Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-65482 — WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS…

Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.5 HIGH
CVE-2026-65481 — WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Vino <= 1.9 versions.

Remote | Path Traversal
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65480 — WordPress TheGem theme <= 5.11.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.

thegem | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65479 — WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65478 — WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.5 HIGH
CVE-2026-65477 — WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

Remote | Path Traversal
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65476 — WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

civi | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65475 — WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulner…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2…

modula_image_gallery | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65474 — WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

ninja_tables | Remote | Information Disclosure
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65473 — WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vu…

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65472 — WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
9.6 CRITICAL
CVE-2026-65471 — WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

Remote | Cross-Site Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65470 — WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

fluent_support | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65469 — WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

awp_classifieds | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65468 — WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.9 MEDIUM
CVE-2026-65467 — WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

Remote | Server-Side Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.9 MEDIUM
CVE-2026-65466 — WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

Remote | Server-Side Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65465 — WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulner…

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65464 — WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

Remote | Cross-Site Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65463 — WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vuln…

Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Showing 20 of 9863 Results