High
CVE-2026-7520
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-7456
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
Critical
CVE-2026-5581
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
Medium
CVE-2026-17532
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
Medium
CVE-2026-17505
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
High
CVE-2026-6639
AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure
High
CVE-2026-7529
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
Medium
CVE-2026-15941
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-8790
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
Critical
CVE-2026-9273
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
High
CVE-2026-8761
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
High
CVE-2026-17506
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-16143
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-18322
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
Medium
CVE-2026-14317
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass
High
CVE-2026-27096
ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-18030
Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset
High
CVE-2026-12720
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-14928
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-28139
Ajax Search Lite – Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-12376
Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-66709
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution
Critical
CVE-2026-28005
Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation
Medium
CVE-2026-16955
AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.