High
5f732a77-fa34-402f-8ab4-a4273b7e0b13
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-42746
Smart Online Order for Clover <= 1.6.0 - Unauthenticated Sensitive Information Exposure
High
CVE-2026-27053
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-42743
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization
Medium
CVE-2026-25425
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization
Critical
CVE-2025-69179
Support Ticket Management System <= 1.9 - Unauthenticated Privilege Escalation
High
CVE-2026-42747
Easy Form Builder by WhiteStudio — Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection
Medium
CVE-2026-4334
Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting
Medium
CVE-2026-6937
Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
Medium
CVE-2026-7048
Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Medium
CVE-2026-8689
Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions
Medium
CVE-2026-9015
Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action
Medium
CVE-2026-7526
PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
Critical
CVE-2026-15300
GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
Medium
CVE-2026-9618
PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
High
CVE-2026-7797
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
High
CVE-2026-7634
SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Medium
CVE-2026-6427
a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element
Medium
CVE-2026-7660
Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter
High
CVE-2026-7052
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
High
CVE-2026-6455
WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
Medium
CVE-2026-7552
Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
High
CVE-2026-9227
GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
Medium
CVE-2026-7621
SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.