Medium
CVE-2026-8038
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-6072
Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Medium
CVE-2026-5293
診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
High
CVE-2026-8073
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Medium
CVE-2026-8096
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
High
CVE-2026-3430
Creative Mail <= 1.6.9 - Unauthenticated SQL Injection
Medium
CVE-2026-47100
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Missing Authorization
Medium
CVE-2026-45442
The Ultimate Video Player For WordPress – by Presto Player <= 4.1.3 - Missing Authorization
High
CVE-2026-42727
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.8 - Unauthenticated SQL Injection
Medium
CVE-2026-45435
WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-4986
WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass
Critical
CVE-2026-4885
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
Critical
CVE-2026-4883
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
Medium
CVE-2026-42681
E2Pdf – Export Pdf Tool for WordPress <= 1.32.14 - Reflected Cross-Site Scripting
High
CVE-2026-8912
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
Medium
CVE-2026-42682
wpForo Forum <= 3.0.6 - Missing Authorization
Critical
CVE-2026-42680
Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-42679
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
High
CVE-2018-25329
WP with Spritz <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2018-25324
Simple Fields <= 0.3.5 - Unauthenticated Local File Inclusion
High
CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
High
CVE-2020-37244
Membership by Supsystic <= 1.4.7 - Unauthenticated SQL Injection
Medium
CVE-2020-37235
Wibar <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2020-37227
Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.