CVE-2026-65607
— SiYuan before v3.7.2 Path Traversal via /export/temp/
SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch …
Remote
|
Path Traversal
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the applic…
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65605
— SiYuan before v3.7.2 Stored XSS to RCE via Attribute View
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escap…
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65550
— WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65540
— WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CS…
Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65539
— WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65538
— WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65537
— WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 -…
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65536
— WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cr…
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65535
— WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
Remote
|
Information Disclosure
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65534
— WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting…
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65533
— WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65532
— WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
Remote
|
Injection
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65531
— WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
qubely
|
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65530
— WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65529
— WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65528
— WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65527
— WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65526
— WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability
Contributor SQL Injection in Visualizer <= 4.0.6 versions.
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65525
— WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
