Title	CVE ID	CVSS	Vector	Date
AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-65515	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 28, 2026
Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-65438	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 27, 2026
Dokan Pro <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-65492	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 23, 2026
Broadcast Live Video <= 7.2.4 - Unauthenticated Arbitrary File Deletion	CVE-2026-57716	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	July 21, 2026
AffiliateWP <= 2.34.0 - Reflected Cross-Site Scripting	CVE-2026-57809	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 21, 2026
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-59517	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 21, 2026
Real Estate Manager Pro <= 12.8.5 - Reflected Cross-Site Scripting	CVE-2026-57701	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 20, 2026
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.10.1 - Missing Authorization	CVE-2026-57703	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	July 20, 2026
Download Monitor - WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57427	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 16, 2026
Sprout Clients – CRM and Lead Management <= 3.2.3 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57428	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 16, 2026
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57735	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 10, 2026
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection	CVE-2026-59518	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 9, 2026
Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57691	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 9, 2026
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection	CVE-2026-57713	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	July 8, 2026
Coaching <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57397	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 8, 2026
Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57394	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 8, 2026
Real Estate Manager Pro <= 12.8.3 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57398	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 8, 2026
Bopo – WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting	CVE-2026-57422	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 8, 2026
Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting	CVE-2026-57423	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	July 8, 2026
FunnelKit Funnel Builder Pro <= 3.15.0.7 - Unauthenticated Stored Cross-Site Scripting	CVE-2026-57374	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	July 7, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation