CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- themegoods grand photographyWordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- code cabin inc wp google maps proWordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability7.1 High
- breakdanceWordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- knit pay pay, knitpay knit pay +1 moreWordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability6.5 Medium
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability5.3 Medium
- storeapps smart managerWordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability6.3 Medium
- webcodingplace real estate manager proWordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bqworks slider proWordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- picture-gallery picture galleryWordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability7.1 High
- boldgrid sprout clientsWordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- download monitor - wpforms lockWordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpdesk autopay dla woocommerceWordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability6.5 Medium
- thimpress. coachingWordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- membership software wishlist member xWordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wisetr inc. funnel kit funnel builder proWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wisetr inc. funnel kit funnel builder proWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepress it solutions llc visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- roland murg wp booking system, wp booking system . booking system +1 moreWordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability7.1 High
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability4.3 Medium
- bplugins yt playerWordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability5.3 Medium
- epsiloncool wp fast total searchWordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability5.3 Medium
- nerdpress hubbub liteWordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webwizards marketkingWordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability5.3 Medium
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability4.3 Medium
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability5.4 Medium
- axiomthemes quickcal - appointment booking calendar for wordpressWordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability6.7 Medium
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability6.5 Medium
- metaphorcreations dittyWordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability5.3 Medium
- everpress mailsterWordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability9.1 Critical
- wp go maps (formerly wp google maps) go maps, wpgmaps wp go maps +1 moreWordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability5.3 Medium
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability5.4 Medium
- mediavine control panelWordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability4.3 Medium
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability8.5 High
- ronald huereca photo blockWordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- supsystic photo gallery by supsysticWordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- catch themes createWordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability8.5 High
- alex volkov wp accessibility helper (wah)WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- gamerz wp-pollsWordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreLibcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()7.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation8.8 High
- libarchivelibarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the...2.5 Low
- cascadiawebservices mountdev ai mcp connector for wordpressMountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint9.8 Critical
- tickera – sell tickets & manage eventsTickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter6.5 Medium
- mahethekiller header footer script adderHeader Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta6.4 Medium
- gowebsmarty wp encryption – lifetime free ssl cert & https, force ssl / https redirect, ssl securityWP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter4.4 Medium
- roundupwp registrations for the events calendar – event registration pluginRegistrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter6.5 Medium
- wupsales ai copilot – content generatorAI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter6.5 Medium
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter6.3 Medium
- mdjm event managementMDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers8.8 High
- Show moreLoading…