Medium
CVE-2026-65506
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-59543
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-65475
Modula Image Gallery – Photo Grid & Video Gallery 2.14.25-2.14.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13146
Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-15787
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
High
CVE-2026-15802
WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
Medium
CVE-2026-27399
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization
High
CVE-2026-59512
PiWeb Product Enquiry or product catalog for WooCommerce <= 2.2.34.43 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57809
AffiliateWP <= 2.34.0 - Reflected Cross-Site Scripting
Critical
CVE-2026-57716
Broadcast Live Video <= 7.2.4 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-15149
Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation
High
CVE-2026-59517
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57626
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
Medium
CVE-2026-59513
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-61958
License Manager for WooCommerce <= 3.0.17 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-57808
WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2026-57717
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.0.0 - Missing Authorization
Medium
CVE-2026-57769
Grand Photography WordPress <= 5.7.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-15145
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Medium
CVE-2026-1372
Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
High
CVE-2026-1771
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
Critical
CVE-2026-13439
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
Medium
CVE-2026-15782
WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
Medium
CVE-2026-15156
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.