High
CVE-2026-10586
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-10821
Yoast SEO Premium <= 27.6.0 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-49774
RD Station <= 5.6.0 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-49113
Cornerstone < 7.8.8 - Authenticated (Subscriber+) Arbitrary Code Execution
Critical
CVE-2026-9690
Media folder Addon <= 4.0.1 - Unauthenticated Arbitrary File Download
Medium
CVE-2025-10268
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
High
CVE-2026-10737
SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
High
CVE-2026-1829
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-5336
Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure
Critical
CVE-2026-48836
Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.1.19 - Unauthenticated Remote Code Execution
Critical
CVE-2026-48866
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-9757
GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
High
CVE-2026-7465
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
High
CVE-2026-42748
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
Critical
CVE-2026-9815
MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload
Critical
CVE-2026-15300
GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
High
CVE-2026-6455
WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
High
CVE-2026-9009
Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
High
CVE-2026-2374
Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF
Medium
CVE-2026-5737
Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
Medium
CVE-2026-4888
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
High
CVE-2025-69166
Gunslinger <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2025-69161
Snowy <= 1.13 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.