High
CVE-2026-34902
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-34895
Softlab Core < 1.2.11 - Unauthenticated Local File Inclusion
Critical
CVE-2026-34901
iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-1900
Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change
Medium
CVE-2026-34903
Ocean Extra <= 2.5.3 - Missing Authorization
High
CVE-2026-3243
Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2026-1673
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
Medium
CVE-2026-39432
Timetics – Appointment Booking & Scheduling <= 1.0.53 - Missing Authorization
Medium
CVE-2026-3177
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
High
CVE-2026-5465
Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Critical
CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-14944
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
Medium
CVE-2026-34888
Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
Medium
CVE-2026-34891
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-34897
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-34885
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
Medium
CVE-2026-3309
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
High
CVE-2026-3666
wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
High
CVE-2026-2936
Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-1233
Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
Medium
CVE-2025-14938
Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload
High
CVE-2026-5425
Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data
High
CVE-2026-3445
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.