High
CVE-2026-4021
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2026-4001
Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
High
CVE-2026-3533
JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
High
CVE-2026-4306
WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter
Medium
CVE-2026-2412
Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
Medium
CVE-2026-3225
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
Medium
CVE-2026-4066
Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search
Medium
CVE-2026-25007
ElementInvader Addons for Elementor <= 1.4.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-32573
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 - Authenticated (Editor+) Remote Code Execution
Medium
CVE-2026-25417
ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-25018
NaturaLife Extensions <= 2.1 - Reflected Cross-Site Scripting
High
CVE-2026-32482
Ona < 1.24 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-25401
WPCargo Track & Trace <= 8.0.2 - Missing Authorization
Medium
CVE-2026-32517
Contact Manager <= 9.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-25373
Vayvo < 6.8 - Reflected Cross-Site Scripting
High
CVE-2026-25032
Ricky < 2.31 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39483
VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-4389
DSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute
High
CVE-2026-32507
Leroux - Business Consulting WordPress Theme < 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39479
OttoKit <= 1.1.20 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-25398
Vertex Addons for Elementor <= 1.6.4 - Missing Authorization
High
CVE-2026-25400
Apicona <= 24.1.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-23979
Gyan Elements <= 2.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-24370
The Grid < 2.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.