# CVEs published 2026-07-11

79 CVEs were published on July 11, 2026: 5 critical, 23 high. Days are UTC.

- [CVE-2026-15470](https://cve.now/CVE-2026-15470.md): Eleveo Call Recording Software group.jsp improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-58281](https://cve.now/CVE-2026-58281.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-10660](https://cve.now/CVE-2026-10660.md): Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption (CVSS 6.4, zephyrproject zephyr)
- [CVE-2026-61870](https://cve.now/CVE-2026-61870.md): ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61861](https://cve.now/CVE-2026-61861.md): ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61858](https://cve.now/CVE-2026-61858.md): ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61857](https://cve.now/CVE-2026-61857.md): ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61465](https://cve.now/CVE-2026-61465.md): ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61454](https://cve.now/CVE-2026-61454.md): Grav before 2.0.4 Information Disclosure via \_\_GRAV\_CONFIG\_\_ (CVSS 8.7, getgrav grav)
- [CVE-2026-61448](https://cve.now/CVE-2026-61448.md): Parse Server 9.0.0 Stored XSS via malformed Content-Type (CVSS 2.1, parse-community parse-server · parse-server)
- [CVE-2026-61447](https://cve.now/CVE-2026-61447.md): PraisonAI before 1.6.78 Remote Code Execution via CodeAgent (CVSS 10.0, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61445](https://cve.now/CVE-2026-61445.md): PraisonAI before 4.6.78 Arbitrary File Write and Command Execution (CVSS 9.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61442](https://cve.now/CVE-2026-61442.md): PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH (CVSS 7.1, MervinPraison PraisonAI · praisonai-platform)
- [CVE-2026-61439](https://cve.now/CVE-2026-61439.md): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (CVSS 8.7, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61429](https://cve.now/CVE-2026-61429.md): PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend (CVSS 8.4, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61428](https://cve.now/CVE-2026-61428.md): PraisonAI AgentMail before 4.6.78 Message Injection via Webhook (CVSS 6.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61426](https://cve.now/CVE-2026-61426.md): PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-60090](https://cve.now/CVE-2026-60090.md): PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension (CVSS 9.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-60088](https://cve.now/CVE-2026-60088.md): PraisonAI before 4.6.78 Path Traversal via Custom Commands (CVSS 6.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56763](https://cve.now/CVE-2026-56763.md): Hono - Prototype Pollution via \_\_proto\_\_ Key in parseBody with dot Option (CVSS 6.3, Hono)
- [CVE-2026-56372](https://cve.now/CVE-2026-56372.md): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56303](https://cve.now/CVE-2026-56303.md): Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function (CVSS 8.7, Capgo)
- [CVE-2026-56296](https://cve.now/CVE-2026-56296.md): Cap-go - App Existence Oracle via Unauthenticated transfer\_app RPC (CVSS 6.9, Cap-go capgo)
- [CVE-2026-56240](https://cve.now/CVE-2026-56240.md): Capgo - Billing Authorization Bypass via Exhausted Usage Credits (CVSS 5.3, Capgo)
- [CVE-2026-57827](https://cve.now/CVE-2026-57827.md): Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component \< 1.17.12 (CVSS 10.0, rsjoomla.com RSFiles extension for Joomla)
- [CVE-2026-57828](https://cve.now/CVE-2026-57828.md): Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component \< 6.1.3 (CVSS 9.0, phoca.cz Phoca Download extension for Joomla)
- [CVE-2026-1359](https://cve.now/CVE-2026-1359.md): Genolve – AI image AI video generation \<= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt (CVSS 8.8, Genolve – Genolve AI Business Graphics, AI Images)
- [CVE-2026-15010](https://cve.now/CVE-2026-15010.md): bbp style pack \<= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields (CVSS 6.4, robin-w bbp style pack)
- [CVE-2026-9282](https://cve.now/CVE-2026-9282.md): W3 Total Cache \<= 2.9.4 - Unauthenticated Arbitrary File Read via 'f\_array\[\]' Parameter (CVSS 7.5, boldgrid W3 Total Cache)
- [CVE-2026-9017](https://cve.now/CVE-2026-9017.md): NEX-Forms \<= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf\_send\_nf\_email AJAX Action (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-10041](https://cve.now/CVE-2026-10041.md): WCFM – Frontend Manager for WooCommerce \<= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers (CVSS 4.3, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2026-6939](https://cve.now/CVE-2026-6939.md): CorvusPay WooCommerce Payment Gateway \<= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval\_code' Parameter (CVSS 7.2, corvusinfo CorvusPay WooCommerce Payment Gateway)
- [CVE-2026-15155](https://cve.now/CVE-2026-15155.md): Essential Addons for Elementor \<= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection (CVSS 8.8, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-12103](https://cve.now/CVE-2026-12103.md): Wallet for WooCommerce \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet\_export\_user\_search AJAX Action (CVSS 4.3, subratamal Wallet for WooCommerce)
- [CVE-2026-12126](https://cve.now/CVE-2026-12126.md): WCFM Marketplace \<= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post\_title' (CVSS 6.4, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2026-4661](https://cve.now/CVE-2026-4661.md): WP CTA \<= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter (CVSS 7.5, blendmedia WP CTA – Call Now Button, Sticky Button & Call t…)
- [CVE-2026-12994](https://cve.now/CVE-2026-12994.md): WCFM – Frontend Manager for WooCommerce \<= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller (CVSS 5.3, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2026-11591](https://cve.now/CVE-2026-11591.md): Widgets for Google Reviews \<= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters (CVSS 4.4, trustindex Widgets for Google Reviews)
- [CVE-2026-1382](https://cve.now/CVE-2026-1382.md): fresh Podcaster \<= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes (CVSS 6.4, freshlabs fresh Podcaster)
- [CVE-2025-5017](https://cve.now/CVE-2025-5017.md): Catalyst Connect Zoho CRM Client Portal \<= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter (CVSS 4.9, catalyst2020 Catalyst Connect Zoho CRM Client Portal)
- [CVE-2026-6801](https://cve.now/CVE-2026-6801.md): Context Blog \<= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter (CVSS 5.3, postmagthemes Context Blog)
- [CVE-2026-10865](https://cve.now/CVE-2026-10865.md): Cost Calculator Builder \<= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys (CVSS 5.3, stylemix Cost Calculator Builder)
- [CVE-2026-12738](https://cve.now/CVE-2026-12738.md): WP Easy Pay \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep\_draft\_confirm AJAX Action (CVSS 4.3, saadiqbal WP Easy Pay – Payment and Donation form Builder f…)
- [CVE-2026-11898](https://cve.now/CVE-2026-11898.md): White Label CMS \<= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings (CVSS 4.4, videousermanuals White Label CMS)
- [CVE-2025-6784](https://cve.now/CVE-2025-6784.md): Code Engine \<= 0.3.5 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, tigroumeow Code Engine – PHP Snippets, AI Functions & Autom…)
- [CVE-2026-11901](https://cve.now/CVE-2026-11901.md): WP Hotel Booking \<= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler (CVSS 5.3, thimpress WP Hotel Booking)
- [CVE-2026-7655](https://cve.now/CVE-2026-7655.md): SureCart \<= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook (CVSS 8.1, SureCart – Ecommerce Made Easy For Selling Physical Product…)
- [CVE-2026-13378](https://cve.now/CVE-2026-13378.md): Form Vibes \<= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field (CVSS 7.2, wpvibes Form Vibes – Save Contact Form 7 & Elementor Form E…)
- [CVE-2026-1832](https://cve.now/CVE-2026-1832.md): ThriveDesk \<= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion (CVSS 4.3, Agentic Help Desk Plugin for WordPress – Live Chat, AI Chat…)
- [CVE-2026-14262](https://cve.now/CVE-2026-14262.md): Simple JWT Login \<= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter (CVSS 8.8, nicu\_m Simple JWT Login – Allows you to use JWT on REST end…)
- [CVE-2026-6804](https://cve.now/CVE-2026-6804.md): AI Chatbot & Workflow Automation by AIWU \<= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions (CVSS 5.3, wupsales AI Copilot – Content Generator)
- [CVE-2026-15335](https://cve.now/CVE-2026-15335.md): Booking Package \<= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter (CVSS 7.5, masaakitanaka Booking Package)
- [CVE-2026-12141](https://cve.now/CVE-2026-12141.md): Premium Addons for Elementor \<= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium\_tooltip\_text' Parameter (CVSS 4.9, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2026-13250](https://cve.now/CVE-2026-13250.md): Solace Extra \<= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete\_previously\_imported AJAX Action (CVSS 5.3, solacewp Solace Extra)
- [CVE-2026-7559](https://cve.now/CVE-2026-7559.md): Affilia \<= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification (CVSS 4.3, redefiningtheweb Affiliate Program & Referral Tracking for…)
- [CVE-2026-15096](https://cve.now/CVE-2026-15096.md): Themify Builder \<= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b\_width\_map' Field (CVSS 6.4, themifyme Themify Builder)
- [CVE-2025-13968](https://cve.now/CVE-2025-13968.md): Starboard Suite Reservation Calendars \<= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, starboardsuite Starboard Suite Reservation Calendars)
- [CVE-2026-13116](https://cve.now/CVE-2026-13116.md): PDF Invoices & Packing Slips for WooCommerce \<= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order\_id' Shortcode Attribute (CVSS 4.3, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-3576](https://cve.now/CVE-2026-3576.md): Planyo online reservation system \<= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap\_url' Parameter (CVSS 7.2, xtreeme Planyo online reservation system)
- [CVE-2026-9738](https://cve.now/CVE-2026-9738.md): Print, PDF, Email by PrintFriendly \<= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content\_position\_css' Parameter (CVSS 4.4, Print, PDF & Email by PrintFriendly)
- [CVE-2026-3552](https://cve.now/CVE-2026-3552.md): SurfLink \< 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl\_import\_410' AJAX Action (CVSS 4.3, surflabtech SurfLink – Link Manager & Backup Restore)
- [CVE-2026-6803](https://cve.now/CVE-2026-6803.md): AI Chatbot & Workflow Automation by AIWU \<= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear' (CVSS 5.3, wupsales AI Copilot – Content Generator)
- [CVE-2026-2354](https://cve.now/CVE-2026-2354.md): Swiss Toolkit For WP \<= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload\_extension\_files() (CVSS 8.8, wpmessiah Swiss Toolkit For WP)
- [CVE-2026-15097](https://cve.now/CVE-2026-15097.md): Themify Builder \<= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height\_slider' Slider Module Field (CVSS 6.4, themifyme Themify Builder)
- [CVE-2026-7620](https://cve.now/CVE-2026-7620.md): Notification for Telegram \<= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb\_cron\_action\_set AJAX Action (CVSS 4.3, rainafarai Notification for Telegram)
- [CVE-2026-13114](https://cve.now/CVE-2026-13114.md): Motors \<= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info (CVSS 7.2, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-13353](https://cve.now/CVE-2026-13353.md): WP Ultimate CSV Importer \<= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter (CVSS 8.8, smackcoders WP Ultimate CSV Importer – WordPress Import & E…)
- [CVE-2026-7544](https://cve.now/CVE-2026-7544.md): Mux Video Uploader \<= 1.1.4 - Authenticated (Subscriber+) Information Exposure (CVSS 4.3, 2coders Mux Video Uploader)
- [CVE-2026-15072](https://cve.now/CVE-2026-15072.md): KiviCare \<= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-15338](https://cve.now/CVE-2026-15338.md): LA-Studio Element Kit for Elementor \<= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress\_type' Widget Setting (CVSS 7.5, choijun LA-Studio Element Kit for Elementor)
- [CVE-2026-12426](https://cve.now/CVE-2026-12426.md): Members \<= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel (CVSS 5.3, supercleanse Members – Membership & User Role Editor Plugin)
- [CVE-2026-3367](https://cve.now/CVE-2026-3367.md): Lockme OAuth2 calendars integration \<= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting (CVSS 4.4, lustmored Lockme calendars integration)
- [CVE-2026-10628](https://cve.now/CVE-2026-10628.md): Points and Rewards for WooCommerce \<= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (CVSS 4.3, wpswings Points and Rewards for WooCommerce)
- [CVE-2026-13262](https://cve.now/CVE-2026-13262.md): Majestic Support \<= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter (CVSS 6.5, ahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…)
- [CVE-2026-15073](https://cve.now/CVE-2026-15073.md): KiviCare \<= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-5743](https://cve.now/CVE-2026-5743.md): Mixed Media Gallery Blocks \<= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute (CVSS 6.4, gallerycreator SimpLy Gallery)
- [CVE-2026-8678](https://cve.now/CVE-2026-8678.md): MyParcel \<= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp\_get\_shipment\_options and wcmp\_save\_shipment\_options AJAX Actions (CVSS 4.3, richardperdaan MyParcel)
- [CVE-2026-13756](https://cve.now/CVE-2026-13756.md): WP Grid Builder \<= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter (CVSS 8.8, WP Grid Builder)
- [CVE-2026-11426](https://cve.now/CVE-2026-11426.md): UnderConstructionPage PRO \<= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template\_thumbnail Parameter (CVSS 6.5, WebFactory Under Construction Page)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.