Medium
CVE-2026-8681
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-42677
WP Document Revisions <= 3.8.1 - Missing Authorization
High
CVE-2021-47965
WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-42676
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42675
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
Medium
CVE-2026-45438
Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization
Medium
CVE-2025-4202
Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment
Medium
CVE-2026-7563
Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
High
CVE-2026-6228
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
High
CVE-2026-6403
Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
Critical
CVE-2026-5229
Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback
Medium
CVE-2026-8425
Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
High
CVE-2026-42672
WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection
Medium
CVE-2026-6415
Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field
High
CVE-2026-4094
FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion
Medium
CVE-2026-4683
Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update
Medium
CVE-2026-42673
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Exposure
Medium
CVE-2026-8151
Simple Membership MailChimp Integration <= 1.9.7 - Cross-Site Request Forgery
Medium
CVE-2026-42674
Advanced Access Manager – Access Governance for WordPress <= 7.1.0 - Missing Authorization
Medium
CVE-2026-6646
The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
Medium
CVE-2026-6504
Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
Medium
CVE-2026-6145
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
High
CVE-2026-6514
InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.