High
CVE-2026-4259
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-15258
Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2026-15982
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
Medium
CVE-2026-14927
FluentCart <= 1.5.2 - Insecure Direct Object Reference to Unauthenticated Order PII Disclosure
Medium
CVE-2026-14833
Lightbox with PhotoSwipe <= 5.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-9341
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
Medium
CVE-2026-14930
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Unauthenticated Arbitrary Media Upload
Medium
CVE-2026-14834
Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription
Medium
CVE-2026-61955
sync-basalam <= 3.0.2 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-61956
sync-basalam <= 1.9.1 - Cross-Site Request Forgery
Medium
CVE-2026-61952
Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization
High
CVE-2026-1359
Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt
High
CVE-2026-9282
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
Medium
CVE-2026-9017
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Medium
CVE-2026-15010
bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields
Medium
CVE-2026-10865
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Medium
CVE-2026-12103
Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
Medium
CVE-2026-1382
fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes
Medium
CVE-2025-5017
Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter
Medium
CVE-2026-6801
Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter
High
CVE-2026-4661
WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
Medium
CVE-2026-12994
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
Medium
CVE-2026-11901
WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
Medium
CVE-2026-12738
WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.