Medium
CVE-2026-12097
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-10570
Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values
Medium
CVE-2026-9731
Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-14500
Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
High
CVE-2026-9700
Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter
Critical
CVE-2026-9701
Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
High
CVE-2026-9842
Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
Critical
CVE-2026-14487
Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
High
CVE-2026-14482
多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
High
CVE-2026-14244
Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
High
CVE-2026-14158
Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
Medium
CVE-2026-57367
WP Booking System – Booking Calendar Premium < 5.12.8.1 - Missing Authorization
Medium
CVE-2026-57385
Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection
Medium
CVE-2026-57373
FunnelKit Funnel Builder Pro <= 3.15.0.4 - Authenticated (Customer+) Stored Cross-Site Scripting
High
CVE-2026-57371
WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-57369
Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14819
Event Tickets <= 5.28.3 - Authenticated (Editor+) Stored Cross-Site Scripting
High
CVE-2026-57372
WPJAM Basic <= 7.0 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-57383
JobSearch WP Job Board <= 3.2.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14924
Tablesome <= 1.1.30 - Missing Authorization
Medium
CVE-2026-57375
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization
High
CVE-2026-57376
ElementInvader Addons for Elementor <= 1.4.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57377
Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.8 - Missing Authorization
Medium
CVE-2026-57378
Advanced Forms for ACF <= 1.9.3.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.