Medium
CVE-2026-14475
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-15104
BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
High
CVE-2026-13430
Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import
Medium
CVE-2026-57810
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-59515
AI Copilot – Content Generator <= 1.5.4 - Unauthenticated SQL Injection
High
CVE-2026-59514
BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection
Medium
CVE-2026-14342
Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
Medium
CVE-2026-13011
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
High
CVE-2026-57702
Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection
High
CVE-2026-57714
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection
High
CVE-2026-57707
Simple Business Directory Pro <= 15.9.4 - Unauthenticated SQL Injection
Medium
CVE-2026-57393
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
High
CVE-2026-6854
My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
High
CVE-2026-6230
Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
Medium
CVE-2026-12936
Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter
High
CVE-2026-9700
Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter
Critical
CVE-2026-9701
Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Medium
CVE-2026-57385
Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection
High
CVE-2026-6101
AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
High
CVE-2026-57739
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection
Medium
CVE-2026-14189
WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-9830
BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure
High
CVE-2026-57726
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.