CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes5.3 Medium
- goodlayers tourmasterTourmaster < 5.4.8 - Stored XSS via CSRF7.1 High
- unknown online scheduling and appointment booking systemBookly < 27.8 - Unauthenticated SQL Injection via staff_id8.6 High
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table5.3 Medium
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag4.8 Medium
- unknown animation addons for elementorAnimation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload6.1 Medium
- arraytics eventinEventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation7.5 High
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR4.3 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN5.3 Medium
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update7.5 High
- unknown fluent formsFluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field6.1 Medium
- unknown wp ghost (hide my wp ghost)Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass5.4 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization6.5 Medium
- brainstorm force ultimate addons for wpbakery page builderUltimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts6.5 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification5.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR5.3 Medium
- search atlas seo, unknown search atlas seo +1 moreSearch Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access5.4 Medium
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR5.9 Medium
- unknown appointment booking pluginLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel5.3 Medium
- unknown customer switchingCustomer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution7.5 High
- stellarwp givewpGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings6.8 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts4.3 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information6.1 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action4.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search6.8 Medium
- unknown bit formBit Form < 3.1.2 - Unauthenticated Inactive Form Submission3.7 Low
- metagauss profilegridProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID7.5 High
- kp4coder sync post with other siteSync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification6.5 Medium
- unknown remote apiRemote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter9.0 Critical
- unknown wp real ip-based access controlWP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr6.1 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing4.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR4.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization3.8 Low
- easyappointments easy appointmentsEasy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization3.8 Low
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure2.7 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet5.3 Medium
- broadcom spring tools, spring tools for eclipse, tools for vscode / cursor / theia +2 moreHTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server3.3 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: remote denial of service and information leakage6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: denial of service due to signed integer overflow7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules7.3 High
- broadcom spring tools, spring tools for eclipse +1 moreCross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips4.2 Medium
- broadcom spring tools, spring tools for eclipse +1 moreCleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations4.4 Medium
- broadcom spring tools, spring tools for eclipse +1 moreSpring Boot DevTools remote secret generated with a non-cryptographic PRNG8.3 High
- broadcom spring tools, spring tools for eclipse +1 moreSpring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces8.0 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability8.8 High
- broadcom spring tools, spring tools for eclipse, tools for vscode / cursor / theia +2 morelive information startup mode is vulnerable for remote code execution8.0 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp linux_sockets pmda: arbitrary command execution via command injection7.8 High
- buddypressBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data7.5 High
- ase admin and site enhancements (ase) proAdmin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key9.8 Critical
- fleekdash v2FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint8.8 High
- Show moreLoading…