Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-57373 — WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) v…

Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.1 HIGH
CVE-2026-57370 — WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Sit…

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.1 HIGH
CVE-2026-57367 — WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.3 MEDIUM
CVE-2026-27423 — WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-27422 — WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-27418 — WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-27403 — WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-27399 — WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.3 MEDIUM
CVE-2026-27392 — WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in uListing <= 2.2.0 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-27391 — WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in uListing <= 2.2.0 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.7 MEDIUM
CVE-2026-27377 — WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken…

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-27372 — WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerabili…

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

peprodev_ultimate_invoice | Remote | Information Disclosure
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-27355 — WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

ditty | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
9.1 CRITICAL
CVE-2026-27064 — WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.

mailster | Remote | Path Traversal
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-25466 — WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

wp_go_maps | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-25427 — WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.3 MEDIUM
CVE-2026-25424 — WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

mediavine_control_panel | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
8.5 HIGH
CVE-2026-25405 — WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability

Contributor SQL Injection in eRoom <= 1.7.1 versions.

Remote | Injection
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
4.4 MEDIUM
CVE-2026-24639 — WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability

Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.

Remote | Server-Side Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.9 MEDIUM
CVE-2026-24628 — WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulner…

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

photo_gallery | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Showing 20 of 8918 Results