# CVEs published 2026-08-01

148 CVEs were published on August 1, 2026: 16 critical, 50 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-13339](https://cve.now/CVE-2026-13339.md): CubeWP Framework \<= 1.1.30 - Unauthenticated Arbitrary File Read via prev\_icon/next\_icon Parameter (CVSS 7.5, cubewp1211 CubeWP Framework)
- [CVE-2026-8457](https://cve.now/CVE-2026-8457.md): WooCommerce - Social Login \<= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id\_token' JWT (CVSS 9.8, WPWeb WooCommerce - Social Login)
- [CVE-2026-18352](https://cve.now/CVE-2026-18352.md): User Access Manager \<= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter (CVSS 7.5, gm\_alex User Access Manager)
- [CVE-2026-18556](https://cve.now/CVE-2026-18556.md): Unauthenticated administrative account takeover (CVSS 8.2, KEV, N-able N-central)
- [CVE-2026-55734](https://cve.now/CVE-2026-55734.md): guardian atom exhaustion in Guardian.Permissions.encode\_permissions!/1 (CVSS 6.9, ueberauth guardian)
- [CVE-2026-55733](https://cve.now/CVE-2026-55733.md): Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation (CVSS 6.9, ueberauth guardian)
- [CVE-2026-54894](https://cve.now/CVE-2026-54894.md): Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys (CVSS 6.9, ueberauth guardian)
- [CVE-2026-55735](https://cve.now/CVE-2026-55735.md): Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation (CVSS 8.2, ueberauth guardian)
- [CVE-2026-67354](https://cve.now/CVE-2026-67354.md): guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer (CVSS 8.2, guzzle · guzzlehttp/guzzle)
- [CVE-2026-67298](https://cve.now/CVE-2026-67298.md): FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow (CVSS 8.7, FreeRDP)
- [CVE-2026-67291](https://cve.now/CVE-2026-67291.md): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH\_FRAGMENT\_ADD (CVSS 8.7, FreeRDP)
- [CVE-2026-67311](https://cve.now/CVE-2026-67311.md): Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect (CVSS 8.2, budibase)
- [CVE-2026-67300](https://cve.now/CVE-2026-67300.md): FreeRDP before 3.29.0 Use-After-Free via async message proxy (CVSS 8.7, FreeRDP)
- [CVE-2026-67299](https://cve.now/CVE-2026-67299.md): FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message (CVSS 8.7, FreeRDP)
- [CVE-2026-67288](https://cve.now/CVE-2026-67288.md): FreeRDP before 3.29.0 Denial of Service via smartcard cache (CVSS 8.7, FreeRDP)
- [CVE-2026-67303](https://cve.now/CVE-2026-67303.md): FreeRDP before 3.29.0 Denial of Service via serial DeviceControl (CVSS 5.3, FreeRDP)
- [CVE-2026-67295](https://cve.now/CVE-2026-67295.md): FreeRDP before 3.29.0 Path Traversal via drive redirection (CVSS 5.3, FreeRDP)
- [CVE-2026-67336](https://cve.now/CVE-2026-67336.md): better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider (CVSS 9.4, better-auth)
- [CVE-2026-67309](https://cve.now/CVE-2026-67309.md): Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass (CVSS 7.8, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-67326](https://cve.now/CVE-2026-67326.md): GitPython before 3.1.50 Newline Injection via config\_writer section (CVSS 7.3, gitpython-developers GitPython · gitpython)
- [CVE-2026-67340](https://cve.now/CVE-2026-67340.md): ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts (CVSS 8.6, ArcadeData arcadedb · com.arcadedb:arcadedb-engine)
- [CVE-2026-67321](https://cve.now/CVE-2026-67321.md): axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass (CVSS 6.9, axios)
- [CVE-2026-67292](https://cve.now/CVE-2026-67292.md): FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure (CVSS 9.3, FreeRDP)
- [CVE-2026-67333](https://cve.now/CVE-2026-67333.md): better-auth before 1.6.13 Stored XSS via javascript redirect\_uri (CVSS 5.1, better-auth)
- [CVE-2026-67319](https://cve.now/CVE-2026-67319.md): axios before 0.33.0 Prototype Pollution via nested option objects (CVSS 6.3, axios)
- [CVE-2026-67324](https://cve.now/CVE-2026-67324.md): GitPython 3.1.50 Authentication Bypass via Joined Short Options (CVSS 9.3, gitpython-developers GitPython · gitpython)
- [CVE-2026-67344](https://cve.now/CVE-2026-67344.md): ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE (CVSS 8.5, ArcadeData arcadedb)
- [CVE-2026-67329](https://cve.now/CVE-2026-67329.md): @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription (CVSS 7.1, better-auth stripe · @better-auth/stripe)
- [CVE-2026-67323](https://cve.now/CVE-2026-67323.md): GitPython before 3.1.51 Command Injection via unguarded Git options (CVSS 8.6, gitpython-developers GitPython · gitpython)
- [CVE-2026-67318](https://cve.now/CVE-2026-67318.md): axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 (CVSS 6.3, axios)
- [CVE-2026-67316](https://cve.now/CVE-2026-67316.md): axios before 1.18.0 Prototype Pollution via bodyless methods (CVSS 6.3, axios)
- [CVE-2026-67334](https://cve.now/CVE-2026-67334.md): better-auth Stale Sessions Persist After User Deletion (CVSS 5.1, better-auth · @better-auth/scim)
- [CVE-2026-67315](https://cve.now/CVE-2026-67315.md): axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO\_PROXY Bypass via 0.0.0.0 (CVSS 6.9, axios)
- [CVE-2025-71403](https://cve.now/CVE-2025-71403.md): better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass (CVSS 7.1, better-auth)
- [CVE-2026-67312](https://cve.now/CVE-2026-67312.md): axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON (CVSS 6.3, axios)
- [CVE-2026-66401](https://cve.now/CVE-2026-66401.md): FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 (CVSS 2.4, FreeRDP)
- [CVE-2026-67341](https://cve.now/CVE-2026-67341.md): ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION (CVSS 9.3, ArcadeData arcadedb · com.arcadedb:arcadedb-engine)
- [CVE-2026-67307](https://cve.now/CVE-2026-67307.md): Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync (CVSS 7.0, wazuh)
- [CVE-2026-67302](https://cve.now/CVE-2026-67302.md): FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service (CVSS 5.3, FreeRDP)
- [CVE-2026-67306](https://cve.now/CVE-2026-67306.md): FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE (CVSS 5.3, FreeRDP)
- [CVE-2026-67332](https://cve.now/CVE-2026-67332.md): @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass (CVSS 5.3, better-auth oauth-provider · @better-auth/oauth-provider)
- [CVE-2026-67337](https://cve.now/CVE-2026-67337.md): better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache (CVSS 7.1, better-auth)
- [CVE-2026-67310](https://cve.now/CVE-2026-67310.md): openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks (CVSS 5.3, openremote)
- [CVE-2026-67328](https://cve.now/CVE-2026-67328.md): @better-auth/sso before 1.6.21 Account Takeover via SSO (CVSS 8.6, better-auth sso)
- [CVE-2026-67289](https://cve.now/CVE-2026-67289.md): FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection (CVSS 9.3, FreeRDP)
- [CVE-2025-71404](https://cve.now/CVE-2025-71404.md): better-auth before 1.1.16 Reflected XSS via error parameter (CVSS 5.1, better-auth)
- [CVE-2026-67327](https://cve.now/CVE-2026-67327.md): better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP (CVSS 8.7, better-auth)
- [CVE-2026-67294](https://cve.now/CVE-2026-67294.md): FreeRDP before 3.29.0 TLS Certificate EKU Bypass (CVSS 9.3, FreeRDP)
- [CVE-2026-67343](https://cve.now/CVE-2026-67343.md): ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server (CVSS 8.7, ArcadeData arcadedb)
- [CVE-2026-67296](https://cve.now/CVE-2026-67296.md): FreeRDP before 3.29.0 Denial of Service via RDPEI PDU (CVSS 8.7, FreeRDP)
- [CVE-2026-67355](https://cve.now/CVE-2026-67355.md): guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope (CVSS 8.2, guzzle · guzzlehttp/guzzle)
- [CVE-2026-67331](https://cve.now/CVE-2026-67331.md): better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass (CVSS 8.7, better-auth scim · @better-auth/scim)
- [CVE-2026-67320](https://cve.now/CVE-2026-67320.md): axios before 0.33.0 Prototype Pollution via Node HTTP adapter (CVSS 8.3, axios)
- [CVE-2026-67304](https://cve.now/CVE-2026-67304.md): FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup (CVSS 8.7, FreeRDP)
- [CVE-2026-67338](https://cve.now/CVE-2026-67338.md): JupyterLab before 4.5.9 Stored XSS via Extension Manager (CVSS 5.1, jupyterlab)
- [CVE-2026-67353](https://cve.now/CVE-2026-67353.md): guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service (CVSS 6.9, guzzle · guzzlehttp/guzzle)
- [CVE-2026-66402](https://cve.now/CVE-2026-66402.md): FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass (CVSS 9.3, FreeRDP)
- [CVE-2026-67335](https://cve.now/CVE-2026-67335.md): better-auth before 1.6.2 OAuth State Validation Bypass (CVSS 6.0, better-auth)
- [CVE-2026-67308](https://cve.now/CVE-2026-67308.md): Wazuh GitHub Actions Shell Injection via Fork Pull Request (CVSS 9.3, wazuh)
- [CVE-2026-67339](https://cve.now/CVE-2026-67339.md): guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure (CVSS 6.9, guzzle · guzzlehttp/guzzle)
- [CVE-2026-67322](https://cve.now/CVE-2026-67322.md): GitPython before 3.1.52 Environment Variable Exfiltration via clone\_from (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-67297](https://cve.now/CVE-2026-67297.md): FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response (CVSS 8.7, FreeRDP)
- [CVE-2026-67301](https://cve.now/CVE-2026-67301.md): FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy (CVSS 8.7, FreeRDP)
- [CVE-2026-67325](https://cve.now/CVE-2026-67325.md): GitPython before 3.1.51 Command Injection via option prefix abbreviation (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-67330](https://cve.now/CVE-2026-67330.md): better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision (CVSS 9.4, better-auth scim · @better-auth/scim)
- [CVE-2026-67293](https://cve.now/CVE-2026-67293.md): FreeRDP before 3.29.0 Improper Certificate Hostname Validation (CVSS 9.3, FreeRDP)
- [CVE-2026-67342](https://cve.now/CVE-2026-67342.md): ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers (CVSS 9.3, ArcadeData arcadedb · com.arcadedb:arcadedb-server)
- [CVE-2026-67305](https://cve.now/CVE-2026-67305.md): FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr (CVSS 9.4, FreeRDP)
- [CVE-2026-67317](https://cve.now/CVE-2026-67317.md): axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream (CVSS 6.3, axios)
- [CVE-2025-71402](https://cve.now/CVE-2025-71402.md): better-auth before 1.4.0 Session Revocation via Forged Cookie (CVSS 2.0, better-auth)
- [CVE-2026-67314](https://cve.now/CVE-2026-67314.md): axios before 1.18.0 Prototype Pollution via auth subfields (CVSS 6.3, axios)
- [CVE-2026-67290](https://cve.now/CVE-2026-67290.md): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF (CVSS 8.7, FreeRDP)
- [CVE-2026-67313](https://cve.now/CVE-2026-67313.md): axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON (CVSS 6.3, axios)
- [CVE-2026-67352](https://cve.now/CVE-2026-67352.md): luci-app-https-dns-proxy Stored XSS via resolver\_url (CVSS 6.8, openwrt luci)
- [CVE-2026-10773](https://cve.now/CVE-2026-10773.md): Out-of-bounds read in DHCPv4 client message-type name lookup (net\_dhcpv4\_msg\_type\_name) (CVSS 5.4, zephyrproject zephyr)
- [CVE-2026-2411](https://cve.now/CVE-2026-2411.md): Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-18536](https://cve.now/CVE-2026-18536.md): Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP (CVSS 7.5, RRWO Data::Entropy)
- [CVE-2026-16635](https://cve.now/CVE-2026-16635.md): Pronamic Pay \<= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field (CVSS 8.8, Pronamic Pay)
- [CVE-2026-18344](https://cve.now/CVE-2026-18344.md): Responsive Thumbnail Slider \< 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter (CVSS 6.1, nik00726 Responsive Thumbnail Slider)
- [CVE-2026-15644](https://cve.now/CVE-2026-15644.md): Powerkit \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute (CVSS 6.4, codesupplyco Powerkit – Supercharge your WordPress Site)
- [CVE-2026-6453](https://cve.now/CVE-2026-6453.md): CubeWP Framework \<= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation\_id' Parameter (CVSS 6.5, cubewp1211 CubeWP Framework)
- [CVE-2025-14073](https://cve.now/CVE-2025-14073.md): WooCommerce PayPal Payments \<= 3.3.2 - Unauthenticated Sensitive Information Disclosure (CVSS 5.3, WooCommerce PayPal Payments)
- [CVE-2026-17555](https://cve.now/CVE-2026-17555.md): WPvivid \<= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export\_data' Parameter (CVSS 4.9, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2026-17571](https://cve.now/CVE-2026-17571.md): Fluent Forms \<= 6.2.8 - Reflected Cross-Site Scripting via 'param' (CVSS 6.1, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-15964](https://cve.now/CVE-2026-15964.md): Single Sign On For TNG \<= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change (CVSS 9.8, britcoder Single Sign On For TNG)
- [CVE-2026-15649](https://cve.now/CVE-2026-15649.md): Powerkit \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, codesupplyco Powerkit – Supercharge your WordPress Site)
- [CVE-2026-16091](https://cve.now/CVE-2026-16091.md): GamiPress \<= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress\_rank' Shortcode (CVSS 6.4, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2026-17580](https://cve.now/CVE-2026-17580.md): Advanced Views \<= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints (CVSS 6.5, wplakeorg Advanced Views – Display Custom Fields (ACF, Pods…)
- [CVE-2026-15950](https://cve.now/CVE-2026-15950.md): Cozy Blocks \<= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Page Builder for Gutenberg Editor…)
- [CVE-2026-18059](https://cve.now/CVE-2026-18059.md): PixelYourSite \<= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation (CVSS 5.3, PixelYourSite – Your smart PIXEL (TAG) & API Manager · Pixe…)
- [CVE-2026-15052](https://cve.now/CVE-2026-15052.md): MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder \<= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values (CVSS 7.2, umarbajwa MailChimp Subscribe Form, Optin Builder, PopUp Bu…)
- [CVE-2026-15450](https://cve.now/CVE-2026-15450.md): NEX-Forms \<= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter (CVSS 8.1, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-17605](https://cve.now/CVE-2026-17605.md): Payment forms, Buy now buttons, and Invoicing System | GetPaid \<= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field (CVSS 6.6, stiofansisland Payment forms, Buy now buttons, and Invoicin…)
- [CVE-2026-15951](https://cve.now/CVE-2026-15951.md): Icegram Mailer \<= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter (CVSS 4.9, Icegram Mailer – Reliable Email Deliverability, No-code SMT…)
- [CVE-2026-16144](https://cve.now/CVE-2026-16144.md): Kali Forms \<= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter (CVSS 8.1, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-15018](https://cve.now/CVE-2026-15018.md): Database Collation Fix \<= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter (CVSS 5.3, davejesch Database Collation Fix)
- [CVE-2026-16614](https://cve.now/CVE-2026-16614.md): GSheetConnector \<= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, westerndeal GSheetConnector – CF7 Google Sheets Connector)
- [CVE-2026-11995](https://cve.now/CVE-2026-11995.md): Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \<= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process\_bulk\_action() (CVSS 5.3, saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…)
- [CVE-2026-16685](https://cve.now/CVE-2026-16685.md): Download Manager \<= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-16090](https://cve.now/CVE-2026-16090.md): GamiPress \<= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress\_achievement Shortcode (CVSS 6.4, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2026-18062](https://cve.now/CVE-2026-18062.md): Kadence Blocks \<= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-18435](https://cve.now/CVE-2026-18435.md): Kadence Blocks \<= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-15645](https://cve.now/CVE-2026-15645.md): Powerkit \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute (CVSS 6.4, codesupplyco Powerkit – Supercharge your WordPress Site)
- [CVE-2026-15662](https://cve.now/CVE-2026-15662.md): Advanced Woo Labels \<= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg\_color' Parameter (CVSS 6.4, mihail-barinov Advanced Woo Labels – Product Labels & Badge…)
- [CVE-2026-15601](https://cve.now/CVE-2026-15601.md): Kirki \<= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) (CVSS 4.9, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-13458](https://cve.now/CVE-2026-13458.md): GenerateBlocks \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes (CVSS 6.4, edge22 GenerateBlocks)
- [CVE-2026-10782](https://cve.now/CVE-2026-10782.md): RealHomes Memberships \<= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims\_add\_paypal\_recurring\_membership' AJAX Action (CVSS 4.3, inspirythemes RealHomes Memberships)
- [CVE-2026-16087](https://cve.now/CVE-2026-16087.md): Icegram Engage \<= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages\[\]\[id\]' Parameter (CVSS 6.5, Icegram Engage – Popups, Optins, CTAs & Lead Generation)
- [CVE-2026-16684](https://cve.now/CVE-2026-16684.md): Easy Property Listings \<= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method (CVSS 6.4, mervb1 Easy Property Listings)
- [CVE-2026-2916](https://cve.now/CVE-2026-2916.md): Jeg Kit for Elementor \<= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script (CVSS 4.3, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-15988](https://cve.now/CVE-2026-15988.md): AI Engine \<= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST\_URI Substring Match (CVSS 8.8, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-14469](https://cve.now/CVE-2025-14469.md): Theme Editor \<= 3.1 - Cross-Site Request Forgery to CSS Modification (CVSS 4.3, mndpsingh287 Theme Editor)
- [CVE-2026-14840](https://cve.now/CVE-2026-14840.md): YOP Poll \< 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing (CVSS 5.3, YOP Poll)
- [CVE-2026-14839](https://cve.now/CVE-2026-14839.md): Mapster WP Maps \< 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure (CVSS 7.5, Mapster WP Maps)
- [CVE-2026-14823](https://cve.now/CVE-2026-14823.md): Event Tickets \< 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR (CVSS 2.2, Event Tickets and Registration)
- [CVE-2026-14822](https://cve.now/CVE-2026-14822.md): Event Tickets \< 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation (CVSS 5.3, Event Tickets and Registration)
- [CVE-2026-14561](https://cve.now/CVE-2026-14561.md): Authora - Easy Login with Mobile Number \< 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure (CVSS 6.5, Authora : Easy login with mobile number)
- [CVE-2026-14315](https://cve.now/CVE-2026-14315.md): Pixel Tag Manager for WooCommerce \< 2.2.1 - Unauthenticated Forged Conversion Event Submission (CVSS 6.5, Pixel Tag Manager for WooCommerce)
- [CVE-2026-14292](https://cve.now/CVE-2026-14292.md): WordPress Download Manager \< 3.3.66 - Author+ Stored XSS via Package Title (CVSS 5.4, Download Manager)
- [CVE-2026-14214](https://cve.now/CVE-2026-14214.md): Amelia \< 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment (CVSS 2.7, Booking for Appointments and Events Calendar)
- [CVE-2026-14195](https://cve.now/CVE-2026-14195.md): Brizy – Page Builder \< 2.8.18 - Contributor+ Sensitive Information Disclosure via get\_post\_info (CVSS 2.7, Brizy)
- [CVE-2026-13729](https://cve.now/CVE-2026-13729.md): Podlove Podcast Publisher \< 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF (CVSS 4.3, Podlove Podcast Publisher)
- [CVE-2026-13725](https://cve.now/CVE-2026-13725.md): Dynamic Pricing With Discount Rules for WooCommerce \< 5.0.0 - Reflected XSS via wdpAjax (CVSS 7.1, Dynamic Pricing With Discount Rules for WooCommerce)
- [CVE-2026-13604](https://cve.now/CVE-2026-13604.md): Pixelavo \< 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo\_event AJAX (CVSS 5.3, Pixelavo)
- [CVE-2026-13596](https://cve.now/CVE-2026-13596.md): Participants Database \< 2.7.8.4 - Unauthenticated SQL Injection via List Search (CVSS 9.1, Participants Database)
- [CVE-2026-13329](https://cve.now/CVE-2026-13329.md): WC Buckaroo BPE Gateway \< 4.9.0 - Subscriber+ Unauthorized Order Refund (CVSS 6.5, Buckaroo Woocommerce Payments Plugin)
- [CVE-2026-12696](https://cve.now/CVE-2026-12696.md): wpForo Forum \< 3.1.2 - Subscriber+ Stored XSS via Profile Location Field (CVSS 5.4, wpForo Forum)
- [CVE-2026-11882](https://cve.now/CVE-2026-11882.md): Builderall for WordPress \< 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes (CVSS 3.7, Builderall for WordPress)
- [CVE-2026-10827](https://cve.now/CVE-2026-10827.md): Spectra (Ultimate Addons for Gutenberg) \< 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes (CVSS 3.5, Spectra Legacy)
- [CVE-2026-13157](https://cve.now/CVE-2026-13157.md): Theme Demo Import \<= 1.1.3 - Admin+ Arbitrary File Upload (CVSS 7.2, Theme Demo Import)
- [CVE-2026-13158](https://cve.now/CVE-2026-13158.md): Everest Toolkit \<= 1.2.3 - Admin+ Arbitrary File Upload (CVSS 7.2, Everest Toolkit)
- [CVE-2026-15234](https://cve.now/CVE-2026-15234.md): Codeless Page Builder \<= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute (CVSS 5.4, Codeless Page Builder)
- [CVE-2026-15262](https://cve.now/CVE-2026-15262.md): Admin Columns for ACF Fields \<= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column (CVSS 5.4, Admin Columns for ACF Fields)
- [CVE-2026-15368](https://cve.now/CVE-2026-15368.md): Profile Builder \< 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration (CVSS 8.1, User Profile Builder)
- [CVE-2026-15244](https://cve.now/CVE-2026-15244.md): HUSKY - Products Filter Professional for WooCommerce \< 1.4.1 - Shop Manager+ Local File Inclusion via meta\_filter search\_view (CVSS 7.2, HUSKY)
- [CVE-2026-14836](https://cve.now/CVE-2026-14836.md): Login/Signup Popup \< 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass (CVSS 8.1, Login & Register Forms)
- [CVE-2026-14596](https://cve.now/CVE-2026-14596.md): DynamicKit for Elementor \< 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection (CVSS 8.8, DynamicKit for Elementor)
- [CVE-2026-14309](https://cve.now/CVE-2026-14309.md): Chat On Desk \< 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass (CVSS 8.1, Chat On Desk Order Notifications)
- [CVE-2026-14197](https://cve.now/CVE-2026-14197.md): Fluent Support \< 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR (CVSS 3.8, Fluent Support)
- [CVE-2026-12966](https://cve.now/CVE-2026-12966.md): Direct Payments for WooCommerce \< 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions (CVSS 5.3, Direct Payments for WooCommerce)
- [CVE-2025-15669](https://cve.now/CVE-2025-15669.md): Bit Form \< 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label (CVSS 4.8, Bit Form)
- [CVE-2026-15932](https://cve.now/CVE-2026-15932.md): Support Genix Lite \< 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal (CVSS 5.3, Support Genix)
- [CVE-2026-3141](https://cve.now/CVE-2026-3141.md): FormGent \<= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file\_token' Parameter (CVSS 9.1, wpwax FormGent – Next-Gen AI Form Builder for WordPress wit…)
- [CVE-2026-15403](https://cve.now/CVE-2026-15403.md): Pinpoint Booking System \<= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter (CVSS 4.9, dotonpaper Pinpoint Booking System –)
- [CVE-2026-15006](https://cve.now/CVE-2026-15006.md): Bit integrations \<= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field (CVSS 7.5, bitpressadmin Bit integrations – Form Integration, Webhook,…)
- [CVE-2026-13362](https://cve.now/CVE-2026-13362.md): SendPulse Email Marketing Newsletter \<= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_sp\_form\_code Post Meta (CVSS 6.4, SendPulse Email Marketing Newsletter)
- [CVE-2026-15414](https://cve.now/CVE-2026-15414.md): Subscriptions for WooCommerce \<= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '\_wps\_plan\_user\_role' Membership Plan Meta (CVSS 8.8, wpswings Subscriptions for WooCommerce)
- [CVE-2026-7623](https://cve.now/CVE-2026-7623.md): SureForms \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute (CVSS 6.4, brainstormforce SureForms – Contact Form Builder, AI Forms,…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.