CVEs

387,427 total · page 794 of 7,749

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-61956	WordPress Sync Basalam	Hig	0.00	7.1	0.00	Jul 13, 2026	Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام – همگام سازی ووکامرس و باسلام: from n/a…
CVE-2026-61955	WordPress persian-gravity-forms	Hig	0.00	7.6	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.
CVE-2026-61952	WordPress WooCommerce Bulk Edit Products – WP Sheet Editor	Med	0.00	4.9	0.00	Jul 13, 2026	Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a…
CVE-2026-59523	WordPress Simply Schedule Appointments	Med	0.35	6.5	0.00	Jul 13, 2026	Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.11.11.
CVE-2026-59521	WordPress Real Testimonials	Hig	0.00	7.2	0.01	Jul 13, 2026	Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.
CVE-2026-59518	WordPress Directorist	Cri	0.00	9.8	0.01	Jul 13, 2026	Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
CVE-2026-59516	Room 34 Creative Services, LLC ICS Calendar	Hig	0.00	7.1	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
CVE-2026-59515	Sergey Aiwu AI Copilot Content Generator	Cri	0.00	9.3	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
CVE-2026-57816	Funnelkit Funnel Builder	Hig	0.00	7.1	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.
CVE-2026-57815	WordPress Forminator	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.
CVE-2026-57814	WordPress Forminator	Hig	0.00	7.1	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.
CVE-2026-57813	WordPress Mailoptin	Cri	0.00	9.8	0.00	Jul 13, 2026	Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3.
CVE-2026-57812	WordPress Simply Schedule Appointments	Med	0.00	6.5	0.00	Jul 13, 2026	Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.
CVE-2026-57811	WordPress Realtyna Organic IDX	Cri	0.00	10.0	0.01	Jul 13, 2026	Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
CVE-2026-57810	WordPress APIExperts Square for WooCommerce	Hig	0.00	8.5	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.
CVE-2026-57805	WordPress Tonda	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.
CVE-2026-57804	CodexThemes TheGem (Elementor)	Hig	0.49	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before…
CVE-2026-57803	WordPress Struktur Core	Hig	0.49	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.
CVE-2026-57802	WordPress Struktur	Hig	0.49	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.
CVE-2026-57801	WordPress SetSail	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.
CVE-2026-57800	WordPress Overworld	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.
CVE-2026-57799	Uxper Nuss	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.
CVE-2026-57798	SaurabhSharma NewsPlus Shortcodes	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0.
CVE-2026-57797	WordPress Edumall	Med	0.00	4.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.
CVE-2026-57796	WordPress Leedo	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.
CVE-2026-57795	WordPress Kitchor	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.
CVE-2026-57794	WordPress Golo Framework	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3.
CVE-2026-57793	WordPress Flow	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.
CVE-2026-57792	WordPress Dør	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.
CVE-2026-57791	WordPress Brook	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
CVE-2026-57790	WordPress Billey	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.
CVE-2026-57789	WordPress Aqua	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.
CVE-2026-57788	WordPress Aalto	Hig	0.00	7.5	0.01	Jul 13, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.
CVE-2026-57787	WordPress CWS SVGicons	Hig	0.00	8.5	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.
CVE-2026-57786	WordPress Workscout Core	Hig	0.00	8.8	0.00	Jul 13, 2026	Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.
CVE-2026-57783	WordPress Speaker	Med	0.00	6.5	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.
CVE-2026-57782	WordPress Universal Clocks	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.
CVE-2026-57781	Sovlix MeetingHub	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.
CVE-2026-57780	WordPress Envision Page Builder	Med	0.00	6.5	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.
CVE-2026-57779	WordPress Fascinate	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.
CVE-2026-57778	WordPress Booking Calendar Appointment Booking System	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
CVE-2026-57776	WordPress VW Wedding	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.
CVE-2026-57774	WordPress VW Food Corner	Med	0.00	5.3	0.00	Jul 13, 2026	Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.
CVE-2026-57773	Zorem Advanced Shipment Tracking For Woocommerce	Hig	0.00	7.6	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from…
CVE-2026-57772	WordPress Wp Inventory Manager	Hig	0.00	8.5	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.
CVE-2026-57771	WordPress Gd Rating System	Hig	0.00	8.5	0.00	Jul 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.
CVE-2026-57770	WordPress Grand Photography	Cri	0.00	9.8	0.01	Jul 13, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.
CVE-2026-57768	WordPress Houzez Login Register	Hig	0.00	8.2	0.00	Jul 13, 2026	Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.
CVE-2026-57745	WordPress RT-Theme 18 \| Extensions	Hig	0.00	7.1	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 \| Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 \| Extensions: from n/a through <= 2.5.
CVE-2026-57744	WordPress RT-Theme 18 \| Extensions	Cri	0.00	9.8	0.01	Jul 13, 2026	Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 \| Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 \| Extensions: from n/a through <= 2.5.

CVE-2026-61956HigJul 13, 2026
WordPress
Sync Basalam
risk 0.00cvss 7.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام – همگام سازی ووکامرس و باسلام: from n/a…
CVE-2026-61955HigJul 13, 2026
WordPress
persian-gravity-forms
risk 0.00cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.
CVE-2026-61952MedJul 13, 2026
WordPress
WooCommerce Bulk Edit Products – WP Sheet Editor
risk 0.00cvss 4.9epss 0.00
Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a…
CVE-2026-59523MedJul 13, 2026
WordPress
Simply Schedule Appointments
risk 0.35cvss 6.5epss 0.00
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.11.11.
CVE-2026-59521HigJul 13, 2026
WordPress
Real Testimonials
risk 0.00cvss 7.2epss 0.01
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.
CVE-2026-59518CriJul 13, 2026
WordPress
Directorist
risk 0.00cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
CVE-2026-59516HigJul 13, 2026
Room 34 Creative Services, LLC
ICS Calendar
risk 0.00cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
CVE-2026-59515CriJul 13, 2026
Sergey Aiwu
AI Copilot Content Generator
risk 0.00cvss 9.3epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
CVE-2026-57816HigJul 13, 2026
Funnelkit
Funnel Builder
risk 0.00cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.
CVE-2026-57815HigJul 13, 2026
WordPress
Forminator
risk 0.00cvss 7.5epss 0.01
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.
CVE-2026-57814HigJul 13, 2026
WordPress
Forminator
risk 0.00cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.
CVE-2026-57813CriJul 13, 2026
WordPress
Mailoptin
risk 0.00cvss 9.8epss 0.00
Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3.
CVE-2026-57812MedJul 13, 2026
WordPress
Simply Schedule Appointments
risk 0.00cvss 6.5epss 0.00
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.
CVE-2026-57811CriJul 13, 2026
WordPress
Realtyna Organic IDX
risk 0.00cvss 10.0epss 0.01
Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
CVE-2026-57810HigJul 13, 2026
WordPress
APIExperts Square for WooCommerce
risk 0.00cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.
CVE-2026-57805HigJul 13, 2026
WordPress
Tonda
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.
CVE-2026-57804HigJul 13, 2026
CodexThemes
TheGem (Elementor)
risk 0.49cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before…
CVE-2026-57803HigJul 13, 2026
WordPress
Struktur Core
risk 0.49cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.
CVE-2026-57802HigJul 13, 2026
WordPress
Struktur
risk 0.49cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.
CVE-2026-57801HigJul 13, 2026
WordPress
SetSail
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.
CVE-2026-57800HigJul 13, 2026
WordPress
Overworld
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.
CVE-2026-57799HigJul 13, 2026
Uxper
Nuss
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.
CVE-2026-57798HigJul 13, 2026
SaurabhSharma
NewsPlus Shortcodes
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0.
CVE-2026-57797MedJul 13, 2026
WordPress
Edumall
risk 0.00cvss 4.3epss 0.00
Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.
CVE-2026-57796HigJul 13, 2026
WordPress
Leedo
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.
CVE-2026-57795HigJul 13, 2026
WordPress
Kitchor
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.
CVE-2026-57794HigJul 13, 2026
WordPress
Golo Framework
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3.
CVE-2026-57793HigJul 13, 2026
WordPress
Flow
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.
CVE-2026-57792HigJul 13, 2026
WordPress
Dør
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.
CVE-2026-57791HigJul 13, 2026
WordPress
Brook
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
CVE-2026-57790HigJul 13, 2026
WordPress
Billey
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.
CVE-2026-57789HigJul 13, 2026
WordPress
Aqua
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.
CVE-2026-57788HigJul 13, 2026
WordPress
Aalto
risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.
CVE-2026-57787HigJul 13, 2026
WordPress
CWS SVGicons
risk 0.00cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.
CVE-2026-57786HigJul 13, 2026
WordPress
Workscout Core
risk 0.00cvss 8.8epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.
CVE-2026-57783MedJul 13, 2026
WordPress
Speaker
risk 0.00cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.
CVE-2026-57782MedJul 13, 2026
WordPress
Universal Clocks
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.
CVE-2026-57781MedJul 13, 2026
Sovlix
MeetingHub
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.
CVE-2026-57780MedJul 13, 2026
WordPress
Envision Page Builder
risk 0.00cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.
CVE-2026-57779MedJul 13, 2026
WordPress
Fascinate
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.
CVE-2026-57778MedJul 13, 2026
WordPress
Booking Calendar Appointment Booking System
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
CVE-2026-57776MedJul 13, 2026
WordPress
VW Wedding
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.
CVE-2026-57774MedJul 13, 2026
WordPress
VW Food Corner
risk 0.00cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.
CVE-2026-57773HigJul 13, 2026
Zorem
Advanced Shipment Tracking For Woocommerce
risk 0.00cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from…
CVE-2026-57772HigJul 13, 2026
WordPress
Wp Inventory Manager
risk 0.00cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.
CVE-2026-57771HigJul 13, 2026
WordPress
Gd Rating System
risk 0.00cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.
CVE-2026-57770CriJul 13, 2026
WordPress
Grand Photography
risk 0.00cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.
CVE-2026-57768HigJul 13, 2026
WordPress
Houzez Login Register
risk 0.00cvss 8.2epss 0.00
Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.
CVE-2026-57745HigJul 13, 2026
WordPress
RT-Theme 18 | Extensions
risk 0.00cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
CVE-2026-57744CriJul 13, 2026
WordPress
RT-Theme 18 | Extensions
risk 0.00cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.