Medium
CVE-2026-15445
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-12941
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
Medium
CVE-2026-12434
List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
High
CVE-2026-12753
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
High
CVE-2026-12721
Kirki <= 6.0.12 - Unauthenticated SQL Injection
Medium
CVE-2026-12385
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Medium
CVE-2026-14554
Check & Log Email <= 2.0.14 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-14849
Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure
Medium
CVE-2026-15258
Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-61955
sync-basalam <= 3.0.2 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-10865
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Medium
CVE-2025-5017
Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter
Medium
CVE-2026-6801
Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter
High
CVE-2026-4661
WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
Medium
CVE-2026-7559
Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification
Medium
CVE-2026-13262
Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter
Medium
CVE-2026-7544
Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-12426
Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Medium
CVE-2026-15072
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
Medium
CVE-2026-15073
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
High
CVE-2026-15335
Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter
Medium
CVE-2026-12918
Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
Medium
CVE-2026-13010
JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
Medium
CVE-2026-15026
Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.