2026 CVE Vulnerabilities
43,311 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27399 | MEDIUM | 5.3 | — | Jul 23, 2026 | Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. |
| CVE-2026-27392 | MEDIUM | 4.3 | — | Jul 23, 2026 | Contributor Broken Access Control in uListing <= 2.2.0 versions. |
| CVE-2026-27391 | MEDIUM | 5.4 | — | Jul 23, 2026 | Subscriber Broken Access Control in uListing <= 2.2.0 versions. |
| CVE-2026-27377 | MEDIUM | 6.7 | — | Jul 23, 2026 | Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. |
| CVE-2026-27372 | MEDIUM | 6.5 | — | Jul 23, 2026 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| CVE-2026-27355 | MEDIUM | 5.3 | — | Jul 23, 2026 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
| CVE-2026-25466 | MEDIUM | 5.3 | — | Jul 23, 2026 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. |
| CVE-2026-25427 | MEDIUM | 5.4 | — | Jul 23, 2026 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. |
| CVE-2026-25424 | MEDIUM | 4.3 | — | Jul 23, 2026 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. |
| CVE-2026-24639 | MEDIUM | 4.4 | — | Jul 23, 2026 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. |
| CVE-2026-24628 | MEDIUM | 5.9 | — | Jul 23, 2026 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
| CVE-2026-24537 | MEDIUM | 4.3 | — | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. |
| CVE-2026-65756 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitr... |
| CVE-2026-65713 | MEDIUM | 6.5 | 0.2% | Jul 23, 2026 | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumera... |
| CVE-2026-65712 | MEDIUM | 6.2 | 0.2% | Jul 23, 2026 | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check... |
| CVE-2026-64875 | MEDIUM | 6.5 | 0.1% | Jul 23, 2026 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forw... |
| CVE-2026-64872 | MEDIUM | 6.5 | 0.2% | Jul 23, 2026 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could es... |
| CVE-2026-64871 | MEDIUM | 5.4 | 0.1% | Jul 23, 2026 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Admi... |
| CVE-2026-16078 | MEDIUM | 6.5 | 0.9% | Jul 23, 2026 | The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all ... |
| CVE-2026-15906 | MEDIUM | 6.5 | 0.5% | Jul 23, 2026 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via th... |
| CVE-2026-15827 | MEDIUM | 5.3 | 0.5% | Jul 23, 2026 | The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check ... |
| CVE-2026-15794 | MEDIUM | 6.4 | 0.3% | Jul 23, 2026 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shor... |
| CVE-2026-15786 | MEDIUM | 4.4 | 0.5% | Jul 23, 2026 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is v... |
| CVE-2026-15761 | MEDIUM | 6.5 | 0.5% | Jul 23, 2026 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event... |
| CVE-2026-15647 | MEDIUM | 4.4 | 0.3% | Jul 23, 2026 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now