CVE-2026-66473
— WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65448
— WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting …
Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65447
— WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65446
— WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65445
— WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulne…
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65443
— WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65442
— WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
Remote
|
Server-Side Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65441
— WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65440
— WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65439
— WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS)…
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65438
— WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS…
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65437
— WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Sc…
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-61957
— WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulner…
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-61953
— WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF)…
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
Remote
|
Server-Side Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted …
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU ex…
|
Denial of Service
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-59240
— IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authentic…
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-55685
— React Router: Unauthenticated Denial of Service via Inefficient Route Matching
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow do…
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-53669
— React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypas…
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 an…
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link …
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
