[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpF0iUhAC8ArNUrks28ctnKT1Bkqj0l2iGKOhzOwOBa8":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"b2ed31e1-fd33-4544-8a09-88efd5d04e66","Vulnerability & Patch Roundup — July 2026","vulnerability-patch-roundup-july-2026-32cc3b","Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting known software flaws, usually reported and disclosed already. To keep you protected from these threats, we’ve compiled this month’s key security updates and vulnerability patches for the WordPress ecosystem. If you’re already using the Sucuri Firewall, you’re protected. These vulnerabilities are virtually patched for all clients. Continue reading Vulnerability & Patch Roundup — July 2026 at Sucuri Blog.","Sucuri's July 2026 roundup highlights several critical vulnerabilities affecting popular WordPress plugins. These include multiple Stored Cross-Site Scripting (XSS) flaws in Yoast SEO, WPForms, Ultimate Addons for Elementor, and Essential Addons for Elementor, as well as an Account Takeover vulnerability in Essential Addons for Elementor. A high-risk Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE) vulnerability in Loco Translate is also detailed. Sucuri states its firewall virtually patches these for clients, but recommends updating affected plugins.","Sucuri details July 2026 WordPress plugin vulnerabilities including XSS and RCE.","Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting known software flaws, usually reported and disclosed already.To keep you protected from these threats, we’ve compiled this month’s key security updates and vulnerability patches for the WordPress ecosystem.If you’re already using the Sucuri Firewall, you’re protected. These vulnerabilities are virtually patched for all clients. If not, consider putting a web application firewall in front of your site to block attacks before they reach your environment.PluginsYoast SEO – Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)Security Risk: Medium Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name) CVE: CVE-2026-15425 Number of Installations: 10,000,000+ Affected Software: Yoast SEO ≤ 28.0 Patched Versions: 28.1Mitigation steps: Update to Yoast SEO version 28.1 or greater.WPForms – Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post ContentSecurity Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content CVE: CVE-2026-15782 Number of Installations: 5,000,000+ Affected Software: WPForms ≤ 2.0.0.1 Patched Versions: 2.0.0.2Mitigation steps: Update to WPForms version 2.0.0.2 or greater.Essential Addons for Elementor – Authenticated (Contributor+) Account Takeover via Email Header InjectionSecurity Risk: High Vulnerability: Authenticated (Contributor+) Account Takeover via Email Header Injection CVE: CVE-2026-15155 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.6.10 Patched Versions: 6.6.11Mitigation steps: Update to Essential Addons for Elementor version 6.6.11 or greater.Ultimate Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon\u002Fdata-close-icon AttributesSecurity Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon\u002Fdata-close-icon Attributes CVE: CVE-2026-15787 Number of Installations: 2,000,000+ Affected Software: Ultimate Addons for Elementor ≤ 2.9.1 Patched Versions: 2.9.2Mitigation steps: Update to Ultimate Addons for Elementor version 2.9.2 or greater.Essential Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetSecurity Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget CVE: CVE-2026-15145 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.6.11 Patched Versions: 6.7.0Mitigation steps: Update to Essential Addons for Elementor version 6.7.0 or greater.Essential Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color SettingsSecurity Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings CVE: CVE-2026-15156 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.6.11 Patched Versions: 6.7.0Mitigation steps: Update to Essential Addons for Elementor version 6.7.0 or greater.Essential Addons for Elementor – Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget PopupSecurity Risk: Medium Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup CVE: CVE-2026-6459 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.6.2 Patched Versions: 6.6.3Mitigation steps: Update to Essential Addons for Elementor version 6.6.3 or greater.Loco Translate – Cross-Site Request Forgery to Remote Code Execution via ‘template’ ParameterSecurity Risk: High Vulnerability: Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter CVE: CVE-2026-15005 Number of Installations: 1,000,000+ Affected Software: Loco Translate ≤ 2.8.5 Patched Versions: 2.8.6Mitigation steps: Update to Loco Translate version 2.8.6 or greater.Image Optimizer – Authenticated (Author+) Arbitrary File Deletion via Post Meta Field InjectionSecurity Risk: High Vulnerability: Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection CVE: CVE-2026-5821 Number of Installations: 1,000,000+ Affected Software: Image Optimizer ≤ 1.7.4 Patched Versions: 1.7.5Mitigation steps: Update to Image Optimizer version 1.7.5 or greater.Complianz – Authenticated (Administrator+) PHP Object InjectionSecurity Risk: Low Vulnerability: Authenticated (Administrator+) PHP Object Injection CVE: CVE-2026-65497 Number of Installations: 1,000,000+ Affected Software: Complianz ≤ 7.5.1 Patched Versions: NoneMitigation steps: No patched version listed. Review vendor guidance and apply compensating controls.Complianz – Authenticated (Author+) Server-Side Request ForgerySecurity Risk: Low Vulnerability: Authenticated (Author+) Server-Side Request Forgery CVE: CVE-2026-65496 Number of Installations: 1,000,000+ Affected Software: Complianz ≤ 7.5.1 Patched Versions: NoneMitigation steps: No patched version listed. Review vendor guidance and apply compensating controls.Spectra Legacy – Gutenberg Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting via uagb\u002Fimage BlockSecurity Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via uagb\u002Fimage Block CVE: CVE-2026-12900 Number of Installations: 1,000,000+ Affected Software: Spectra Legacy – Gutenberg Blocks ≤ 2.19.28 Patched Versions: 2.19.29Mitigation steps: Update to Spectra Legacy – Gutenberg Blocks version 2.19.29 or greater.Complianz – Unauthenticated Information ExposureSecurity Risk: High Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-65498 Number of Installations: 1,000,000+ Affected Software: Complianz ≤ 7.5.1 Patched Versions: NoneMitigation steps: No patched version listed. Review vendor guidance and apply compensating controls.Smash Balloon Social Photo Feed – Cross-Site Request Forgery to oEmbed Access Token Overwrite via ‘sbi_access_token’ ParameterSecurity Risk: Low Vulnerability: Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter CVE: CVE-2026-12002 Number of Installations: 1,000,000+ Affected Software: Smash Balloon Social Photo Feed ≤ 6.11.1 Patched Versions: 6.11.2Mitigation steps: Update to Smash Balloon Social Photo Feed version 6.11.2 or greater.W3 Total Cache – Unauthenticated Arbitrary File Read via ‘f_array[]’ ParameterSecurity Risk: High Vulnerability: Unauthenticated Arbitrary File Read via 'f_array[]' Parameter CVE: CVE-2026-9282 Number of Installations: 900,000+ Affected Software: W3 Total Cache ≤ 2.9.4 Patched Versions: 2.10.0Mitigation steps: Update to W3 Total Cache version 2.10.0 or greater.WPvivid – Authenticated (Administrator+) SQL Injection via ‘export_data’ ParameterSecurity Risk: Low Vulnerability: Authenticated (Administrator+) SQL Injection via 'export_data' Parameter CVE: CVE-2026-17555 Number of Installations: 900,000+ Affected Software: WPvivid ≤ 0.9.131 Patched Versions: 0.9.132Mitigation steps: Update to WPvivid version 0.9.132 or greater.Widgets for Google Reviews – Authenticated (Editor+) Stored Cross-Site Scripting via ‘fomo-title’ and ‘fomo-text’ ParametersSecurity Risk: Medium Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters CVE: CVE-2026-11591 Number of Installations: 900,000+ Affected Software: Widgets for Google Reviews ≤ 13.3 Patched Versions: 13.3.1Mitigation steps: Update to Widgets for Google Reviews version 13.3.1 or greater.WooCommerce PayPal Payments – Unauthenticated Sensitive Information DisclosureSecurity Risk: High Vulnerability: Unauthenticated S","https:\u002F\u002Fblog.sucuri.net\u002F2026\u002F07\u002Fvulnerability-patch-roundup-july-2026.html","https:\u002F\u002Fblog.sucuri.net\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FSucuri-Vulnerability-Roundup-July-2026.png","2026-07-31T23:28:30+00:00","2026-08-01T04:00:23.238248+00:00",8,[18,21,23,25,27,29],{"name":19,"type":20},"Yoast SEO","product",{"name":22,"type":20},"WPForms",{"name":24,"type":20},"Essential Addons for Elementor",{"name":26,"type":20},"Ultimate Addons for Elementor",{"name":28,"type":20},"Loco Translate",{"name":30,"type":31},"Sucuri","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[46,50,53,56,59,62,64],{"type":47,"value":48,"context":49},"cve","CVE-2026-15425","Yoast SEO Authenticated Stored Cross-Site Scripting",{"type":47,"value":51,"context":52},"CVE-2026-15782","WPForms Authenticated Stored Cross-Site Scripting",{"type":47,"value":54,"context":55},"CVE-2026-15155","Essential Addons for Elementor Authenticated Account Takeover",{"type":47,"value":57,"context":58},"CVE-2026-15787","Ultimate Addons for Elementor Authenticated Stored Cross-Site Scripting",{"type":47,"value":60,"context":61},"CVE-2026-15145","Essential Addons for Elementor Authenticated Stored Cross-Site Scripting",{"type":47,"value":63,"context":61},"CVE-2026-15156",{"type":47,"value":65,"context":61},"CVE-2026-6459"]