# CVEs published 2026-06-27

33 CVEs were published on June 27, 2026: 1 critical, 10 high. Days are UTC.

- [CVE-2026-8095](https://cve.now/CVE-2026-8095.md): Frontend File Manager Plugin \<= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, nmedia Frontend File Manager Plugin)
- [CVE-2026-10643](https://cve.now/CVE-2026-10643.md): Out-of-bounds heap write in Zephyr \`recvmsg()\` ancillary-data path (\`insert\_pktinfo\` undersizes the control-buffer capacity check) (CVSS 8.7, zephyrproject zephyr)
- [CVE-2026-49416](https://cve.now/CVE-2026-49416.md): Integer overflow in vt(4) CONS\_HISTORY ioctl (CVSS 7.8, FreeBSD)
- [CVE-2026-49414](https://cve.now/CVE-2026-49414.md): ASLR bypass for setuid executables via procctl(2) (CVSS 7.8, FreeBSD)
- [CVE-2026-49413](https://cve.now/CVE-2026-49413.md): Flaw in Linuxulator execution of setugid binaries (CVSS 7.1, FreeBSD)
- [CVE-2026-49412](https://cve.now/CVE-2026-49412.md): Use-after-free bug in the IPV6\_MSFILTER socket option handler (CVSS 7.8, FreeBSD)
- [CVE-2026-45259](https://cve.now/CVE-2026-45259.md): sigqueue(2) missing capability mode restriction (CVSS 6.5, FreeBSD)
- [CVE-2026-45258](https://cve.now/CVE-2026-45258.md): Multiple vulnerabilities in the sound(4) mmap path (CVSS 7.8, FreeBSD)
- [CVE-2026-49417](https://cve.now/CVE-2026-49417.md): Multiple vulnerabilities in the sound(4) mmap path (CVSS 7.0, FreeBSD)
- [CVE-2026-12399](https://cve.now/CVE-2026-12399.md): Gutenverse \<= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts\[\].font.font.value' Parameter (CVSS 4.4, jegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…)
- [CVE-2026-3462](https://cve.now/CVE-2026-3462.md): Frisbii Pay \<= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification (CVSS 6.5, reepaydenmark Frisbii Pay)
- [CVE-2026-12432](https://cve.now/CVE-2026-12432.md): Stripe Payment Forms by WP Full Pay \<= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter (CVSS 5.3, themeisle Stripe Payment Forms by WP Full Pay – Accept Cred…)
- [CVE-2026-11597](https://cve.now/CVE-2026-11597.md): Surbma | Infusionsoft Shortcode \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, Surbma | Infusionsoft Shortcode)
- [CVE-2026-13295](https://cve.now/CVE-2026-13295.md): Page Builder by SiteOrigin \<= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels\_data Parameter (CVSS 6.4, gpriday Page Builder by SiteOrigin)
- [CVE-2026-12471](https://cve.now/CVE-2026-12471.md): Spexo \<= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation (CVSS 4.3, templatescoderthemes Spexo)
- [CVE-2026-11773](https://cve.now/CVE-2026-11773.md): Masteriyo LMS \<= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification (CVSS 4.3, Masteriyo LMS – LMS Course Builder, Quizzes & Certificates)
- [CVE-2026-9233](https://cve.now/CVE-2026-9233.md): Quiz and Survey Master (QSM) \<= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm\_insert\_quiz\_template AJAX Action (CVSS 4.3, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2026-11364](https://cve.now/CVE-2026-11364.md): Product Specifications for Woocommerce \<= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps\_modify\_groups' and 'dwps\_modify\_attributes' AJAX Actions (CVSS 4.3, dornaweb Product Specifications for Woocommerce)
- [CVE-2026-11783](https://cve.now/CVE-2026-11783.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \<= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU (CVSS 6.4, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-9242](https://cve.now/CVE-2026-9242.md): RegistrationMagic \<= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request (CVSS 5.3, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2026-11987](https://cve.now/CVE-2026-11987.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \<= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter (CVSS 4.3, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-9677](https://cve.now/CVE-2026-9677.md): Shariff for WordPress \<= 1.0.11 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Shariff for WordPress)
- [CVE-2026-10820](https://cve.now/CVE-2026-10820.md): ProfilePress \< 4.16.17 - Subscriber+ Subscription Cancellation via IDOR (CVSS 8.1, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2026-12404](https://cve.now/CVE-2026-12404.md): NEX-Forms \<= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-13245](https://cve.now/CVE-2026-13245.md): MaxButtons \<= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter (CVSS 6.1, maxfoundry MaxButtons – Create buttons)
- [CVE-2026-12415](https://cve.now/CVE-2026-12415.md): Invoice Generator \<= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user\_id' Parameter (CVSS 9.8, pravel Invoice Generator)
- [CVE-2025-59868](https://cve.now/CVE-2025-59868.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure (CVSS 5.5, HCLSoftware Traveler for Microsoft Outlook)
- [CVE-2026-13422](https://cve.now/CVE-2026-13422.md): HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers (CVSS 4.3, harmonic\_design HD Quiz)
- [CVE-2026-11356](https://cve.now/CVE-2026-11356.md): Ivory Search \<= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu\_title' and 'menu\_magnifier\_color' Settings (CVSS 4.4, vinod-dalvi Ivory Search – WordPress Search Plugin)
- [CVE-2026-13333](https://cve.now/CVE-2026-13333.md): Groundhogg \<= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query\[select\]' Parameter (CVSS 6.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-13335](https://cve.now/CVE-2026-13335.md): CodePeople Post Map for Google Maps \<= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm\_point' Post Meta (CVSS 6.4, CodePeople Post Map for Google Maps)
- [CVE-2026-13331](https://cve.now/CVE-2026-13331.md): Groundhogg \<= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter (CVSS 6.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-37524](https://cve.now/CVE-2023-37524.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service (CVSS 7.7, HCLSoftware Traveler for Microsoft Outlook)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.