Critical
CVE-2026-104732
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-104797
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
Medium
CVE-2026-104915
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Medium
CVE-2026-107419
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
Medium
CVE-2026-104022
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Medium
CVE-2026-106600
GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization
High
CVE-2026-103309
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-17609
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
High
CVE-2026-82627
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Medium
CVE-2026-17538
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Medium
CVE-2026-103075
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization
High
CVE-2026-105318
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94062
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
High
CVE-2026-42716
payever – WooCommerce Gateway <= 4.8.2 - Unauthenticated PHP Object Injection
Critical
CVE-2026-85097
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
High
CVE-2026-62094
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
High
CVE-2026-62092
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion
High
CVE-2026-42719
Dynamic User Directory <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
Medium
bc5886e8-a520-48e4-9976-2e92b37e4bdf
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
High
CVE-2026-62115
KuteShop <= 4.2.9 - Unauthenticated Local File Inclusion
Medium
866f5121-81be-409e-b6d5-81b72bfb5539
WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
Medium
CVE-2026-105872
Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-62099
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
High
CVE-2026-62096
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.