2026 CVE Vulnerabilities
64,617 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-8866 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortco... |
| CVE-2026-8847 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in versio... |
| CVE-2026-8846 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'TUXQUOTE' shortcode in versions ... |
| CVE-2026-8845 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortco... |
| CVE-2026-8844 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in v... |
| CVE-2026-8842 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcod... |
| CVE-2026-8837 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adi... |
| CVE-2026-8787 | HIGH | 8.8 | 0.3% | May 27, 2026 | The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to,... |
| CVE-2026-8760 | CRITICAL | 9.8 | 0.6% | May 27, 2026 | The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6... |
| CVE-2026-8708 | MEDIUM | 4.3 | 0.1% | May 27, 2026 | The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu... |
| CVE-2026-8707 | MEDIUM | 6.1 | 0.2% | May 27, 2026 | The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versi... |
| CVE-2026-8703 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all ver... |
| CVE-2026-8702 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribut... |
| CVE-2026-8701 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `tit... |
| CVE-2026-8698 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version... |
| CVE-2026-8048 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode att... |
| CVE-2026-8040 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute ... |
| CVE-2026-7614 | MEDIUM | 4.3 | 0.1% | May 27, 2026 | The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in... |
| CVE-2026-6268 | HIGH | 7.1 | 0.2% | May 27, 2026 | The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_n... |
| CVE-2026-9236 | MEDIUM | 4.3 | 0.1% | May 27, 2026 | The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cros... |
| CVE-2026-8450 | CRITICAL | 9.1 | 1.5% | May 27, 2026 | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string arg... |
| CVE-2026-6287 | MEDIUM | 5.4 | 0.2% | May 27, 2026 | The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site S... |
| CVE-2026-49000 | HIGH | 7 | 0.1% | May 27, 2026 | An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequa... |
| CVE-2026-9022 | MEDIUM | 6.4 | 0.2% | May 27, 2026 | The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in... |
| CVE-2026-48999 | MEDIUM | 5.7 | 0.2% | May 27, 2026 | Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users a... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now