Średnia
CVE-2026-77765
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 8 950
Wyczyść filtry
Średnia
CVE-2026-84027
Directorist 8.9.1 - 8.9.4 - Missing Authorization
Średnia
CVE-2026-91073
Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Średnia
CVE-2026-90950
Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass
Średnia
CVE-2026-84026
Directorist 8.1 - 8.9.4 - Unauthenticated Information Exposure
Średnia
CVE-2026-84098
Directorist 3.1.0 - 8.9.4 - Missing Authorization
Średnia
CVE-2026-87070
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
Średnia
CVE-2026-84150
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Średnia
CVE-2026-9858
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Średnia
CVE-2026-9289
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
Średnia
CVE-2026-9613
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Wysoka
CVE-2026-1255
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
Średnia
CVE-2026-6295
WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Średnia
CVE-2026-11899
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
Średnia
CVE-2026-9832
Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
Średnia
CVE-2026-2422
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
Średnia
CVE-2026-15946
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Średnia
CVE-2026-15947
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Średnia
CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Średnia
CVE-2026-7527
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Wysoka
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Średnia
CVE-2026-87917
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Średnia
CVE-2026-9232
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Średnia
CVE-2026-9855
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.