Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.9 MEDIUM
CVE-2026-66437 — WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66434 — WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross…

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-66433 — WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

location_weather | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
4.3 MEDIUM
CVE-2026-66428 — WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vuln…

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Remote | Cross-Site Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
7.6 HIGH
CVE-2026-66427 — WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Remote | Injection
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
8.7 HIGH
CVE-2026-66050 — NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending …

Remote | Path Traversal
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.0 MEDIUM
CVE-2026-65568 — WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulne…

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65567 — WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.3 MEDIUM
CVE-2026-65564 — WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerab…

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65563 — WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabili…

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65562 — WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

betterdocs | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65561 — WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS…

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.4 MEDIUM
CVE-2026-65558 — WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Remote | Server-Side Request Forgery
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
5.9 MEDIUM
CVE-2026-65557 — WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS…

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

abandoned_cart_lite_for_woocommerce | Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.8 MEDIUM
CVE-2026-65436 — WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Remote | Path Traversal
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65435 — WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65434 — WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Remote | Information Disclosure
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-65433 — WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Br…

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-59560 — WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Remote | Authorization
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
6.5 MEDIUM
CVE-2026-59559 — WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cr…

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Remote | Cross-Site Scripting
Jul 27, 2026 Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Showing 20 of 9055 Results