High
CVE-2026-8143
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-15397
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
Critical
CVE-2026-16610
Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
High
CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
High
CVE-2026-14356
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
Medium
CVE-2026-16092
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
Medium
CVE-2026-1982
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
Medium
CVE-2026-66699
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
High
CVE-2026-15360
Ajax Load More <= 8.0.0 - Unauthenticated SQL Injection
Medium
CVE-2026-14313
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering
Medium
CVE-2026-14314
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure
Critical
CVE-2026-65553
Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 - Unauthenticated Remote Code Execution
Medium
CVE-2026-15372
2FA <= 4.0.0 - Two-Factor Authentication Bypass
Medium
CVE-2026-14224
Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-66696
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-65554
AnsPress – Question and answer 4.4.4 - Missing Authorization
Medium
CVE-2026-66692
Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference
Medium
CVE-2026-18197
Link Library < 7.9.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-61968
myCred <= 3.1.2 - Missing Authorization
Medium
CVE-2026-17515
MLS Import <= 7.0.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16055
Contest Gallery <= 30.0.6 - Unauthenticated Two-Factor Authentication Bypass
Medium
CVE-2026-16036
miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass
Medium
CVE-2026-66688
Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66703
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.