High
CVE-2026-12736
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-15420
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
Critical
CVE-2026-15981
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
High
CVE-2026-15212
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
Medium
CVE-2026-59531
Falcon – WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization
Medium
CVE-2026-65538
Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-59548
Byteflows Travel & Hotel Booking <= 1.0.0 - Unauthenticated Information Exposure
Medium
CVE-2026-13342
Security Optimizer – The All-In-One Protection <= 1.6.4 - IP Allowlist Bypass
High
CVE-2026-65516
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-59552
3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-59533
Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection
Medium
CVE-2026-65512
WP Activity Log <= 5.6.4 - Cross-Site Request Forgery
Medium
CVE-2026-16274
Classified Listing <= 5.4.3 - Missing Authorization
Medium
CVE-2026-65529
Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization
Medium
CVE-2026-59537
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-16534
Import and export users and customers <= 2.4.1 - Authenticated (Admin+) Privilege Escalation
Medium
CVE-2026-15236
Gallery for Google Photos <= 1.2.0 - Unauthenticated Google OAuth Token Disclosure
Medium
CVE-2026-59546
WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass
Medium
CVE-2026-65514
Appointment Hour Booking – Booking Calendar <= 1.5.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-65530
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.2 - Missing Authorization
Medium
CVE-2026-65531
Qubely – Advanced Gutenberg Blocks <= 1.8.14 - Missing Authorization
Medium
CVE-2026-59528
ShipTime: Discount Shipping <= 1.1.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-59534
Post My CF7 Form <= 6.2.0 - Missing Authorization
High
CVE-2026-65510
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.