2026 CVE Vulnerabilities
45,447 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-42378 | MEDIUM | 6.5 | 0.4% | Jun 15, 2026 | Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions. |
| CVE-2026-41556 | MEDIUM | 6.5 | 0.2% | Jun 15, 2026 | Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions. |
| CVE-2026-40799 | MEDIUM | 5.3 | 0.3% | Jun 15, 2026 | Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions. |
| CVE-2026-40796 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions. |
| CVE-2026-40795 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in Amelia <= 2.2 versions. |
| CVE-2026-40794 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in myCred <= 3.0.3 versions. |
| CVE-2026-40793 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in Groundhogg < 4.4.1 versions. |
| CVE-2026-40792 | MEDIUM | 6.3 | 0.2% | Jun 15, 2026 | Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions. |
| CVE-2026-40790 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions. |
| CVE-2026-40782 | MEDIUM | 6.5 | 0.2% | Jun 15, 2026 | Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions. |
| CVE-2026-40773 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions. |
| CVE-2026-40743 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. |
| CVE-2026-39594 | MEDIUM | 6.4 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions. |
| CVE-2026-39584 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions. |
| CVE-2026-39540 | MEDIUM | 6.5 | 0.2% | Jun 15, 2026 | Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions. |
| CVE-2026-39527 | MEDIUM | 5.4 | 0.3% | Jun 15, 2026 | Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions. |
| CVE-2026-39525 | MEDIUM | 6.5 | 0.2% | Jun 15, 2026 | Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions. |
| CVE-2026-39515 | MEDIUM | 6.5 | 0.4% | Jun 15, 2026 | Subscriber Broken Access Control in Motors < 1.4.107 versions. |
| CVE-2026-39491 | MEDIUM | 6.5 | 0.2% | Jun 15, 2026 | Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions. |
| CVE-2026-39489 | MEDIUM | 4.4 | 0.3% | Jun 15, 2026 | Author Arbitrary File Download in Download Monitor <= 5.1.9 versions. |
| CVE-2026-39468 | MEDIUM | 6.8 | 0.4% | Jun 15, 2026 | Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions. |
| CVE-2026-39451 | MEDIUM | 6.3 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions. |
| CVE-2026-34892 | MEDIUM | 6.5 | 0.3% | Jun 15, 2026 | Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions. |
| CVE-2026-25440 | MEDIUM | 5.3 | 0.2% | Jun 15, 2026 | Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions. |
| CVE-2026-52721 | MEDIUM | 5.3 | 0.1% | Jun 15, 2026 | Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trig... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now