Medium
CVE-2026-32467
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-32444
Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution
Critical
CVE-2026-12277
Frontend File Manager <= 23.6 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-17604
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
High
CVE-2026-17581
WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
Medium
CVE-2026-15351
WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
High
CVE-2026-17123
Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
High
CVE-2026-14498
Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
Critical
CVE-2026-14524
ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters
High
CVE-2026-16099
Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
Critical
CVE-2026-18432
Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
Medium
CVE-2026-15056
StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
Critical
CVE-2026-18855
Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter
High
CVE-2026-18438
Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch
Medium
CVE-2026-12128
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Critical
CVE-2026-14484
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
High
CVE-2026-32464
Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion
High
CVE-2026-32553
OttoKit: All-in-One Automation Platform <= 1.1.35 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-73383
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.47 - Authenticated (Shop Manager+) Arbitrary File Downloaf
High
CVE-2026-73181
Extra Product Options & Add-Ons for WooCommerce < 7.6 - Unauthenticated Arbitrary File Download
High
CVE-2026-13700
WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-16294
PowerPress Podcasting plugin by Blubrry < 11.17.1 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2026-28570
Vavo Core <= 2.3.0 - Unauthenticated Local File Inclusion
Critical
CVE-2026-12949
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.