Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
410,171
Last 24h
698
Critical, 7 days
364
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

98,053 results · Clear filters · Feed

  • High 8.1
    CVE-2026-62074

    WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

    ThemeREX Ozeum
  • High 8.1
    CVE-2026-62070

    WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

    CKThemes Flipmart
  • High 8.1
    CVE-2026-62068

    WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

    CocoBasic Teoro
  • High 8.1
    CVE-2026-62069

    WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

    CocoBasic Fabius
  • High 8.1
    CVE-2026-62067

    WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

    CocoBasic Kaven
  • High 8.1
    CVE-2026-62066

    WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

    CocoBasic Volos
  • High 8.1
    CVE-2026-62065

    WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

    CocoBasic Cardea
  • High 7.1
    CVE-2026-62064

    WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

    bracketweb Ambed
  • High 7.5
    CVE-2026-62043

    WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

    sevenspark Contact Form 7 – Dynamic Text Extension
  • High 7.3
    CVE-2026-62038

    WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

    DigitalME eRoom
  • High 7.1
    CVE-2026-62037

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

    bPlugins Document Embedder
  • High 7.1
    CVE-2026-62034

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

    bPlugins Before After Image Comparison – Image comparison for WP
  • High 7.6
    CVE-2026-62033

    WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

    Subscriber Settings Change in uListing <= 2.2.0 versions.

    stylemix uListing
  • High 7.2
    CVE-2026-62030

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

    bPlugins StreamCast
  • High 7.1
    CVE-2026-62027

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

    bPlugins Team Section Block
  • High 8.8
    CVE-2026-62021

    WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

    rascals Angio
  • High 8.1
    CVE-2026-62020

    WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

    Mikado-Themes TouchUp
  • High 8.1
    CVE-2026-48194

    WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

    kutethemes DukaMarket
  • High 8.1
    CVE-2026-48193

    WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

    kutethemes Uminex
  • High 7.6
    CVE-2026-45440

    WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

    Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

    Smackcoders WP Ultimate CSV Importer
  • High 8.1
    CVE-2026-42724

    WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

    AncoraThemes CleanSkin
  • High 8.1
    CVE-2026-42777

    WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

    Edge-Themes Aalto
  • High 7.6
    CVE-2026-42722

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

    Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

    Shabti Kaplan Frontend Admin by DynamiApps
  • High 7.6
    CVE-2026-42717

    WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

    Administrator SQL Injection in Leyka <= 3.32.3 versions.

    VaultDweller Leyka
  • High 7.1
    CVE-2026-42715

    WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

    10web Photo Gallery by 10Web
  • High 8.5
    CVE-2026-42712

    WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

    Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

    QODE Qode Tours
  • High 7.1
    CVE-2026-42711

    WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

    10web Slider by 10Web
  • High 7.5
    CVE-2026-42706

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

    ThemeGoods DK
  • High 7.1
    CVE-2026-42709

    WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

    RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-42705

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

    ThemeGoods Grand News
  • High 8.1
    CVE-2026-42704

    WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

    axiomthemes Kids Care
  • High 7.1
    CVE-2026-42702

    WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

    Themeum Tutor LMS
  • High 7.1
    CVE-2026-42699

    WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

    foliovision FV Player 8
  • High 7.1
    CVE-2026-42697

    WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons…

    Inisev Social Share Icons & Social Share Buttons
  • High 8.5
    CVE-2026-42633

    WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

    Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

    Marcus Events Manager
  • High 7.1
    CVE-2026-42693

    WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

    TieLabs Jannah
  • High 7.1
    CVE-2026-42632

    WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

    QODE Qode Real Estate
  • High 7.1
    CVE-2026-42631

    WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

    QODE Qode Music
  • High 7.5
    CVE-2026-42630

    WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

    Web Plura Web Plura Backup &amp; Restore Manager
  • High 7.7
    CVE-2026-40805

    WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

    Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

    PeepSo PeepSo