Latest CVE Vulnerabilities

2.7 LOW

CVE-2026-11578 — Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR

The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limite…

contact_form | Remote | Authorization

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

6.8 MEDIUM

CVE-2026-10077 — YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes

The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users wit…

Remote | Cross-Site Scripting

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

6.4 MEDIUM

CVE-2026-13704 — GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa F…

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and inc…

givewp | Remote | Cross-Site Scripting

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

5.3 MEDIUM

CVE-2026-5348 — Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic …

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to t…

academy_lms | Remote | Authorization

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

6.4 MEDIUM

CVE-2026-10089 — Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom F…

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and including, 3.11.4. This is due to insufficien…

Remote | Cross-Site Scripting

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

4.3 MEDIUM

CVE-2026-11592 — Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contr…

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu…

email_subscribers_\&_newsletters | Remote | Authorization

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

8.1 HIGH

CVE-2026-5821 — Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta …

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() func…

Remote | Path Traversal

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

4.9 MEDIUM

CVE-2026-13357 — Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderb…

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied…

houzez_property_feed | Remote | Injection

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

7.5 HIGH

CVE-2026-14249 — Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deri…

Remote | Injection

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

4.3 MEDIUM

CVE-2026-11600 — Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorizatio…

The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) w…

envo\'s_elementor_templates_\&_widgets_for_woocommerce | Remote | Authorization

Jul 02, 2026 Jul 02, 2026

Jul 02, 2026

8.3 HIGH

CVE-2026-57278 — GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow v…