High
CVE-2026-48867
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-48965
Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-48967
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-9732
EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-7421
Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
Critical
CVE-2026-5076
ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Medium
CVE-2026-5074
ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
High
CVE-2026-5073
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
High
CVE-2026-1829
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-48873
Montonio for WooCommerce <= 10.1.2 - Missing Authorization
Medium
CVE-2026-48868
Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-48874
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-48889
Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-27351
Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization
High
CVE-2026-48885
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-48875
JetSmartFilters <= 3.8.1 - Unauthenticated SQL Injection
Medium
CVE-2026-48881
TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization
Medium
CVE-2026-48878
Visual Link Preview <= 2.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-5336
Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure
Medium
CVE-2026-49782
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
Medium
CVE-2026-48964
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-48886
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection
Medium
CVE-2026-48882
WP Time Slots Booking Form <= 1.2.50 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-28116
Progress Planner <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.