CVE-2026-66437
— WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
Remote
|
Server-Side Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-66434
— WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross…
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-66433
— WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-66428
— WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vuln…
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
Remote
|
Cross-Site Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-66427
— WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Remote
|
Injection
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-66050
— NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending …
Remote
|
Path Traversal
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65568
— WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulne…
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65567
— WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65564
— WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerab…
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
Remote
|
Information Disclosure
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65563
— WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabili…
Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65562
— WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65561
— WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS…
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65558
— WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.
Remote
|
Server-Side Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65557
— WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS…
Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65436
— WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
Remote
|
Path Traversal
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65435
— WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65434
— WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
Remote
|
Information Disclosure
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65433
— WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Br…
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-59560
— WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-59559
— WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cr…
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
