CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- syed balkhi pushengage – web push notifications, ecommerce automation & chat widgetWordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability7.4 High
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability7.5 High
- wpfunnels proWordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- tomdever wpforo forumWordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability9.8 Critical
- thrive themes apprenticeWordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability9.8 Critical
- crocoblock jetengineWordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability9.3 Critical
- themegrill user registration stripeWordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability8.2 High
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability9.8 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- opmc woocommerce anti-fraudWordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability6.5 Medium
- opmc woocommerce dropshippingWordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability6.5 Medium
- loginpress proWordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability9.8 Critical
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability8.5 High
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability9.3 Critical
- rain-task ltd. wpbakery page builder, wpbakery page builder +1 moreWordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability6.5 Medium
- ideabox creations powerpack pro for elementorWordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability8.8 High
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- jwsthemes ai labWordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability9.8 Critical
- presslayouts kapeeWordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability9.9 Critical
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability7.3 High
- collect.chat inc. collectchatWordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- mikado-themes easymealsWordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability8.1 High
- themagnifico52 charity zoneWordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 kids gift shopWordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 ecommerce zoneWordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 restaurant zoneWordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability9.9 Critical
- edge-themes reinaWordPress Reina theme <= 2.1 - PHP Object Injection vulnerability8.1 High
- mikado-themes chapteroneWordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- themegrill user registration stripeWordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability8.2 High
- barn2 media ltd woocommerce product filtersWordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability9.8 Critical
- client portal ltd. portal (pro)WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability6.5 Medium
- bricks builderWordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability4.3 Medium
- bdthemes element pack proWordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability7.5 High
- wpzoom addons for elementorWordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability9.3 Critical
- boldgrid w3 total cacheWordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability4.7 Medium
- a wp life webenvoWordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability9.9 Critical
- xtemos hitekWordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability8.1 High
- select-themes mildhillWordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability8.1 High
- elated-themes malmöWordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability8.1 High
- techspawn multilocaWordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability7.6 High
- select-themes zermattWordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability8.1 High
- mikado-themes mikado coreWordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability8.1 High
- bricksforgeWordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability7.5 High
- veronalabs slimstat analyticsWordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability6.5 Medium
- ovatheme bookproWordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability8.6 High
- studio keren aga ltd. unlimited elements for elementor (premium)WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability9.9 Critical
- Show moreLoading…