Medium
CVE-2026-4006
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-1238
SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
High
CVE-2026-25447
Widget Wrangler <= 2.3.9 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-25445
Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-2571
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Medium
CVE-2026-39484
Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect
Medium
CVE-2026-25312
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
Medium
CVE-2026-25317
Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization
Medium
CVE-2026-42644
BetterDocs <= 4.3.10 - Unauthenticated Information Exposure
Medium
CVE-2026-25437
GZSEO <= 2.0.14 - Missing Authorization
High
CVE-2026-24989
SUMO Affiliates Pro < 11.4.0 - Unauthenticated PHP Object Injection
High
CVE-2026-25429
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39476
User Feedback <= 1.10.1 - Missing Authorization
Medium
CVE-2026-25442
Kentha <= 4.7.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-42645
Barcode Scanner with Inventory & Order Manager <= 1.11.0 - Cross-Site Request Forgery
High
CVE-2026-25443
Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2026-32565
Contextual Related Posts < 4.2.2 - Missing Authorization
Medium
CVE-2026-24362
Ultimate Post Kit Addons for Elementor <= 4.0.21 - Missing Authorization
High
CVE-2026-24993
Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection
High
CVE-2026-25446
Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-4338
ActivityPub < 8.0.2 - Unauthenticated Information Epxosure
Medium
CVE-2026-4120
Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Medium
CVE-2026-25430
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.2 - Missing Authorization
Medium
CVE-2026-25013
Phox Hosting <= 2.0.8 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.