Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-66474 — WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Reques…

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Remote | Cross-Site Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66448 — WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

gallery_photoblocks | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66445 — WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

open_user_map | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.4 MEDIUM
CVE-2026-66442 — WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-66438 — WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerabil…

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
4.9 MEDIUM
CVE-2026-66437 — WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66434 — WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross…

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66433 — WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

location_weather | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
4.3 MEDIUM
CVE-2026-66428 — WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vuln…

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Remote | Cross-Site Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
7.6 HIGH
CVE-2026-66427 — WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Remote | Injection
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.0 MEDIUM
CVE-2026-65568 — WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulne…

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65567 — WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65564 — WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerab…

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65563 — WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabili…

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65562 — WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

betterdocs | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65561 — WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS…

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.4 MEDIUM
CVE-2026-65558 — WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65557 — WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS…

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

abandoned_cart_lite_for_woocommerce | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.8 MEDIUM
CVE-2026-65436 — WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Remote | Path Traversal
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65435 — WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Showing 20 of 9027 Results