Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-17873

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-56848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a...

EUVD-2025-210556

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

PT-2026-66588

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, via the 'addmeasurement.php' endpoint using the...

EUVD-2025-210554

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /editmember.php?id=1...

CVE-2026-13425

creationtimestamp| type| source ---|---|--- 2026-07-29 11:36:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrrtj6pzpx23 2026-07-29 11:51:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrrue7z7kt2b...

Linux Distros Unpatched Vulnerability : CVE-2026-54619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the...

CVE-2026-63303

creationtimestamp| type| source ---|---|--- 2026-07-28 16:15:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-63301...

CVE-2026-13890

An out of bounds read flaw was found in the Chromecast component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500601345...

CVE-2026-14404

An inappropriate implementation flaw was found in the PDFium component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513337989...

CGA-3R9Q-9QP3-5G66

Bulletin has no description...

CVE-2026-64355

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

EUVD-2026-48434

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)

Last week, there were 91 vulnerabilities disclosed in WordPress Core, 80 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart SEO Tool versions = 4.1.2...

CVE-2026-13181

creationtimestamp| type| source ---|---|--- 2026-07-22 16:32:32+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mraqrtt7w72g 2026-07-22 17:03:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrasjljpek2b 2026-09-08 22:20:02+00:00| seen|...

CVE-2026-16364

creationtimestamp| type| source ---|---|--- 2026-07-22 04:46:10+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 16:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mraqnhcmd52k...

CVE-2026-61210

...

CVE-2026-60678

The CVE-2026-60678 affects Oracle E-Business Suite, Oracle General Ledger (Internal Operations) in supported 12.2.3–12.2.15 releases. The vulnerability allows a low-privilege attacker with network access via SOAP to compromise Oracle General Ledger, with potential takeover and impact to confident...