Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-65491 — WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability

Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65490 — WordPress Create by Mediavine plugin <= 2.5.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.

Remote | Information Disclosure
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65489 — WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vul…

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.1 HIGH
CVE-2026-65488 — WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forger…

Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

Remote | Cross-Site Request Forgery
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65487 — WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

photography | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65486 — WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65485 — WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.3 MEDIUM
CVE-2026-65484 — WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

style_kits | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.9 MEDIUM
CVE-2026-65483 — WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabi…

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65482 — WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS…

Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.5 HIGH
CVE-2026-65481 — WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Vino <= 1.9 versions.

Remote | Path Traversal
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65480 — WordPress TheGem theme <= 5.11.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.

thegem | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65479 — WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.4 MEDIUM
CVE-2026-65478 — WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
7.5 HIGH
CVE-2026-65477 — WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

Remote | Path Traversal
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65476 — WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

civi | Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65475 — WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulner…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2…

modula_image_gallery | Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65474 — WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

ninja_tables | Remote | Information Disclosure
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
6.5 MEDIUM
CVE-2026-65473 — WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vu…

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

Remote | Cross-Site Scripting
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
5.3 MEDIUM
CVE-2026-65472 — WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

Remote | Authorization
Jul 23, 2026 Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Showing 20 of 9814 Results