Medium
CVE-2026-28146
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-17011
Nexter Blocks <= 5.0.1 - Payment Bypass to Authenticated (Contributor+) Stored CSS Injection
Medium
CVE-2026-16265
Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service
High
CVE-2026-16263
Maps <= 4.9.6 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2026-17014
Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion
High
CVE-2026-18465
Maps Pro <= 6.1.2 - Unauthenticated Local File Inclusion
High
CVE-2026-18352
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
High
CVE-2026-13339
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Medium
CVE-2026-13604
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
Medium
CVE-2026-15601
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Medium
CVE-2026-17605
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
High
CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
High
CVE-2026-16144
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Medium
CVE-2026-15018
Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
Medium
CVE-2026-2916
Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
Critical
CVE-2026-3141
FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
High
CVE-2026-15006
Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
Medium
CVE-2026-61970
Auto Featured Image (Auto Post Thumbnail) <= 5.0.4 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2026-16236
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-16268
Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-16620
WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-14547
Estatik Real Estate <= 4.3.2 - Unauthenticated Mail Relay
Critical
CVE-2026-16610
Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
Medium
CVE-2026-1982
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.