Browse CVEs

HIGH 8.5 CVE-2026-65895 Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users w… Patch available Fix from $1,9502026-07-23 HIGH 8.8 CVE-2026-65608 Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: … Patch available Fix from $1,9502026-07-23 MEDIUM 6.5 CVE-2026-65607 SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serv… Patch available Fix from $1,6002026-07-23 CRITICAL 9.6 CVE-2026-65606 SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references … Patch available Fix from $2,3002026-07-23 CRITICAL 9.6 CVE-2026-65605 SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is ren… Patch available Fix from $2,3002026-07-23 MEDIUM 5.9 CVE-2026-65550 Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.1 CVE-2026-65540 Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. No fix yet Fix from $1,9502026-07-23 HIGH 7.1 CVE-2026-65539 Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 5.9 CVE-2026-65538 Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65536 Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.9 CVE-2026-65534 Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65533 Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.6 CVE-2026-65532 Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65529 Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65528 Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65527 Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 8.5 CVE-2026-65526 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection… No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65525 Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65522 Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-65521 Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65519 Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65518 Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.2 CVE-2026-65516 Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 6.5 CVE-2026-65514 Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-65512 Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery.… No fix yet Fix from $1,6002026-07-23 HIGH 7.1 CVE-2026-65511 Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. No fix yet Fix from $1,9502026-07-23 HIGH 7.1 CVE-2026-65510 Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65506 Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-65505 Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65503 Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. No fix yet Fix from $1,6002026-07-23