2026 CVE Vulnerabilities
48,546 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-7616 | MEDIUM | 4.3 | 0.1% | May 12, 2026 | The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, ... |
| CVE-2026-7562 | MEDIUM | 4.3 | 0.1% | May 12, 2026 | The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including ... |
| CVE-2026-7561 | MEDIUM | 6.1 | 0.1% | May 12, 2026 | The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a... |
| CVE-2026-7464 | MEDIUM | 6.1 | 0.2% | May 12, 2026 | The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` param... |
| CVE-2026-7437 | MEDIUM | 6.1 | 0.2% | May 12, 2026 | The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `editpos_hidden` parameter in ... |
| CVE-2026-7050 | MEDIUM | 4.3 | 0.3% | May 12, 2026 | The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. Thi... |
| CVE-2026-6932 | MEDIUM | 4.3 | 0.1% | May 12, 2026 | The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to a... |
| CVE-2026-6913 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all... |
| CVE-2026-6808 | MEDIUM | 6.1 | 0.3% | May 12, 2026 | The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter ... |
| CVE-2026-6710 | MEDIUM | 4.3 | 0.1% | May 12, 2026 | The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in... |
| CVE-2026-6709 | MEDIUM | 4.3 | 0.2% | May 12, 2026 | The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to a... |
| CVE-2026-6708 | MEDIUM | 5.3 | 0.3% | May 12, 2026 | The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in al... |
| CVE-2026-6663 | MEDIUM | 4.8 | 0.3% | May 12, 2026 | The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up... |
| CVE-2026-6402 | MEDIUM | 6.5 | 0.2% | May 12, 2026 | webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving o... |
| CVE-2026-6256 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the ... |
| CVE-2026-6247 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute o... |
| CVE-2026-6237 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl... |
| CVE-2026-5715 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post... |
| CVE-2026-5693 | MEDIUM | 5.3 | 0.2% | May 12, 2026 | The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing... |
| CVE-2026-5340 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Fancy Image Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fancy-img-show`... |
| CVE-2026-5028 | MEDIUM | 6.5 | 0.2% | May 12, 2026 | The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' p... |
| CVE-2026-4920 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in... |
| CVE-2026-4859 | MEDIUM | 6.4 | 0.2% | May 12, 2026 | The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the... |
| CVE-2026-4301 | MEDIUM | 4.3 | 0.3% | May 12, 2026 | The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorizatio... |
| CVE-2026-3604 | MEDIUM | 4.9 | 0.2% | May 12, 2026 | The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_kcseo_ativ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now