Medium
CVE-2026-77787
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-84752
RTMKit <= 2.1.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-84217
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 - Missing Authorization
Medium
CVE-2026-16281
Classified Listing <= 6.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-84780
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service
Low
CVE-2026-80438
Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure
High
CVE-2026-84812
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-75134
SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting
High
CVE-2026-75528
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Critical
CVE-2026-78657
SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
High
CVE-2026-14357
DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
High
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
High
CVE-2026-81772
Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Medium
CVE-2025-15692
Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-81769
Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-82884
All in One SEO <= 5.0.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-81283
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-18550
Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
Medium
CVE-2026-15101
WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
Medium
CVE-2026-16786
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Medium
CVE-2026-16788
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
Medium
CVE-2026-75964
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
Medium
CVE-2026-77189
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Medium
CVE-2026-75980
BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.