2026 CVE Vulnerabilities
49,638 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-16067 | MEDIUM | 5.3 | 0.2% | Aug 6, 2026 | The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the ... |
| CVE-2026-15734 | CRITICAL | 9.8 | 0.3% | Aug 6, 2026 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated att... |
| CVE-2026-15733 | CRITICAL | 9.8 | 1.5% | Aug 6, 2026 | A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injectio... |
| CVE-2026-15732 | CRITICAL | 9.8 | 0.2% | Aug 6, 2026 | A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functiona... |
| CVE-2026-15256 | MEDIUM | 4.8 | 0.2% | Aug 6, 2026 | The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate ... |
| CVE-2026-15208 | MEDIUM | 5.3 | 0.1% | Aug 6, 2026 | The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, p... |
| CVE-2026-15152 | MEDIUM | 5.3 | 0.1% | Aug 6, 2026 | The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment ... |
| CVE-2026-15149 | MEDIUM | 5.3 | 0.2% | Aug 6, 2026 | The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total ar... |
| CVE-2026-15147 | MEDIUM | 5.3 | 0.1% | Aug 6, 2026 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming paymen... |
| CVE-2026-14936 | MEDIUM | 5.3 | 0.2% | Aug 6, 2026 | The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the s... |
| CVE-2026-14842 | MEDIUM | 5.3 | 0.3% | Aug 6, 2026 | The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record b... |
| CVE-2026-14831 | MEDIUM | 5.3 | 0.3% | Aug 6, 2026 | The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking durat... |
| CVE-2026-14812 | CRITICAL | 10 | 0.6% | Aug 6, 2026 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator ... |
| CVE-2026-14306 | MEDIUM | 4.3 | 0.2% | Aug 6, 2026 | The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected co... |
| CVE-2026-14225 | LOW | 2.7 | 0.2% | Aug 6, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-re... |
| CVE-2026-13399 | HIGH | 7.5 | 0.3% | Aug 6, 2026 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a... |
| CVE-2026-13342 | MEDIUM | 5.3 | 0.3% | Aug 6, 2026 | The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-base... |
| CVE-2026-12901 | MEDIUM | 5.9 | 0.1% | Aug 6, 2026 | The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, ... |
| CVE-2026-12584 | HIGH | 7.5 | 0.2% | Aug 6, 2026 | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of inco... |
| CVE-2026-12501 | MEDIUM | 5.3 | 0.2% | Aug 6, 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent... |
| CVE-2026-11976 | CRITICAL | 10 | 0.5% | Aug 6, 2026 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both ... |
| CVE-2026-11803 | HIGH | 7.8 | 0.1% | Aug 6, 2026 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A mal... |
| CVE-2026-11361 | MEDIUM | 5.9 | 0.1% | Aug 6, 2026 | The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payme... |
| CVE-2026-10599 | HIGH | 7.5 | 0.2% | Aug 6, 2026 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transact... |
| CVE-2026-10524 | HIGH | 7.5 | 0.3% | Aug 6, 2026 | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now