CVE-2026-65xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

632 records · Page 4 of 7

• CVE-2026-65546: WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

  Updated 2026-08-06
• CVE-2026-65545: WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  Updated 2026-08-06
• CVE-2026-65544: WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  Updated 2026-08-06
• CVE-2026-65543: WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability 7.5 High

  Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

  Updated 2026-08-06
• CVE-2026-65542: WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability 8.8 High

  Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

  Updated 2026-08-06
• CVE-2026-65541: WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability 7.3 High

  Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

  Updated 2026-08-06
• CVE-2026-65540: WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

  Updated 2026-07-23
• CVE-2026-65539: WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability 7.1 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

  Updated 2026-07-23
• CVE-2026-65538: WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

  Updated 2026-07-23
• CVE-2026-65537: WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

  Updated 2026-07-23
• CVE-2026-65536: WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

  Updated 2026-07-23
• CVE-2026-65535: WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability 4.3 Medium

  Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

  Updated 2026-07-23
• CVE-2026-65534: WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

  Updated 2026-07-23
• CVE-2026-65533: WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

  Updated 2026-07-23
• CVE-2026-65532: WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability 7.6 High

  Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

  Updated 2026-07-23
• CVE-2026-65531: WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability 4.8 Medium

  Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

  Updated 2026-07-23
• CVE-2026-65530: WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

  Updated 2026-07-23
• CVE-2026-65529: WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.

  Updated 2026-10-23
• CVE-2026-65528: WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

  Updated 2026-07-23
• CVE-2026-65527: WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

  Updated 2026-07-23
• CVE-2026-65526: WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

  Updated 2026-08-03
• CVE-2026-65525: WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

  Updated 2026-07-23
• CVE-2026-65524: WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability 4.3 Medium

  Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

  Updated 2026-07-23
• CVE-2026-65523: WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability 7.5 High

  Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

  Updated 2026-08-06
• CVE-2026-65522: WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  Updated 2026-07-23
• CVE-2026-65521: WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

  Updated 2026-07-23
• CVE-2026-65520: WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

  Updated 2026-08-06
• CVE-2026-65519: WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

  Updated 2026-07-23
• CVE-2026-65518: WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

  Updated 2026-07-23
• CVE-2026-65517: WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  Updated 2026-08-06
• CVE-2026-65516: WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  Updated 2026-07-23
• CVE-2026-65515: WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  Updated 2026-08-06
• CVE-2026-65514: WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

  Updated 2026-07-23
• CVE-2026-65513: WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  Updated 2026-08-06
• CVE-2026-65512: WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.

  Updated 2026-08-05
• CVE-2026-65511: WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  Updated 2026-07-23
• CVE-2026-65510: WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  Updated 2026-07-23
• CVE-2026-65509: WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  Updated 2026-08-06
• CVE-2026-65508: WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

  Updated 2026-08-06
• CVE-2026-65507: WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability 9.8 Critical

  Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

  Updated 2026-08-06
• CVE-2026-65506: WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

  Updated 2026-07-23
• CVE-2026-65505: WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability 5.3 Medium

  Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  Updated 2026-07-23
• CVE-2026-65504: WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

  Updated 2026-08-06
• CVE-2026-65503: WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  Updated 2026-07-23
• CVE-2026-65502: WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability 5.3 Medium

  Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

  Updated 2026-08-06
• CVE-2026-65501: WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

  Updated 2026-07-23
• CVE-2026-65500: WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  Updated 2026-07-23
• CVE-2026-65499: WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

  Updated 2026-07-23
• CVE-2026-65498: WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

  Updated 2026-08-12
• CVE-2026-65497: WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability 7.2 High

  Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

  Updated 2026-07-23
• CVE-2026-65496: WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability 4.4 Medium

  Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

  Updated 2026-07-23
• CVE-2026-65495: WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

  Updated 2026-07-23
• CVE-2026-65494: WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability 7.1 High

  Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

  Updated 2026-07-23
• CVE-2026-65493: WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability 7.5 High

  Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

  Updated 2026-07-23
• CVE-2026-65492: WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

  Updated 2026-09-21
• CVE-2026-65491: WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

  Updated 2026-07-23
• CVE-2026-65490: WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0.

  Updated 2026-09-18
• CVE-2026-65489: WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  Updated 2026-09-30
• CVE-2026-65488: WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  Updated 2026-09-30
• CVE-2026-65487: WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

  Updated 2026-07-23
• CVE-2026-65486: WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

  Updated 2026-07-23
• CVE-2026-65485: WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

  Updated 2026-07-23
• CVE-2026-65484: WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability 6.3 Medium

  Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

  Updated 2026-07-23
• CVE-2026-65483: WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

  Updated 2026-07-23
• CVE-2026-65482: WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3.

  Updated 2026-10-01
• CVE-2026-65481: WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability 7.5 High

  Contributor Local File Inclusion in Vino <= 1.9 versions.

  Updated 2026-07-23
• CVE-2026-65480: WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

  Updated 2026-08-14
• CVE-2026-65479: WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

  Updated 2026-07-23
• CVE-2026-65478: WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability 5.4 Medium

  Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

  Updated 2026-07-23
• CVE-2026-65477: WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability 7.5 High

  Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

  Updated 2026-07-23
• CVE-2026-65476: WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

  Updated 2026-07-23
• CVE-2026-65475: WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

  Updated 2026-07-23
• CVE-2026-65474: WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability 5.3 Medium

  Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

  Updated 2026-07-23
• CVE-2026-65473: WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

  Updated 2026-07-23
• CVE-2026-65472: WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

  Updated 2026-07-23
• CVE-2026-65471: WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability 9.6 Critical

  Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

  Updated 2026-07-23
• CVE-2026-65470: WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

  Updated 2026-07-23
• CVE-2026-65469: WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

  Updated 2026-07-23
• CVE-2026-65468: WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

  Updated 2026-07-23
• CVE-2026-65467: WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

  Updated 2026-07-23
• CVE-2026-65466: WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

  Updated 2026-07-23
• CVE-2026-65465: WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

  Updated 2026-07-23
• CVE-2026-65464: WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

  Updated 2026-07-23
• CVE-2026-65463: WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

  Updated 2026-07-23
• CVE-2026-65462: WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

  Updated 2026-07-23
• CVE-2026-65461: WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability 9.1 Critical

  Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

  Updated 2026-07-23
• CVE-2026-65460: WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

  Updated 2026-07-23
• CVE-2026-65459: WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability 7.5 High

  Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  Updated 2026-10-11
• CVE-2026-65458: WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.

  Updated 2026-08-06
• CVE-2026-65457: WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability 4.3 Medium

  Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

  Updated 2026-07-23
• CVE-2026-65456: WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.

  Updated 2026-07-23
• CVE-2026-65455: WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability 9.1 Critical

  Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

  Updated 2026-07-23
• CVE-2026-65454: WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

  Updated 2026-07-23
• CVE-2026-65453: WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

  Updated 2026-07-23
• CVE-2026-65452: WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

  Updated 2026-07-23
• CVE-2026-65451: WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  Updated 2026-07-23
• CVE-2026-65450: WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  Updated 2026-07-23
• CVE-2026-65449: WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

  Updated 2026-07-23
• CVE-2026-65448: WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions.

  Updated 2026-07-28
• CVE-2026-65447: WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.

  Updated 2026-07-28

Search a CVE ID or check dependency files →