Latest CVE Vulnerabilities

9.8 CRITICAL

CVE-2026-49106 — WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Objec…

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

integration_for_constant_contact_and_contact_form_7\,_wpforms\,_elementor\,_ninja | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.8 CRITICAL

CVE-2026-49105 — WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms p…

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.8 CRITICAL

CVE-2026-49104 — WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formi…

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.8 CRITICAL

CVE-2026-49085 — WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms…

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-49067 — WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-48886 — WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.1 CRITICAL

CVE-2026-48881 — WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

truebooker | Remote | Authorization

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

10.0 CRITICAL

CVE-2026-48836 — WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Remote | Authentication

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-45439 — WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-42665 — WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

wp_data_access | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-42639 — WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

gd_rating_system | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-42386 — WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerabili…

Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

order_delivery_date_for_woocommerce | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-42381 — WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

funnel_builder | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-40798 — WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

wpforo_forum | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

10.0 CRITICAL

CVE-2026-40772 — WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

Remote | Misconfiguration

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-40771 — WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.9 CRITICAL

CVE-2026-39591 — WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

Remote | Misconfiguration

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.8 CRITICAL

CVE-2026-39583 — WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerabi…

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

Remote | Authorization

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-39530 — WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

speakout\!_email_petitions | Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

9.3 CRITICAL

CVE-2026-39519 — WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

Remote | Injection

Jun 15, 2026 Jun 15, 2026

Jun 15, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences