Medium
CVE-2026-7753
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-5062
PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
High
CVE-2026-15979
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
Medium
CVE-2026-15941
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-8790
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
Medium
CVE-2026-11421
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
Critical
CVE-2026-9273
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
High
CVE-2026-8761
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
High
CVE-2026-17506
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-16143
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15918
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
High
CVE-2026-18322
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
Medium
CVE-2026-14317
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass
Medium
CVE-2026-14830
FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-17017
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-17541
Bit File Manager <= 6.9.0 - Unauthenticated File Activity Log Disclosure
High
CVE-2026-27096
ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-18030
Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset
High
CVE-2026-12720
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28140
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization
High
CVE-2026-13392
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor < 3.10.01 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-14928
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13143
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
High
CVE-2026-61964
Ninja Tables – Easy Data Table Builder <= 5.2.9 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.