High
CVE-2026-28003
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-73349
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
High
CVE-2026-28001
Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
Medium
CVE-2026-73346
Mailchimp for WooCommerce < 6.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-65640
WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
Medium
CVE-2026-28148
Headless SSO Plugin for WP <= 1.6 - Missing Authorization
Medium
CVE-2026-28008
OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 - Missing Authorization
High
CVE-2026-28149
Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-18961
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
High
CVE-2026-15606
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
High
CVE-2026-19091
GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
Critical
CVE-2026-16230
Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
High
CVE-2026-13457
InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
High
CVE-2026-15426
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
High
CVE-2026-66653
Barista <= 2.5.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-66658
Reviewer <= 3.14.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-66656
Foton Core <= 1.1.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-16739
Epeken All Kurir for Woocommerce <= 2.1.2 - Unauthenticated Payment Bypass
High
CVE-2026-27536
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-19088
ShopEngine <= 4.9.2 - Cross-Site Request Forgery
High
CVE-2026-27537
Smart Popup by Supsystic <= 1.11.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-27544
QA Assistants – Driven by data <= 5.2.0.0 - Unauthenticated Remote Code Execution
High
CVE-2026-61969
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.6.0 - Unauthenticated SQL Injection
Medium
CVE-2026-14549
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.