CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- david de boer paytiumWordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability9.8 Critical
- corvuspay woocommerce payment gatewayWordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability7.5 High
- themewant easy elements for elementor – addons & website templatesWordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability9.8 Critical
- pluggabl booster for woocommerceWordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- chris carlevato utm.codesWordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- paymob for woocommerceWordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability7.5 High
- chrisvrichardson mappress maps for wordpressWordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- tyche softwares abandoned cart pro for woocommerceWordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability8.8 High
- themefusion fusion builderWordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability8.8 High
- design stylish cost calculatorWordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability7.5 High
- akosglys syncee premium dropshipping & wholesaleWordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability7.5 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability7.3 High
- kingaddons trinity backup – backup, migrate, restore, clone & schedule backupsWordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability7.5 High
- syed balkhi intranet & private site – all-in-one intranetWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability7.5 High
- five star plugins star restaurant menu, rustaurius five star restaurant menu +1 moreWordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability7.5 High
- fpuenteonline object cache 4 everyoneWordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability7.5 High
- dev kabir enable corsWordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability7.4 High
- jegstudio gutenverse companionWordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability7.5 High
- ayecode ltd geodirectoryWordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability9.3 Critical
- contempo themes real estate 7WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability9.3 Critical
- psm plugins supportcandyWordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability7.6 High
- tms wpdatatablesWordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability9.3 Critical
- ads by wpquads by wpquadsWordPress Ads by WPQuads plugin <= 3.0.3 - Sensitive Data Exposure vulnerability7.5 High
- crocoblock jetbookingWordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability9.3 Critical
- themegrill user registrationWordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability6.5 Medium
- siteground email marketingWordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability5.3 Medium
- kerry bne testimonialsWordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ghozylab image carouselWordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- everthemess goya coreWordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability7.5 High
- stylemixthemes splash - sport club wordpress theme for basketball, football, hockeyWordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability7.5 High
- eagle-themes eagle bookingWordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- about envato bookproWordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- opal wp auros coreWordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability5.3 Medium
- rhewlif donation thermometerWordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability5.3 Medium
- bdthemes live copy paste for elementorWordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability4.3 Medium
- jetmonsters restaurant menu by motopressWordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability4.3 Medium
- code amp forget about shortcode buttonsWordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability5.4 Medium
- freebsdArbitrary file overwrite via the KTLS receive path7.8 High
- mattermost, mattermost server +1 moreSSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server6.5 Medium
- mattermostMattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors6.8 Medium
- zaproxy zap-extensionsZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()8.7 High
- freebsdMissing permission check in thr_kill2(2)5.5 Medium
- mattermost, mattermost server +1 moreMarkdown image rendering bypass in AI bot tool result posts in Mattermost3.5 Low
- teableio teableTeable - Missing Authorization in v2 REST API8.7 High
gearyDebian[Unknown description]No score- mattermost github.com/mattermost/mattermost/server/publicClient4 fails to validate path parameters5.4 Medium
- danpros htmlyHTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import...2.1 Low
- jetbrains kotlinJetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution6.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype...2.6 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries...4.3 Medium
- Show moreLoading…