Medium
CVE-2026-16078
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-15761
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
Medium
CVE-2026-15906
Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-15827
GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
Medium
CVE-2026-15794
Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
Critical
CVE-2026-14282
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
Medium
CVE-2026-14481
Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter
Critical
CVE-2026-15011
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
Medium
CVE-2026-15404
Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Medium
CVE-2026-15647
Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field
Medium
CVE-2026-15646
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-9729
Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter
Medium
CVE-2026-9635
WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
High
CVE-2026-12421
ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
High
CVE-2026-9713
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
High
CVE-2026-7534
SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
High
CVE-2026-7232
FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
Medium
CVE-2026-27391
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Medium
CVE-2026-65488
LA-Studio Element Kit for Elementor <= 1.6.2 - Cross-Site Request Forgery
Medium
CVE-2026-65457
ЮKassa для WooCommerce <= 2.16.1 - Missing Authorization
High
CVE-2026-65466
JetBooking <= 4.1.2 - Authenticated (Custom+) Server-Side Request Forgery
Medium
CVE-2026-65471
Avada Core <= 5.15.6 - Cross-Site Request Forgery
High
CVE-2026-59544
Thrive Quiz Builder <= 10.9.3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-65487
Photography <= 7.7.6 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.