High
CVE-2026-87791
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
8898bae3-067c-4505-9a96-05b7a08d90c6
Admin Menu Editor Pro 2.35 - 2.36 - Backdoored Software
Medium
CVE-2026-90922
Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass
Medium
CVE-2026-86824
Newsletter <= 9.3.7 - Unauthenticated Information Exposure
High
CVE-2026-75983
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Medium
CVE-2026-15402
Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
Medium
CVE-2026-89141
AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
Medium
CVE-2026-15758
3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
Medium
CVE-2026-85657
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
High
CVE-2026-85530
GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-86784
Visualizer <= 4.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-86823
Newsletter <= 9.3.6 - Unauthenticated Open Redirect
Medium
CVE-2026-86475
Appointment Hour Booking <= 1.5.94 - Unauthenticated Appointment Slot Capacity Bypass
Medium
CVE-2026-74926
MultiVendorX <= 5.0.15 - Missing Authorization
Medium
CVE-2026-86406
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-13407
Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails
High
CVE-2026-84099
IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-80071
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation
Medium
CVE-2026-89027
JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
Medium
CVE-2026-87959
WPBot 8.7.2 - 8.7.5 - Missing Authorization
Medium
CVE-2026-86407
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 5.0 - 5.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-89023
Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings <= 3.5.1 - Missing Authorization
Medium
CVE-2026-84025
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-84023
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.