Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-66474 — WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Reques…

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Remote | Cross-Site Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66448 — WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

gallery_photoblocks | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66445 — WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

open_user_map | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.4 MEDIUM
CVE-2026-66442 — WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-66438 — WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerabil…

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
4.9 MEDIUM
CVE-2026-66437 — WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66434 — WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross…

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66433 — WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

location_weather | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
4.3 MEDIUM
CVE-2026-66428 — WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vuln…

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Remote | Cross-Site Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
7.6 HIGH
CVE-2026-66427 — WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Remote | Injection
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.0 MEDIUM
CVE-2026-65568 — WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulne…

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65567 — WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65564 — WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerab…

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65563 — WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabili…

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65562 — WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

betterdocs | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65561 — WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS…

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.4 MEDIUM
CVE-2026-65558 — WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65557 — WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS…

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

abandoned_cart_lite_for_woocommerce | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.8 MEDIUM
CVE-2026-65436 — WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Remote | Path Traversal
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65435 — WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Showing 20 of 9027 Results