Medium
CVE-2026-1128
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-39632
Grand Blog <= 3.1 - Cross-Site Request Forgery
Medium
CVE-2025-14608
WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
Medium
CVE-2026-32351
PowerPress Podcasting <= 11.15.13 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-32353
MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-32352
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39637
Mogi <= 1.2.3 - Missing Authorization
Medium
CVE-2026-39631
WPSchoolPress <= 2.2.36 - Missing Authorization
Critical
CVE-2026-2446
Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update
High
CVE-2026-42641
Share This Image <= 2.14 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-39634
Grand Portfolio <= 3.3 - Cross-Site Request Forgery
Medium
CVE-2026-39633
Grand Car Rental <= 3.6.9 - Cross-Site Request Forgery
High
CVE-2026-1320
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
High
CVE-2026-1316
Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Medium
CVE-2026-39629
Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution
Critical
CVE-2026-2418
Login with Salesforce <= 1.0.2 - Authentication Bypass
Medium
CVE-2026-25036
Passster <= 4.2.25 - Missing Authorization
Medium
CVE-2026-39627
Ashe <= 2.267 - Missing Authorization
Medium
CVE-2026-39575
Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39628
DukaMarket <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-1671
Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
Medium
CVE-2026-1356
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
Medium
CVE-2026-1537
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
Critical
CVE-2026-1729
AdForest <= 6.0.12 - Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.