Medium
CVE-2026-9016
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-10823
YMC Smart Filter <= 3.11.2 - Unauthenticated Private/Draft Post Disclosure
Medium
CVE-2026-49082
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2019-25738
Hybrid Composer <= 1.4.6 - Missing Authorization
High
CVE-2026-7654
Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
High
CVE-2026-10586
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
High
CVE-2026-10821
Yoast SEO Premium <= 27.6.0 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-49774
RD Station <= 5.6.0 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-49773
FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2019-25737
Live Chat Unlimited <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-5305
Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-49077
Wp EMember <= v10.2.2 - Unauthenticated Information Exposure
High
CVE-2026-49107
Thrive Apprentice < 10.8.10.2 - Unauthenticated PHP Object Injection
High
CVE-2026-49769
wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection
High
CVE-2026-49770
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection
Medium
CVE-2026-32834
Easy PayPal Events & Tickets <= 1.3 - Unauthenticated Information Exposure
High
CVE-2019-25745
WP Google Review Slider <= 6.1 - Unauthenticated SQL Injection
Medium
CVE-2026-8380
Frontend File Manager <= 23.6 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
High
CVE-2026-49113
Cornerstone < 7.8.8 - Authenticated (Subscriber+) Arbitrary Code Execution
Medium
CVE-2026-10824
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion
High
CVE-2026-49776
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 - Unauthenticated SQL Injection
Critical
CVE-2026-9690
Media folder Addon <= 4.0.1 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-49110
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization
Medium
CVE-2026-9702
InPost PL <= 1.9.0 - Missing Authorization to Unauthenticated WooCommerce Order Parcel-Locker Hijacking
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.