CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- liquid design ltd. speech balloon, lqd liquid speech balloon +1 moreWordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle visualizerWordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability8.5 High
- uxper civi frameworkWordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- themefusion avada custom brandingWordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability4.3 Medium
- pixelacehq manual - documentation, knowledge base & education wordpress themeWordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mahmudul hasan arif wp social ninjaWordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability5.3 Medium
- gt3 themes photo galleryWordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- scott paterson accept donations with paypal & stripeWordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- codepeople appointment hour bookingWordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- melapress wp activity log, wp activity log premium +1 moreWordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- pixelacehq manual - documentation, knowledge base & education wordpress themeWordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- sonaar mp3 audio player for music, radio & podcast by sonaarWordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability5.3 Medium
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability5.3 Medium
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vendidero shiptastic for woocommerceWordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- pixelacehq manual - documentation, knowledge base & education wordpress themeWordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability7.5 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability6.5 Medium
- complianzWordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability5.3 Medium
- complianzWordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability7.2 High
- complianzWordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- dokan proWordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability7.5 High
- dokan proWordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability7.1 High
- dokan proWordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability7.5 High
- dokan pro, wedevs dokan pro +1 moreWordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- jonathan daggerhart query wranglerWordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability4.3 Medium
- catch themes createWordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability5.3 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability5.3 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- themegoods photographyWordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability5.3 Medium
- bastien ho event postWordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability5.3 Medium
- code atlantic content controlWordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability5.3 Medium
- analogwp style kitsWordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability6.3 Medium
- hashthemes demo importerWordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- elated-themes vinoWordPress Vino theme <= 1.9 - Local File Inclusion vulnerability7.5 High
- codexthemes thegemWordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mvp themes reviewerWordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability5.4 Medium
- cridiostudio listingproWordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability5.4 Medium
- select-themes tonda coreWordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability7.5 High
- uxper civiWordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability5.3 Medium
- shahjahan jewel ninja tablesWordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability5.3 Medium
- nexcess virtue/ascend/pinnacle toolkitWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kit (formerly convertkit)WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability5.3 Medium
- avada studio core, themefusion avada core +1 moreWordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- shahjahan jewel fluent supportWordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability5.3 Medium
- crocoblock jetbookingWordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability5.3 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- Show moreLoading…