CVEs published July 11, 2026
79 CVEs were published on July 11, 2026: 5 critical, 23 high.
- Published
- 79
- Critical
- 5
- High
- 23
- Medium
- 49
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- MervinPraison PraisonAI · praisonai
- 6
- ImageMagick · Magick.NET-Q16-AnyCPU +16
- 5
- Capgo
- 2
- iqonicdesign KiviCare – Clinic & Patient Management System
- 2
- MervinPraison PraisonAI · praisonaiagents
- 2
- themifyme Themify Builder
- 2
- wclovers WCFM – Frontend Manager for WooCommerce
- 2
- wupsales AI Copilot – Content Generator
- 2
- 2coders Mux Video Uploader
- 1
- Agentic Help Desk Plugin for WordPress – Live Chat, AI Chat…
- 1
Critical 5
- CVE-2026-61447PraisonAI before 1.6.78 Remote Code Execution via CodeAgentMervinPraison PraisonAI · praisonaiagents
- CVE-2026-61445PraisonAI before 4.6.78 Arbitrary File Write and Command ExecutionMervinPraison PraisonAI · praisonai
- CVE-2026-60090PraisonAI before 4.6.78 SQL/CQL Injection via vector dimensionMervinPraison PraisonAI · praisonai
- CVE-2026-57827Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12rsjoomla.com RSFiles extension for Joomla
- CVE-2026-57828Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3phoca.cz Phoca Download extension for Joomla
High 23
- CVE-2026-58281Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-61454Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__getgrav grav
- CVE-2026-61442PraisonAI Platform before 0.1.9 Authorization Bypass via PATCHMervinPraison PraisonAI · praisonai-platform
- CVE-2026-61439PraisonAI before 4.6.78 Prompt Injection Defense BypassMervinPraison PraisonAI · praisonai
- CVE-2026-61429PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backendMervinPraison PraisonAI · praisonaiagents
- CVE-2026-61426PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure DefaultsMervinPraison PraisonAI · praisonai
- CVE-2026-56303Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionCapgo
- CVE-2026-1359Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theoptGenolve – Genolve AI Business Graphics, AI Images
- CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameterboldgrid W3 Total Cache
- CVE-2026-6939CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parametercorvusinfo CorvusPay WooCommerce Payment Gateway
- CVE-2026-15155Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injectionwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2026-4661WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameterblendmedia WP CTA – Call Now Button, Sticky Button & Call t…
- CVE-2025-6784Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Executiontigroumeow Code Engine – PHP Snippets, AI Functions & Autom…
- CVE-2026-7655SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated WebhookSureCart – Ecommerce Made Easy For Selling Physical Product…
- CVE-2026-13378Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Fieldwpvibes Form Vibes – Save Contact Form 7 & Elementor Form E…
- CVE-2026-14262Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameternicu_m Simple JWT Login – Allows you to use JWT on REST end…
- CVE-2026-15335Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parametermasaakitanaka Booking Package
- CVE-2026-3576Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameterxtreeme Planyo online reservation system
- CVE-2026-2354Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()wpmessiah Swiss Toolkit For WP
- CVE-2026-13114Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Infostylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-13353WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parametersmackcoders WP Ultimate CSV Importer – WordPress Import & E…
- CVE-2026-15338LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Settingchoijun LA-Studio Element Kit for Elementor
- CVE-2026-13756WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' ParameterWP Grid Builder
Medium, low and unrated 51
- CVE-2026-15470Eleveo Call Recording Software group.jsp improper authorizationEleveo Call Recording Software
- CVE-2026-10660Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruptionzephyrproject zephyr
- CVE-2026-61870ImageMagick before 7.1.2-26 Memory Leak via VIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61861ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaptionImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61858ImageMagick before 7.1.2-26 Policy Bypass via APNG encoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61857ImageMagick before 7.1.2-26 Heap Use-After-Free via XMPImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61465ImageMagick before 7.1.2-26 Memory Allocation Policy BypassImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Typeparse-community parse-server · parse-server
- CVE-2026-61428PraisonAI AgentMail before 4.6.78 Message Injection via WebhookMervinPraison PraisonAI · praisonai
- CVE-2026-60088PraisonAI before 4.6.78 Path Traversal via Custom CommandsMervinPraison PraisonAI · praisonai
- CVE-2026-56763Hono - Prototype Pollution via __proto__ Key in parseBody with dot OptionHono
- CVE-2026-56372ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify MethodImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56296Cap-go - App Existence Oracle via Unauthenticated transfer_app RPCCap-go capgo
- CVE-2026-56240Capgo - Billing Authorization Bypass via Exhausted Usage CreditsCapgo
- CVE-2026-15010bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fieldsrobin-w bbp style pack
- CVE-2026-9017NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Actionwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-10041WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlerswclovers WCFM – Frontend Manager for WooCommerce
- CVE-2026-12103Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Actionsubratamal Wallet for WooCommerce
- CVE-2026-12126WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'wclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2026-12994WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controllerwclovers WCFM – Frontend Manager for WooCommerce
- CVE-2026-11591Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameterstrustindex Widgets for Google Reviews
- CVE-2026-1382fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributesfreshlabs fresh Podcaster
- CVE-2025-5017Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parametercatalyst2020 Catalyst Connect Zoho CRM Client Portal
- CVE-2026-6801Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameterpostmagthemes Context Blog
- CVE-2026-10865Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keysstylemix Cost Calculator Builder
- CVE-2026-12738WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Actionsaadiqbal WP Easy Pay – Payment and Donation form Builder f…
- CVE-2026-11898White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settingsvideousermanuals White Label CMS
- CVE-2026-11901WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handlerthimpress WP Hotel Booking
- CVE-2026-1832ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache DeletionAgentic Help Desk Plugin for WordPress – Live Chat, AI Chat…
- CVE-2026-6804AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actionswupsales AI Copilot – Content Generator
- CVE-2026-12141Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameterleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2026-13250Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Actionsolacewp Solace Extra
- CVE-2026-7559Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modificationredefiningtheweb Affiliate Program & Referral Tracking for…
- CVE-2026-15096Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Fieldthemifyme Themify Builder
- CVE-2025-13968Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesstarboardsuite Starboard Suite Reservation Calendars
- CVE-2026-13116PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attributewpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-9738Print, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' ParameterPrint, PDF & Email by PrintFriendly
- CVE-2026-3552SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Actionsurflabtech SurfLink – Link Manager & Backup Restore
- CVE-2026-6803AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'wupsales AI Copilot – Content Generator
- CVE-2026-15097Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Fieldthemifyme Themify Builder
- CVE-2026-7620Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Actionrainafarai Notification for Telegram
- CVE-2026-7544Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure2coders Mux Video Uploader
- CVE-2026-15072KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilderiqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2026-12426Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channelsupercleanse Members – Membership & User Role Editor Plugin
- CVE-2026-3367Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Settinglustmored Lockme calendars integration
- CVE-2026-10628Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actionswpswings Points and Rewards for WooCommerce
- CVE-2026-13262Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameterahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…
- CVE-2026-15073KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionControlleriqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2026-5743Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attributegallerycreator SimpLy Gallery
- CVE-2026-8678MyParcel <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Actionsrichardperdaan MyParcel
- CVE-2026-11426UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail ParameterWebFactory Under Construction Page