High
CVE-2026-66583
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation
High
CVE-2026-75981
TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15780
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
High
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
High
CVE-2026-73400
Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion
High
CVE-2026-73380
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
High
CVE-2026-32547
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-14919
ShopMonitor.io – Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-73187
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons <= 1.4.2 - Unauthenticated SQL Injection
Critical
CVE-2026-14596
DynamicKit for Elementor < 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-66602
HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-66620
OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-73397
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-73341
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection
High
CVE-2026-73376
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-73396
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.6.7 - Missing Authorization
Medium
CVE-2026-66651
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.17 - Missing Authorization
Medium
CVE-2026-73994
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization
Medium
CVE-2026-73350
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization
High
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
High
CVE-2026-73393
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-32549
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.