Medium
CVE-2026-15286
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-25423
Real 3D FlipBook <= 4.19.1 - Missing Authorization
Medium
CVE-2025-69390
Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-39616
Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-0910
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-13391
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
High
CVE-2025-68552
WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-67998
Miraculous Elementor <= 2.0.7 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-32342
Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery
Medium
CVE-2026-39615
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-1866
Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2026-1922
The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Medium
CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
Medium
CVE-2026-0996
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
High
CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
Medium
CVE-2025-15147
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment
High
CVE-2025-67995
PatioTime < 2.1 - Unauthenticated PHP Object Injection
High
CVE-2025-69387
Simple Retail Menus <= 4.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-32338
Construction Landing Page <= 1.4.1 - Missing Authorization
Medium
CVE-2025-69386
RVCFDI para Woocommerce <= 8.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-32336
Rara Business <= 1.3.0 - Missing Authorization
Critical
CVE-2025-69379
Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.