CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter7.5 High
- erolsk8 media syncMedia Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters6.5 Medium
- mr2p meta field block – display custom fields in the block editor without codingMeta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute6.4 Medium
- managewp workerManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header7.2 High
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter8.2 High
- boldthemes bold page builderBold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode6.4 Medium
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update8.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route4.3 Medium
- taskbuilder – project management & task management tool with kanban boardTaskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter6.5 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user6.5 Medium
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter8.1 High
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'9.8 Critical
- shahinurislam career sectionCareer Section <= 1.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- linux kernel, linux, red hat nvidia for rhel 10 +38 more +40 morenet: skbuff: preserve shared-frag marker during coalescing7.8 High
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab5.4 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabImproper Validation of Specified Quantity in Input in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabDeserialization of Untrusted Data in GitLab6.5 Medium
- gitlabBusiness Logic Errors in GitLab6.8 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabMissing Authorization in GitLab2.7 Low
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabUnintended Proxy or Intermediary ('Confused Deputy') in GitLab5.8 Medium
- gitlabAccess Control Check Implemented After Asset is Accessed in GitLab4.3 Medium
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab6.5 Medium
- gitlabCross-Site Request Forgery (CSRF) in GitLab6.5 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab5.4 Medium
- gitlabMissing Authorization in GitLab2.6 Low
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabServer-Side Request Forgery (SSRF) in GitLab3.5 Low
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- burstbv burst statistics – privacy-friendly wordpress analytics (google analytics alternative)Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover9.8 Critical
- gowebsmarty wp encryption – one click free ssl certificate & ssl / https redirect, security & ssl scanWP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering5.4 Medium
- interactivegeomaps mapgeo – interactive geo mapsMapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter6.1 Medium
- bojansliskovicglscroatiacom gls shipping for woocommerceGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'6.1 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter8.2 High
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widg…6.4 Medium
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter6.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter4.3 Medium
- joedolson my calendar – accessible event managerMy Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter4.3 Medium
- alinto sogoSOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored,...7.1 High
- alinto sogoSOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.7.1 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter6.5 Medium
- Show moreLoading…