAdvisories

Archive

6 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /6 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

493 results · Feed

  • Critical 9.3
    CVE-2026-66447

    WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

    Nickboss WordPress File Upload Web / CMS
  • High 7.1
    CVE-2026-66439

    WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

    BeRocket Advanced AJAX Product Filters
  • High 7.1
    CVE-2026-66440

    WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.

    XplodedThemes WPIDE – File Manager & Code Editor
  • Medium 6.5
    CVE-2026-66425

    WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.

    Saad Iqbal Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
  • Critical 9.8
    CVE-2026-65581

    WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

    axiomthemes AI ANN
  • Critical 9.8
    CVE-2026-65578

    WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

    AncoraThemes Agora
  • Critical 9.8
    CVE-2026-65579

    WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

    axiomthemes Agricola
  • Critical 9.8
    CVE-2026-65577

    WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

    AncoraThemes Advice
  • Critical 9.8
    CVE-2026-65575

    WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

    AncoraThemes Accalia
  • Critical 9.8
    CVE-2026-65576

    WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

    AncoraThemes Adrena
  • Critical 9.8
    CVE-2026-65574

    WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

    AncoraThemes Abogado
  • Critical 9.8
    CVE-2026-65572

    WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

    axiomthemes A.Williams
  • Critical 9.8
    CVE-2026-65573

    WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

    ThemeREX Abelle
  • Critical 9.8
    CVE-2026-65571

    WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

    axiomthemes 69 Clothing
  • High 8.1
    CVE-2026-65570

    WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.

    Hamid Alinia Login with phone number
  • High 8.5
    CVE-2026-65569

    WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability

    Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

    WP Job Portal WP Job Portal
  • High 7.1
    CVE-2026-65565

    WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

    Ays Pro Survey Maker
  • High 7.1
    CVE-2026-65560

    WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

    Property Hive Houzez Property Feed
  • High 7.2
    CVE-2026-65559

    WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability

    Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.

    Tyche Softwares Order Delivery Date for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-65556

    WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

    MihChe WPBruiser {no- Captcha anti-Spam}
  • High 7.1
    CVE-2026-65554

    WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

    lattepress AnsPress – Question and answer
  • Critical 10.0
    CVE-2026-65553

    WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.

    wbolt.com Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 Web / CMS
  • Critical 9.8
    CVE-2026-65552

    WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

    qstudio Export User Data
  • High 7.2
    CVE-2026-65549

    WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

    Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

    jegtheme Jeg Kit for Elementor
  • Critical 9.9
    CVE-2026-65548

    WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

    Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

    Muffin Group Betheme
  • High 7.1
    CVE-2026-65545

    WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

    Jordy Meow AI Engine
  • Critical 9.3
    CVE-2026-65546

    WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

    QODE Qode Tours
  • High 7.1
    CVE-2026-65544

    WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

    Rajat Varlani Super Socializer
  • High 7.5
    CVE-2026-65543

    WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

    vimeodev Vimeo
  • High 8.8
    CVE-2026-65542

    WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

    Rajat Varlani Super Socializer
  • High 7.3
    CVE-2026-65541

    WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

    solutioned Staff Training
  • High 7.5
    CVE-2026-65523

    WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

    approveme Formidable Forms Signature Online Contract Automation
  • Critical 9.3
    CVE-2026-65520

    WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

    miniOrange WP OAuth Server
  • High 7.1
    CVE-2026-65517

    WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

    Scott Paterson Easy PayPal Buy Now Button
  • High 7.1
    CVE-2026-65515

    WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

    AffiliateWP AffiliateWP
  • High 7.1
    CVE-2026-65513

    WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

    N Squared Simply Schedule Appointments
  • High 7.1
    CVE-2026-65509

    WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

    wpDataTables wpDataTables
  • Critical 9.8
    CVE-2026-65507

    WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

    Sergey AIWU
  • Critical 9.3
    CVE-2026-65508

    WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

    N Squared Simply Schedule Appointments
  • High 7.5
    CVE-2026-65504

    WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

    ivanbebek BOX NOW Delivery Croatia