CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- arraytics wpcafeWordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability4.3 Medium
- themeisle neve proWordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seedprod llc proWordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mervin praison featured imageWordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seopress free proWordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability4.3 Medium
- jellywp nanomagWordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- villatheme gift4uWordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability6.5 Medium
- bplugins flash & html5 videoWordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability5.8 Medium
- wedevs wemailWordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- icc0rz h5pWordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability7.1 High
- realmag777 foxWordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability6.5 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- roxnor getgenieWordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability6.5 Medium
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability8.5 High
- surecartWordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- surecartWordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- xtemos woodmartWordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- themehunk advance product searchWordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability9.3 Critical
- site building with toolset toolset formsWordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability9.3 Critical
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability9.3 Critical
- shortpixel adaptive imagesWordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability5.8 Medium
- themefic tourficWordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability8.5 High
- bplugins mailchimp blockWordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability8.3 High
- oooorgle quotes llamaWordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability9.3 Critical
- wp swings subscriptions for woocommerceWordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability7.5 High
- tychesoftwares print invoice & delivery notes for woocommerceWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data Exposure vulnerability7.5 High
- physcode travel bookingWordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability9.9 Critical
- themecatcher quformWordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability9.9 Critical
- uncanny owl automator proWordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability9.8 Critical
- inspirythemes realhomesWordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability8.8 High
- tyche softwares payment gateway based fees and discounts for woocommerceWordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- perfmattersWordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cridiostudio listingproWordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- valvepress automaticWordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- adenion blog2socialWordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- cusrev customer reviews for woocommerceWordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- dfactory responsive lightboxWordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jegstudio gutenverse formWordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- aerin quick interest sliderWordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- frisbii payWordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability8.8 High
- codemstory 워드프레스 결제 심플페이WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability9.3 Critical
- cory marsh bitfire securityWordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability8.6 High
- online web tutor library management systemWordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability9.3 Critical
- dokan proWordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability9.8 Critical
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability9.8 Critical
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability8.1 High
- Show moreLoading…