CVE-2026 records published in August 2026
Page 13 of 13: records 12,001 to 12,071 of the 12,071 published in August 2026, newest first. The first page carries the figures for August 2026.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2026-18344 | Responsive Thumbnail Slider WordPress plugin reflected cross-site scripting via id parameter | 6.1CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-18062 | Kadence Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-18059 | PixelYourSite WordPress plugin unauthenticated sensitive information exposure | 5.3CNA v3.1 | 0.6% | 2026-08-01 | Fix |
| CVE-2026-17605 | Payment forms, Buy now buttons, and Invoicing System GetPaid WordPress plugin local file inclusion | 6.6CNA v3.1 | 1.2% | 2026-08-01 | Fix |
| CVE-2026-17580 | Advanced Views WordPress plugin missing authorization authenticated sensitive information exposure | 6.5CNA v3.1 | 0.6% | 2026-08-01 | Fix |
| CVE-2026-17571 | Fluent Forms WordPress plugin reflected cross-site scripting via param | 6.1CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-17555 | WPvivid WordPress plugin authenticated (Administrator+) SQL injection via export_data parameter | 4.9CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-16685 | Download Manager WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-16684 | Easy Property Listings WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-16635 | Pronamic Pay WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.6% | 2026-08-01 | Fix |
| CVE-2026-16614 | GSheetConnector WordPress plugin authenticated (Administrator+) SQL injection via s parameter | 4.9CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-16144 | Kali Forms WordPress plugin unauthenticated remote code execution via thisPermalink field parameter | 8.1CNA v3.1 | 1.2% | 2026-08-01 | Reported exploitedFix |
| CVE-2026-16091 | GamiPress WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-16090 | GamiPress WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-16087 | Icegram Engage WordPress plugin Second-order SQL injection | 6.5CNA v3.1 | 0.5% | 2026-08-01 | Fix |
| CVE-2026-15988 | AI Engine WordPress plugin cross-site request forgery to privilege escalation | 8.8CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-15964 | Single Sign On For TNG WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.9% | 2026-08-01 | Exploit codeFix |
| CVE-2026-15951 | Icegram Mailer WordPress plugin authenticated (Administrator+) SQL injection via fields parameter | 4.9CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15950 | Cozy Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-15932 | Support Genix Lite WordPress plugin unauthenticated arbitrary file read via path traversal | 5.3CISA ADP v3.1 | 0.7% | 2026-08-01 | Fix |
| CVE-2026-15662 | Advanced Woo Labels WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15649 | Powerkit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-15645 | Powerkit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15644 | Powerkit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15601 | Kirki WordPress plugin authenticated (Editor+) path traversal to arbitrary file write (Zip Slip) | 4.9CNA v3.1 | 1.1% | 2026-08-01 | Fix |
| CVE-2026-15450 | NEX-Forms WordPress plugin arbitrary file deletion | 8.1CNA v3.1 | 0.6% | 2026-08-01 | Fix |
| CVE-2026-15414 | Subscriptions for WooCommerce WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.8% | 2026-08-01 | Fix |
| CVE-2026-15403 | Pinpoint Booking System WordPress plugin SQL injection | 4.9CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15368 | Profile Builder WordPress plugin unauthenticated account takeover via Auto-Login after Registration | 8.1CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15262 | Admin Columns for ACF Fields WordPress plugin Contributor+ stored XSS via ACF field Value Column | 5.4CISA ADP v3.1 | 0.2% | 2026-08-01 | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce WordPress plugin local file inclusion | 7.2CISA ADP v3.1 | 1.1% | 2026-08-01 | Fix |
| CVE-2026-15234 | Codeless Page Builder WordPress plugin Contributor+ stored XSS via shortcode attribute | 5.4CISA ADP v3.1 | 0.2% | 2026-08-01 | |
| CVE-2026-15052 | MailChimp Subscribe Form WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15018 | Database Collation Fix WordPress plugin unauthenticated SQL injection | 5.3CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-15006 | Bit integrations WordPress plugin unauthenticated arbitrary file read via Optional CF7 file field | 7.5CNA v3.1 | 1.2% | 2026-08-01 | Fix |
| CVE-2026-14840 | YOP Poll WordPress plugin unauthenticated Vote Restriction bypass via IP Header spoofing | 5.3CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-14839 | Mapster WP Maps WordPress plugin unauthenticated Private and Draft post content disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-14836 | Login/Signup Popup WordPress plugin unauthenticated account takeover | 8.1CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-14823 | Event Tickets and Registration seating layout management insecure direct object reference | 2.2CISA ADP v3.1 | 0.2% | 2026-08-01 | Fix |
| CVE-2026-14822 | Event Tickets WordPress plugin unauthenticated PayPal order Status manipulation | 5.3CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14596 | DynamicKit for Elementor WordPress plugin unauthenticated account takeover | 8.8CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-14561 | Authora - Easy Login with Mobile Number WordPress plugin unauthenticated account takeover | 6.5CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14315 | Pixel Tag Manager for WooCommerce AJAX conversion event handler improper access control | 6.5CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14309 | Chat On Desk WordPress plugin unauthenticated account takeover via password reset OTP bypass | 8.1CISA ADP v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-14292 | WordPress Download Manager plugin Author+ stored XSS via Package Title | 5.4CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14214 | Booking for Appointments and Events Calendar customer import mass assignment | 2.7CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14197 | Fluent Support ticket reassignment insecure direct object reference | 3.8CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-14195 | Brizy Page Builder WordPress plugin Contributor+ sensitive information disclosure via get_post_info | 2.7CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-13729 | Podlove Podcast Publisher contributor, group and role management cross-site request forgery | 4.3CISA ADP v3.1 | 0.1% | 2026-08-01 | Fix |
| CVE-2026-13725 | Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin reflected XSS via wdpAjax | 7.1CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-13604 | Pixelavo WordPress plugin unauthenticated Facebook CAPI Event injection via pixelavo_event AJAX | 5.3CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-13596 | Participants Database WordPress plugin unauthenticated SQL injection via List Search | 9.1CISA ADP v3.1 | 0.5% | 2026-08-01 | Fix |
| CVE-2026-13458 | GenerateBlocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-13362 | SendPulse Email Marketing Newsletter WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-13339 | CubeWP Framework WordPress plugin unauthenticated arbitrary file read | 7.5CNA v3.1 | 0.9% | 2026-08-01 | Fix |
| CVE-2026-13329 | WC Buckaroo BPE Gateway WordPress plugin Subscriber+ unauthorized order Refund | 6.5CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-13158 | Everest Toolkit WordPress plugin Admin+ arbitrary file upload | 7.2CISA ADP v3.1 | 0.5% | 2026-08-01 | |
| CVE-2026-13157 | Theme Demo Import WordPress plugin Admin+ arbitrary file upload | 7.2CISA ADP v3.1 | 0.5% | 2026-08-01 | |
| CVE-2026-12966 | Direct Payments for WooCommerce order AJAX handlers improper access control | 5.3CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-12696 | wpForo Forum WordPress plugin Subscriber+ stored XSS via Profile Location field | 5.4CISA ADP v3.1 | 0.2% | 2026-08-01 | Fix |
| CVE-2026-11995 | Gutena Forms WordPress plugin authorization bypass | 5.3CNA v3.1 | 0.6% | 2026-08-01 | Fix |
| CVE-2026-11882 | Builderall for WordPress plugin unauthenticated OAuth access Token Poisoning via Public REST Routes | 3.7CISA ADP v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) WordPress plugin stored CSS injection | 3.5CISA ADP v3.1 | 0.2% | 2026-08-01 | Fix |
| CVE-2026-10782 | RealHomes Memberships WordPress plugin missing authorization authenticated Membership Payment bypass | 4.3CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-10773 | zephyrproject zephyr out-of-bounds read in DHCPv4 client message-type name lookup | 5.4CNA v3.1 | 0.3% | 2026-08-01 | Fix |
| CVE-2026-8457 | WooCommerce - Social Login WordPress plugin unauthenticated authentication bypass | 9.8CNA v3.1 | 0.7% | 2026-08-01 | Fix |
| CVE-2026-7623 | SureForms WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-6453 | CubeWP Framework WordPress plugin SQL injection | 6.5CNA v3.1 | 0.5% | 2026-08-01 | Fix |
| CVE-2026-3141 | FormGent WordPress plugin missing authorization unauthenticated arbitrary file deletion | 9.1CNA v3.1 | 0.9% | 2026-08-01 | Fix |
| CVE-2026-2916 | Jeg Kit for Elementor WordPress plugin exposure of sensitive information | 4.3CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2026-2411 | Zephyr Bluetooth GATT notify and indicate incorrect authorization | 6.5CNA v3.1 | 0.2% | 2026-08-01 | Fix |