[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpF0iUhAC8ArNUrks28ctnKT1Bkqj0l2iGKOhzOwOBa8":3},{"article":4,"iocs":44,"watch_terms":65,"solutions":66,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b2ed31e1-fd33-4544-8a09-88efd5d04e66","Vulnerability & Patch Roundup — July 2026","vulnerability-patch-roundup-july-2026-32cc3b","Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting known software flaws, usually reported and disclosed already. To keep you protected from these threats, we’ve compiled this month’s key security updates and vulnerability patches for the WordPress ecosystem. If you’re already using the Sucuri Firewall, you’re protected. These vulnerabilities are virtually patched for all clients. Continue reading Vulnerability & Patch Roundup — July 2026 at Sucuri Blog.","Sucuri's July 2026 roundup highlights several critical vulnerabilities affecting popular WordPress plugins. These include multiple Stored Cross-Site Scripting (XSS) flaws in Yoast SEO, WPForms, Ultimate Addons for Elementor, and Essential Addons for Elementor, as well as an Account Takeover vulnerability in Essential Addons for Elementor. A high-risk Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE) vulnerability in Loco Translate is also detailed. Sucuri states its firewall virtually patches these for clients, but recommends updating affected plugins.","Sucuri details July 2026 WordPress plugin vulnerabilities including XSS and RCE.","https:\u002F\u002Fblog.sucuri.net\u002F2026\u002F07\u002Fvulnerability-patch-roundup-july-2026.html","https:\u002F\u002Fblog.sucuri.net\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FSucuri-Vulnerability-Roundup-July-2026.png","2026-07-31T23:28:30+00:00","2026-08-01T04:00:23.238248+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Yoast SEO","product",{"name":21,"type":19},"WPForms",{"name":23,"type":19},"Essential Addons for Elementor",{"name":25,"type":19},"Ultimate Addons for Elementor",{"name":27,"type":19},"Loco Translate",{"name":29,"type":30},"Sucuri","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[45,49,52,55,58,61,63],{"type":46,"value":47,"context":48},"cve","CVE-2026-15425","Yoast SEO Authenticated Stored Cross-Site Scripting",{"type":46,"value":50,"context":51},"CVE-2026-15782","WPForms Authenticated Stored Cross-Site Scripting",{"type":46,"value":53,"context":54},"CVE-2026-15155","Essential Addons for Elementor Authenticated Account Takeover",{"type":46,"value":56,"context":57},"CVE-2026-15787","Ultimate Addons for Elementor Authenticated Stored Cross-Site Scripting",{"type":46,"value":59,"context":60},"CVE-2026-15145","Essential Addons for Elementor Authenticated Stored Cross-Site Scripting",{"type":46,"value":62,"context":60},"CVE-2026-15156",{"type":46,"value":64,"context":60},"CVE-2026-6459",[29,18,21],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":127,"name":128,"problem":129,"products":130},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":169},"critical-wordpress-plugin-vulnerabilities-demand-immediate-patching","Critical WordPress Plugin Vulnerabilities Demand Immediate Patching","Multiple popular WordPress plugins — including Yoast SEO, WPForms, and Essential Addons for Elementor — were found to contain serious vulnerabilities such as Stored XSS, Account Takeover, and a CSRF-to-RCE chain in Loco Translate. These flaws exist because plugin code failed to properly sanitize user input and validate request origins, leaving millions of WordPress sites exposed. The account takeover and RCE vulnerabilities are especially dangerous, as they can allow unauthenticated attackers to fully compromise a site without any user interaction beyond a single page visit. This roundup underscores how third-party plugins dramatically expand the attack surface of any CMS-based website, making timely patching non-negotiable.",[161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SA-22: Unsupported System Components","OWASP Top 10: A03 Injection \u002F A07 Identification and Authentication Failures","GDPR Article 32: Security of Processing (breach risk from RCE\u002Faccount takeover)","ITIL Change Management: Emergency Change procedures for critical patches",{}]