Latest CVE Vulnerabilities – Page 2

7.1 HIGH

CVE-2026-28569 — WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Remote | Cross-Site Scripting

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

7.1 HIGH

CVE-2026-28568 — WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Remote | Cross-Site Scripting

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

7.5 HIGH

CVE-2026-28567 — WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

9.6 CRITICAL

CVE-2026-28192 — WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulne…

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Remote | Authentication

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

8.8 HIGH

CVE-2026-28191 — WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in The Grid <= 2.7.9.1 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

8.8 HIGH

CVE-2026-24301 — Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

6.0 MEDIUM

CVE-2026-17084 — stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior …

cpython cpython | Remote | Information Disclosure

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

8.7 HIGH

CVE-2026-66046 — Expat Denial of Service via storeAtts() Quadratic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-n…

Remote | Denial of Service

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

6.9 MEDIUM

CVE-2026-75872 — HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-…

Remote | Injection

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

9.3 CRITICAL

CVE-2026-74015 — WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Remote | Injection

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

8.8 HIGH

CVE-2026-74012 — WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.

Remote | Injection

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

5.3 MEDIUM

CVE-2026-74009 — WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (I…

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

5.3 MEDIUM

CVE-2026-74008 — WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Dat…

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.

shortcodes_and_extra_features_for_phlox_theme | Remote | Information Disclosure

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

5.3 MEDIUM

CVE-2026-74007 — WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - S…

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Remote | Information Disclosure

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

4.3 MEDIUM

CVE-2026-74006 — WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

5.4 MEDIUM

CVE-2026-74004 — WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - …

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

4.3 MEDIUM

CVE-2026-74003 — WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerabili…

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

Remote | Authorization

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

7.5 HIGH

CVE-2026-73997 — WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vuln…

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Remote | Denial of Service

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

9.8 CRITICAL

CVE-2026-73996 — WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Remote | Authentication

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

5.4 MEDIUM

CVE-2026-73995 — WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

user_registration | Remote | Authentication

Aug 18, 2026 Aug 18, 2026

Aug 18, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences