CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- learnnearclub login with nearLogin with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter8.1 High
- gapgag55 auto thumbnailsAuto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- huankong hk shortcodehk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- shra genzel breadcrumbsGenzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page4.3 Medium
- yehudah faq shortocdefaq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute6.4 Medium
- mshomali dideoDideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- kevin1804 responsive checkResponsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- rahulbhangale wp promoterWP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action5.3 Medium
- nsthemes ns product icon badgeNS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF6.1 Medium
- mkhfr old posts highlighterOld Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- vinaysankhyan iwr tooltipiWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cuamckuy easy prism syntax highlighterEasy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- india-web-developer login with otpLogin with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force9.8 Critical
- celloexpressions content slideshowContent Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- samiullah-kaifi islamic databaseIslamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- devsabbirahmed firebase support & chat managementFirebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- bitform – data management solution for wordpressBitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- eldougo tuxquoteTuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- fides-it animate your contentAnimate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- thomstark formidable kineticFormidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- paulpela my email shortcodeMy Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]6.4 Medium
- godlessons wp autobuzzWP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter6.1 Medium
- youtag two-factor authentication (formerly ip vault)Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mutualfunddata mutual funds dataMutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- ruchit47 events in cityEvents In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- bradyholt jquery googleslidesjQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- rchmura gostats for wordpressGoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function4.3 Medium
- wmark cdn linker liteCDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- golzarrahman gntt post title tickerGNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- vincentastolfi shortcode buddyShortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- konforti listen shortcodeListen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- shazdeh query shortcodeQuery Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute7.5 High
- adnanmoqsood team master – a modern wordpress team showcaseTeam Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- garber gbi to printGBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute6.4 Medium
- simonailie search simple fieldsSearch Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- nakamura1458 auto making json-ldauto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass4.3 Medium
- morettolss google+ link nameGoogle+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- jonathan-robrecht single mailchimpSingle Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- codycave endless scrollEndless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]6.4 Medium
- ektorcaba wp iframe geo style for amazon affiliatesWP Iframe Geo Style for Amazon affiliates <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute6.4 Medium
- cryptoprijzen cryptocurrency prijsvergelijking widgetCryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- esiteq responsive video embedderResponsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute5.4 Medium
- creativemindssolutions cm ad changer – a simple tool to control and optimize your site's bannersCM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management4.3 Medium
- yoast seo – advanced seo with real-time guidance and built-in aiYoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter4.3 Medium
- oalders http::daemon, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreHTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()9.1 Critical
- zte zxunipos nds-lteCryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product7.0 High
- pmqs io::compress, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob7.3 High
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference7.7 High
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials4.3 Medium
- Show moreLoading…