Total CVEs

149,971

Critical Severity

4,911

High Severity

17,397

Last 7 Days

1,778
Quick preset (or use dates below)
Clear Filters
Showing 561 - 580 of 149,971 CVEs
CVE-2026-65557 MEDIUM - 5.9

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Vendor: Tychesoftwares
Product: Abandoned Cart Lite for WooCommerce
Published: Jul 27, 2026
Source: NVD
CVE-2026-65436 MEDIUM - 6.8

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Vendor: Themeum
Product: Kirki
Published: Jul 27, 2026
Source: NVD
CVE-2026-65435 MEDIUM - 6.5

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Vendor: Thrive Themes Coupon
Product: Thrive Leads Version
Published: Jul 27, 2026
Source: NVD
CVE-2026-65434 MEDIUM - 6.5

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Vendor: yoomoney
Product: ЮKassa для WooCommerce
Published: Jul 27, 2026
Source: NVD
CVE-2026-65433 MEDIUM - 6.5

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Vendor: themewant
Product: RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg
Published: Jul 27, 2026
Source: NVD
CVE-2026-59560 MEDIUM - 6.5

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Vendor: Roxnor
Product: FundEngine
Published: Jul 27, 2026
Source: NVD
CVE-2026-59559 MEDIUM - 6.5

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Vendor: themewant
Product: RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg
Published: Jul 27, 2026
Source: NVD
CVE-2026-59558 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

Vendor: wpdevelop
Product: Booking Calendar
Published: Jul 27, 2026
Source: NVD
CVE-2026-59557 MEDIUM - 6.5

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

Vendor: Franky
Product: Events Made Easy
Published: Jul 27, 2026
Source: NVD
CVE-2026-59556 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

Vendor: acowebs
Product: Dynamic Pricing With Discount Rules for WooCommerce
Published: Jul 27, 2026
Source: NVD
CVE-2026-59553 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

Vendor: RexTheme
Product: Product Feed Manager
Published: Jul 27, 2026
Source: NVD
CVE-2026-59552 HIGH - 7.2

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1.4.2 versions.

Vendor: Shahadat Hossain
Product: 3D Flipbook PDF Viewer &amp; Embedder
Published: Jul 27, 2026
Source: NVD
CVE-2026-59551 HIGH - 8.5

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Vendor: rtCamp
Product: rtMedia for WordPress, BuddyPress and bbPress
Published: Jul 27, 2026
Source: NVD
CVE-2026-59550 CRITICAL - 9.3

Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

Vendor: Strategy11 Team
Product: AWP Classifieds
Published: Jul 27, 2026
Source: NVD
CVE-2026-59549 CRITICAL - 9.3

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Vendor: rtCamp
Product: rtMedia for WordPress, BuddyPress and bbPress
Published: Jul 27, 2026
Source: NVD
CVE-2026-59548 HIGH - 7.5

Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <= 1.0.0 versions.

Vendor: Byteflows
Product: Byteflows Travel &amp; Hotel Booking
Published: Jul 27, 2026
Source: NVD
CVE-2026-59546 HIGH - 7.4

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

Vendor: John Darrel
Product: Hide My WP Ghost
Published: Jul 27, 2026
Source: NVD
CVE-2026-59539 HIGH - 7.5

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Vendor: Cozmoslabs
Product: Paid Member Subscriptions
Published: Jul 27, 2026
Source: NVD
CVE-2026-59538 CRITICAL - 9.3

Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Vendor: Ruben Garcia
Product: GamiPress
Published: Jul 27, 2026
Source: NVD
CVE-2026-59537 HIGH - 7.6

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

Vendor: Sender
Product: Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Published: Jul 27, 2026
Source: NVD