Skip to content
OpenAdvisories

Archive

13 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /13 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

606 results · Feed

  • High 7.1
    CVE-2026-66468

    WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

    powerfulwp Local Delivery Drivers for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-66467

    WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

    WP ManageNinja FluentCommunity
  • High 7.5
    CVE-2026-66466

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

    wedevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart Web / CMS
  • Critical 9.8
    CVE-2026-66465

    WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

    Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

    AgniHD Cartify
  • High 7.5
    CVE-2026-66463

    WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

    Hassan Fakih iCARRY
  • Medium 6.5
    CVE-2026-66464

    WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

    Toast Plugins Internal Link Optimiser
  • High 7.5
    CVE-2026-66461

    WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

    Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

    smepay SMEPay: UPI Gateway for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-66462

    WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

    BookingWP WooCommerce Appointments Web / CMS
  • Medium 6.5
    CVE-2026-66460

    WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

    AfterShip & Automizely AfterShip Tracking
  • Critical 9.3
    CVE-2026-66458

    WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

    Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

    ThimPress RealPress
  • Medium 6.5
    CVE-2026-66459

    WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

    Space Codes AI for SEO
  • Medium 6.5
    CVE-2026-66456

    WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

    bestwebsoft Profile Extra Fields by BestWebSoft
  • Medium 6.0
    CVE-2026-66455

    WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

    rockiger ReactPress
  • Medium 6.5
    CVE-2026-66454

    WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

    Maruti Mohanty WP Social Avatar
  • Critical 9.8
    CVE-2026-66453

    WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

    Dimitri Grassi Salon booking system
  • High 8.1
    CVE-2026-66450

    WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

    Dylan Kuhn Geo Mashup
  • High 7.1
    CVE-2026-66449

    WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

    Dylan Kuhn Geo Mashup
  • Critical 9.3
    CVE-2026-66446

    WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

    Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

    If-So Dynamic Content If-So Dynamic Content Personalization
  • Medium 6.5
    CVE-2026-66444

    WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

    kendysond Payment Forms for Paystack
  • High 7.5
    CVE-2026-66443

    WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

    Pete Nelson REST API Log
  • Critical 9.3
    CVE-2026-66436

    WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

    RealMag777 Active Products Tables for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-66441

    WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

    MultiVendorX MultiVendorX
  • High 7.5
    CVE-2026-66432

    WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

    denishua WPJAM Basic
  • High 8.5
    CVE-2026-66430

    WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

    Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

    codepress Visitor Traffic Real Time Statistics Pro
  • High 7.5
    CVE-2026-66431

    WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

    WoompaLoompa Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) Web / CMS
  • High 7.1
    CVE-2026-66429

    WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

    codepress Visitor Traffic Real Time Statistics Pro
  • High 7.1
    CVE-2026-66426

    WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

    Lester Chan WP-Stats
  • Critical 9.8
    CVE-2026-66424

    WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

    Cozy Vision Technologies Pvt SMS Alert Order Notifications
  • High 7.7
    CVE-2026-65582

    WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

    Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

    LiquidThemes AI Hub
  • High 7.5
    CVE-2026-61984

    WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

    Amauri WPMobile.App
  • High 7.1
    CVE-2026-65580

    WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

    bracketweb Agrion
  • High 7.5
    CVE-2026-61980

    WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

    Daan.dev OMGF Pro
  • High 8.1
    CVE-2026-61979

    WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

    miniOrange SAML SP Single Sign On
  • Medium 6.5
    CVE-2026-61978

    WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

    webhosting4ugr Secure Card Gateway for ePay Paycenter (Piraeus Bank)
  • Critical 9.3
    CVE-2026-61969

    WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

    Webilia Listdom
  • High 7.1
    CVE-2026-61974

    WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

    kitae-park Mang Board WP
  • Critical 9.8
    CVE-2026-61967

    WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

    miniOrange miniorange otp verification
  • Critical 9.3
    CVE-2026-61966

    WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

    Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

    denishua WPJAM Basic
  • High 7.1
    CVE-2026-61965

    WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

    ahmadgb GeekyBot
  • Critical 10.0
    CVE-2026-61962

    WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability

    Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

    Hakan Ozevin WP BASE Booking