2026 CVE Vulnerabilities
64,779 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-90976 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an acco... |
| CVE-2026-89330 | MEDIUM | 6.1 | — | Sep 18, 2026 | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for ... |
| CVE-2026-89278 | MEDIUM | 5.3 | — | Sep 18, 2026 | The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is v... |
| CVE-2026-89138 | MEDIUM | 4.3 | — | Sep 18, 2026 | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.... |
| CVE-2026-88994 | MEDIUM | 6.6 | — | Sep 18, 2026 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a ... |
| CVE-2026-86800 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before ... |
| CVE-2026-86796 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request befo... |
| CVE-2026-84909 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
| CVE-2026-79713 | MEDIUM | 6.5 | — | Sep 18, 2026 | The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-... |
| CVE-2026-75017 | MEDIUM | 4.3 | — | Sep 18, 2026 | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plu... |
| CVE-2026-75016 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's client... |
| CVE-2026-18317 | MEDIUM | 4.3 | — | Sep 18, 2026 | The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to a... |
| CVE-2026-17576 | MEDIUM | 6.5 | — | Sep 18, 2026 | The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to,... |
| CVE-2026-12106 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, ... |
| CVE-2026-90984 | MEDIUM | 5.8 | — | Sep 18, 2026 | The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch... |
| CVE-2026-88993 | MEDIUM | 6.8 | — | Sep 18, 2026 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it... |
| CVE-2026-88798 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using... |
| CVE-2026-87966 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauth... |
| CVE-2026-87965 | MEDIUM | 4.8 | — | Sep 18, 2026 | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appoi... |
| CVE-2026-85350 | MEDIUM | 5.3 | — | Sep 18, 2026 | The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought ... |
| CVE-2026-85123 | MEDIUM | 5.3 | — | Sep 18, 2026 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor... |
| CVE-2026-85009 | MEDIUM | 6.5 | — | Sep 18, 2026 | The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on ... |
| CVE-2026-84902 | MEDIUM | 6.8 | — | Sep 18, 2026 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when... |
| CVE-2026-92991 | MEDIUM | 5.4 | — | Sep 18, 2026 | The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in variou... |
| CVE-2026-15650 | MEDIUM | 6.4 | — | Sep 18, 2026 | The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site S... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now