Latest CVE Vulnerabilities

7.8 HIGH

CVE-2026-46733 — Dell Display and Peripheral Manager Improper Access Control Vulnerability

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this…

display_and_peripheral_manager | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

9.3 CRITICAL

CVE-2026-54836 — WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

Remote | Injection

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

5.3 MEDIUM

CVE-2026-42389 — Reject more queries with invalid header values

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

recursor | Remote

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

8.1 HIGH

CVE-2026-54842 — WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

Remote | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

0.0 NA

CVE-2026-12755 — Devolutions Server PAM AD Discovery Server-Side Request Forgery

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side…

| Authentication

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

6.5 MEDIUM

CVE-2026-57429 — WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

Remote | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56071 — WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.7 HIGH

CVE-2026-56054 — WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

Remote | Path Traversal

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

8.8 HIGH

CVE-2026-56053 — WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Remote | Injection

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56051 — WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

8.5 HIGH

CVE-2026-56049 — WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

Remote | Injection

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56042 — WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (X…

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.

advanced_order_export_for_woocommerce | Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

5.4 MEDIUM

CVE-2026-56023 — WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Con…

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

Remote | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56014 — WordPress Master Slider plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.

master_slider | Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

6.5 MEDIUM

CVE-2026-56013 — WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object Refer…

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

Remote | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56006 — WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.1 HIGH

CVE-2026-56005 — WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.

wp_activity_log | Remote | Cross-Site Scripting

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

9.3 CRITICAL

CVE-2026-54849 — WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerabili…

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Remote | Injection

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

8.1 HIGH

CVE-2026-54845 — WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

Remote | Path Traversal

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

7.5 HIGH

CVE-2026-54844 — WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerabili…

Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

Remote | Authorization

Jun 25, 2026 Jun 25, 2026

Jun 25, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences