Medium
CVE-2026-16953
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-14331
Subscribe2 <= 10.45 - Reflected Cross-Site Scripting
Medium
CVE-2026-15211
Subscriptions for WooCommerce <= 2.0.0 - Unauthenticated Payment Verification Bypass
High
CVE-2026-16267
Newsletters <= 4.15 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28146
Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-17011
Nexter Blocks <= 5.0.1 - Payment Bypass to Authenticated (Contributor+) Stored CSS Injection
High
CVE-2026-16263
Maps <= 4.9.6 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2026-16258
Ajax Search Lite <= 4.14.4 - Unauthenticated PHP Object Injection
High
CVE-2026-14602
Remote API <= 0.2 - Unauthenticated PHP Object Injection
High
CVE-2026-18465
Maps Pro <= 6.1.2 - Unauthenticated Local File Inclusion
Medium
CVE-2025-15678
Nexter Blocks <= 5.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-15214
Subscriptions for WooCommerce <= 2.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
High
CVE-2026-18464
Maps Pro <= 6.1.2 - Unauthenticated Denial of Service
Medium
CVE-2026-16574
Dokan <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant
Medium
CVE-2026-16957
Slim SEO <= 4.9.10 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Meta Disclosure
Medium
CVE-2025-15675
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-16062
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2026-8457
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
High
CVE-2026-18352
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
High
CVE-2026-13339
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Medium
CVE-2026-13604
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
High
CVE-2026-16635
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Critical
CVE-2026-15964
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
Medium
CVE-2026-18344
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.