Medium
CVE-2026-84744
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-3253
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
Critical
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
High
CVE-2026-85682
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
High
CVE-2026-77193
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
Medium
CVE-2026-93513
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-93623
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-94168
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-18467
Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Medium
CVE-2026-95590
Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-95603
Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-95529
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95515
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94174
Email Log <= 2.63 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-93527
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.10 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-19125
EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
Medium
CVE-2026-93529
WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent <= 2.7.0 - Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification
High
CVE-2026-93368
Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
Medium
CVE-2026-88848
MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment
Medium
CVE-2026-80514
wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion
High
Exploited in attacks
CVE-2026-87902
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
Medium
CVE-2026-74991
WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization
High
CVE-2026-80513
wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-91827
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.