Medium
CVE-2026-14829
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-18395
Child Pages Card <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-66702
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66690
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66711
WPML Multilingual & Multicurrency for WooCommerce <= 5.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-66695
W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal
Medium
CVE-2026-15645
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
Medium
CVE-2026-61971
User Profile Picture <= 2.6.3 - Authenticated (Author+) Insecure Direct Object Reference
Medium
CVE-2026-28144
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-28145
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.39 - Missing Authorization
High
CVE-2026-66707
Meta for WooCommerce <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16065
Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection
High
CVE-2026-11588
EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-17567
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
Medium
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
Critical
CVE-2026-14483
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
High
CVE-2026-16236
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-15255
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-14305
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization
Medium
CVE-2026-14231
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13145
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Low
CVE-2026-16619
miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force
Medium
CVE-2026-15252
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization
Medium
CVE-2026-14923
Sync Post With Other Site < 1.9.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.