Medium
CVE-2026-48872
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
High
CVE-2026-42761
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.9 - Unauthenticated SQL Injection
High
CVE-2026-42755
TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
High
CVE-2026-9757
GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
High
CVE-2026-7459
Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
Medium
CVE-2026-10039
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
Medium
CVE-2026-42742
Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-42741
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42740
Tainacan <= 1.0.3 - Unauthenticated SQL Injection
High
5f732a77-fa34-402f-8ab4-a4273b7e0b13
GEO my WP <= 4.5.4 - Unauthenticated SQL Injection
Medium
CVE-2026-42746
Smart Online Order for Clover <= 1.6.0 - Unauthenticated Sensitive Information Exposure
High
CVE-2026-42747
Easy Form Builder by WhiteStudio — Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection
Medium
CVE-2026-7048
Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Medium
CVE-2026-7526
PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
High
CVE-2026-7797
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Medium
CVE-2026-5737
Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
Medium
CVE-2026-49046
Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-48877
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure
Medium
CVE-2026-7618
EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-45439
Realtyna Organic IDX plugin + WPL Real Estate <= 5.1.0 - Unauthenticated SQL Injection
Medium
CVE-2025-69135
Events Schedule - WordPress Events Calendar <= 2.7.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-48837
Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-42763
SePay Gateway <= 1.1.20 - Unauthenticated Information Exposure
Medium
CVE-2026-8386
Go Maps <= 10.0.9 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.