Total CVEs

138,466

Critical Severity

3,569

High Severity

12,817

Last 7 Days

1,987
Quick preset (or use dates below)
Clear Filters
📅 Showing Year: 2026 (January 1 - December 31, 2026) View All Years →
Showing 1,661 - 1,680 of 34,871 CVEs
CVE-2026-39587 HIGH - 8.1

Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

Vendor: Hakan Ozevin
Product: WP BASE Booking
Published: Jun 15, 2026
Source: NVD
CVE-2026-39584 MEDIUM - 6.5

Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

Vendor: Webful Creations
Product: RepairBuddy
Published: Jun 15, 2026
Source: NVD
CVE-2026-39583 CRITICAL - 9.8

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

Vendor: Datalogics
Product: Datalogics Ecommerce Delivery
Published: Jun 15, 2026
Source: NVD
CVE-2026-39579 HIGH - 8.8

Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

Vendor: bPlugins
Product: B Blocks
Published: Jun 15, 2026
Source: NVD
CVE-2026-39540 MEDIUM - 6.5

Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

Vendor: Amit Mittal
Product: Shipment Tracker for Woocommerce
Published: Jun 15, 2026
Source: NVD
CVE-2026-39534 HIGH - 7.5

Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

Vendor: Wp Directory Kit
Product: WP Directory Kit
Published: Jun 15, 2026
Source: NVD
CVE-2026-39533 HIGH - 7.5

Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

Vendor: WPTasty
Product: AWP Classifieds
Published: Jun 15, 2026
Source: NVD
CVE-2026-39532 HIGH - 8.8

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

Vendor: Stiofan
Product: Events Calendar for GeoDirectory
Published: Jun 15, 2026
Source: NVD
CVE-2026-39530 CRITICAL - 9.3

Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

Vendor: SpeakOut!
Product: SpeakOut! Email Petitions
Published: Jun 15, 2026
Source: NVD
CVE-2026-39527 MEDIUM - 5.4

Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

Vendor: sc Internet Vivoo
Product: WpStream
Published: Jun 15, 2026
Source: NVD
CVE-2026-39525 MEDIUM - 6.5

Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

Vendor: Booking Activities Team
Product: Booking Activities
Published: Jun 15, 2026
Source: NVD
CVE-2026-39524 HIGH - 7.5

Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

Vendor: ThemeGrill
Product: Masteriyo - LMS
Published: Jun 15, 2026
Source: NVD
CVE-2026-39519 CRITICAL - 9.3

Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

Vendor: Ahmad
Product: GeekyBot
Published: Jun 15, 2026
Source: NVD
CVE-2026-39518 HIGH - 7.1

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Vendor: EventPrime
Product: EventPrime
Published: Jun 15, 2026
Source: NVD
CVE-2026-39515 MEDIUM - 6.5

Subscriber Broken Access Control in Motors < 1.4.107 versions.

Vendor: StylemixThemes
Product: Motors
Published: Jun 15, 2026
Source: NVD
CVE-2026-39514 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

Vendor: Cozmoslabs
Product: Paid Member Subscriptions
Published: Jun 15, 2026
Source: NVD
CVE-2026-39513 HIGH - 7.5

Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

Vendor: Easy Appointments
Product: Easy Appointments
Published: Jun 15, 2026
Source: NVD
CVE-2026-39512 CRITICAL - 9.3

Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

Vendor: Paolo
Product: GeoDirectory
Published: Jun 15, 2026
Source: NVD
CVE-2026-39511 CRITICAL - 9.3

Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

Vendor: Jacob N. Breetvelt
Product: WP Photo Album Plus
Published: Jun 15, 2026
Source: NVD
CVE-2026-39507 HIGH - 7.1

Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

Vendor: Themeisle
Product: Social Slider Feed
Published: Jun 15, 2026
Source: NVD