2026 CVE Vulnerabilities
51,132 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-14226 | MEDIUM | 4.3 | 0.2% | Jul 30, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment... |
| CVE-2026-14223 | MEDIUM | 4.3 | 0.2% | Jul 30, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored cust... |
| CVE-2026-14222 | LOW | 3.8 | 0.2% | Jul 30, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its conne... |
| CVE-2026-14221 | LOW | 3.8 | 0.2% | Jul 30, 2026 | The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-mana... |
| CVE-2026-14207 | MEDIUM | 6.1 | — | Jul 30, 2026 | The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field befor... |
| CVE-2026-14188 | LOW | 2.7 | 0.2% | Jul 30, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of... |
| CVE-2026-13395 | HIGH | 8.6 | 0.2% | Jul 30, 2026 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a ... |
| CVE-2026-13345 | MEDIUM | 5.3 | 0.2% | Jul 30, 2026 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility... |
| CVE-2026-13344 | MEDIUM | 4.8 | — | Jul 30, 2026 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Ta... |
| CVE-2026-13330 | MEDIUM | 6.1 | — | Jul 30, 2026 | The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it ad... |
| CVE-2026-13178 | HIGH | 7.5 | 0.1% | Jul 30, 2026 | The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied ... |
| CVE-2026-13145 | MEDIUM | 4.3 | 0.1% | Jul 30, 2026 | The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboa... |
| CVE-2026-13143 | MEDIUM | 5.3 | 0.1% | Jul 30, 2026 | The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal po... |
| CVE-2026-12687 | HIGH | 7.5 | — | Jul 30, 2026 | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into th... |
| CVE-2026-12500 | HIGH | 7.5 | 0.1% | Jul 30, 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a... |
| CVE-2026-11881 | MEDIUM | 6.1 | — | Jul 30, 2026 | The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration setting... |
| CVE-2026-11870 | MEDIUM | 5.4 | 0.2% | Jul 30, 2026 | The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a ... |
| CVE-2026-11867 | MEDIUM | 6.5 | 0.1% | Jul 30, 2026 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term ... |
| CVE-2026-11782 | MEDIUM | 5.9 | 0.1% | Jul 30, 2026 | The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a w... |
| CVE-2026-67248 | HIGH | 8.8 | 0.2% | Jul 30, 2026 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because ... |
| CVE-2026-67247 | MEDIUM | 6.5 | 0.3% | Jul 30, 2026 | A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlle... |
| CVE-2026-67246 | MEDIUM | 6.5 | 0.3% | Jul 30, 2026 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-contro... |
| CVE-2026-67245 | HIGH | 8.1 | 0.2% | Jul 30, 2026 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled... |
| CVE-2026-1360 | HIGH | 7.5 | 0.6% | Jul 30, 2026 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and includ... |
| CVE-2026-16610 | CRITICAL | 9.8 | 0.6% | Jul 30, 2026 | The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now