Medium
CVE-2026-2868
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-4409
Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management
High
CVE-2026-5100
AWP Classifieds <= 4.4.6 - Unauthenticated SQL Injection via 'regions'
Medium
CVE-2026-4730
Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute
Medium
CVE-2026-6704
Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter
Medium
CVE-2026-6696
Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter
Medium
CVE-2026-6702
Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
Medium
CVE-2026-6701
addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
Medium
CVE-2026-6700
DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-5505
WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-6255
Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute
High
CVE-2026-15293
WP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification
Medium
CVE-2026-5247
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
Critical
CVE-2025-13618
Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration
Medium
CVE-2026-1921
Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
Critical
CVE-2026-5722
MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse
Medium
CVE-2026-41471
Easy PayPal Events & Tickets <= 1.3 - Insecure Direct Object Reference to Unauthenticated Information Exposure
High
CVE-2026-40797
WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection
Medium
CVE-2026-25863
Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service
High
CVE-2026-42663
Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
Medium
CVE-2026-42662
Event Tickets and Registration <= 5.27.5 - Missing Authorization
Medium
CVE-2026-39716
Flipmart <= 2.8 - Missing Authorization
Medium
CVE-2026-4790
Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.