CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- crocoblock jetbookingWordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability7.6 High
- webの相談所 really simple csv importerWordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability9.1 Critical
- zarinpal gatewayWordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- chouby polylang, polylang pro +1 moreWordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability4.3 Medium
- yoomoney юkassa для woocommerceWordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability4.3 Medium
- pickplugins product slider for woocommerceWordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- mapsvgWordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability9.1 Critical
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability8.5 High
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability5.3 Medium
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability5.3 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability8.5 High
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability8.5 High
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quantumcloud simple link directory proWordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- woolentor shoplentor proWordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability4.3 Medium
- woolentor shoplentor proWordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability5.3 Medium
- payu indiaWordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability7.5 High
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability9.8 Critical
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability9.3 Critical
- booklyWordPress Bookly plugin <= 27.7 - SQL Injection vulnerability9.3 Critical
- shahjada wpdm – premium packagesWordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability9.3 Critical
- wpvibes form vibes – database manager for formsWordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- easy appointments appointments, easyappointments easy appointments +1 moreWordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- booklyWordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- shahjada wpdm – premium packagesWordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability7.5 High
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability10.0 Critical
- ziinaWordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability7.5 High
- easy payment payment gateway for paypal on woocommerceWordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability7.5 High
- miniorange discord integrationWordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability8.1 High
- thrive themes quiz builderWordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability9.8 Critical
- wplake advanced viewsWordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability9.9 Critical
- wp chill kali formsWordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability7.7 High
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability8.8 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability9.8 Critical
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability9.3 Critical
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability9.3 Critical
- easy digital downloads digital downloads, sandhills development, llc easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability6.5 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability6.5 Medium
- hassantafreshi easy form builderWordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability7.1 High
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability9.3 Critical
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pi web solution product enquiry for woocommerceWordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability7.1 High
- affiliatewpWordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability6.5 Medium
- apustheme apuslistingWordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- ninja forms file uploads extensionWordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- Show moreLoading…