2026 CVE Vulnerabilities
48,537 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-39481 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. |
| CVE-2026-39480 | HIGH | 7.5 | 0.4% | Jun 15, 2026 | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. |
| CVE-2026-39478 | HIGH | 8.8 | 0.4% | Jun 15, 2026 | Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions. |
| CVE-2026-39474 | HIGH | 8.8 | 0.4% | Jun 15, 2026 | Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. |
| CVE-2026-39472 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions. |
| CVE-2026-39471 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. |
| CVE-2026-39470 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. |
| CVE-2026-39463 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. |
| CVE-2026-39450 | HIGH | 7.1 | 0.4% | Jun 15, 2026 | Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. |
| CVE-2026-39449 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. |
| CVE-2026-39447 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. |
| CVE-2026-39435 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions. |
| CVE-2026-39434 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. |
| CVE-2026-34902 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions. |
| CVE-2026-34900 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. |
| CVE-2026-34898 | HIGH | 7.5 | 0.2% | Jun 15, 2026 | Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. |
| CVE-2026-34891 | HIGH | 7.5 | 0.3% | Jun 15, 2026 | Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions. |
| CVE-2026-34886 | HIGH | 7.5 | 0.3% | Jun 15, 2026 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. |
| CVE-2026-27407 | HIGH | 7.2 | 0.4% | Jun 15, 2026 | Editor Privilege Escalation in AI Engine <= 3.4.9 versions. |
| CVE-2026-27333 | HIGH | 8.1 | 0.3% | Jun 15, 2026 | Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. |
| CVE-2026-27089 | HIGH | 7.5 | 0.3% | Jun 15, 2026 | Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. |
| CVE-2026-25425 | HIGH | 7.5 | 0.4% | Jun 15, 2026 | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. |
| CVE-2026-24637 | HIGH | 8.5 | 0.3% | Jun 15, 2026 | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. |
| CVE-2026-23970 | HIGH | 7.1 | 0.2% | Jun 15, 2026 | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. |
| CVE-2026-53705 | HIGH | 7.6 | 0.4% | Jun 15, 2026 | A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack f... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now