CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- google site kit by googleSite Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update2.7 Low
- metaphor creations post duplicatorPost Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData7.2 High
- unknown product slider for woocommerce pro, real testimonials pro, smart-post-show-pro +2 moreShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server7.5 High
- unknown ai share & summarizeAI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute5.4 Medium
- qos.ch sarl logback-coreIncomplete protection against CVE-2025-112267.0 High
- hancock11 wp forms connectorWP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint7.5 High
- rentmy real-time rental management pluginRentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action5.3 Medium
- seo tools bulk seo imageBulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- yapacdev whatsorder – instant checkout for woocommerceWhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs5.3 Medium
- pixelwelt image sizes on demandImage Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable6.1 Medium
- joomunited wp latest postsWP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute6.4 Medium
- paradigmatools avalon23 products filter for woocommerceAvalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- krishaweb advance nav menu managerAdvance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action4.3 Medium
- 24liveblog – live blog tool24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization4.3 Medium
- mirsoftware mir blocks and shortcodesMIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- pravel invoice generatorInvoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter9.8 Critical
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging7.2 High
- ajitdas devs accounting – simple accounting and invoicing solutionDevs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint5.3 Medium
- pravel signup & signinSignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover9.8 Critical
- verenigingvanregistrars generate security.txtGenerate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action4.3 Medium
- ailchev searchplusSearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions5.3 Medium
- manuelpadillac mp customize login pageMP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- 24liveblog – live blog tool24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action4.3 Medium
- clearsale totalClearSale Total <= 3.4.2 - Unauthenticated SQL Injection7.5 High
- owencutajar entredroppersEntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter6.1 Medium
- bytuncay kargo takipKargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter7.2 High
- jotis blue captchaBlue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter4.3 Medium
- berfect reviews and rating – docplannerReviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action4.3 Medium
- assistioai assistioAssistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action4.3 Medium
- secufor oauthSecufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action5.3 Medium
- motordeskMotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- newscred welcome software publishingWelcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method8.8 High
- iamranit advanced contact form 7 – compact dbAdvanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter5.3 Medium
- hancock11 wp forms connectorWP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter7.5 High
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter6.4 Medium
- nicashmu cincopa video and media plug-inCincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments7.2 High
- chuhpl book a room event calendarBook a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update4.3 Medium
- ajitdas devs accounting – simple accounting and invoicing solutionDevs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter5.3 Medium
- cgarvey email javascript cloakEmail JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting7.2 High
- osiris8 osiris signature bannerOsiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter6.1 Medium
- abhisheksaha11 url previewURL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- freedesktop.org libslirplibslirp TCP URG OOB Read Information Leak6.5 Medium
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command10.0 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command10.0 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command10.0 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command10.0 Critical
- Show moreLoading…