Medium
CVE-2026-13701
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-16985
Squeeze <= 1.7.11 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2026-18946
Contact Form to Any API <= 3.0.6 - Unauthenticated Sensitive File Disclosure
High
CVE-2026-61960
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65565
Survey Maker by AYS <= 5.2.3.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65574
Abogado - Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection
High
CVE-2026-65560
Houzez Property Feed <= 2.5.48 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-16261
Login Social <= 1.0.4 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-66685
Featured Video Plus <= 2.3.3 - Unauthenticated Information Exposure
High
CVE-2025-15028
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-9266
Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
Medium
CVE-2026-11983
Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax
Medium
CVE-2026-5391
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5158
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
High
CVE-2026-18510
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-18400
Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
High
CVE-2026-15459
WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
High
CVE-2026-16636
FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
High
CVE-2026-15991
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
High
CVE-2026-18325
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
Medium
CVE-2026-48197
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
Medium
CVE-2026-28183
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
High
CVE-2026-16298
FoodBoxBooker <= 1.0.6 - Privilege Escalation to Unauthenticated Arbitrary Password Reset
Medium
CVE-2026-66452
Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.