Medium
CVE-2026-16578
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-16595
Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure
Medium
CVE-2026-16992
Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure
High
CVE-2026-12713
WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection
Medium
CVE-2026-16285
Product Attachment for WooCommerce < 2.3.3 - Unauthenticated Information Exposure
Medium
CVE-2026-14938
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.95.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-61977
JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure
Medium
CVE-2026-14839
Mapster WP Maps < 1.24.0 - Unauthenticated Information Exposure
Medium
CVE-2026-61976
JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure
Medium
CVE-2026-14195
Brizy – Page Builder < 2.8.18 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-61975
JetReviews <= 3.0.1 - Unauthenticated Information Exposure
Medium
CVE-2026-13604
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
Medium
CVE-2026-17555
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Medium
CVE-2026-15601
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Medium
CVE-2026-18059
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
Medium
CVE-2026-15951
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Medium
CVE-2026-16087
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Medium
CVE-2026-16614
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Medium
CVE-2026-15018
Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
Medium
CVE-2026-17580
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
Medium
CVE-2026-2916
Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
Medium
CVE-2026-15403
Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
Medium
CVE-2026-28144
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16065
Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.