High
CVE-2026-104392
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-42777
Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
High
CVE-2026-89417
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
High
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
High
CVE-2026-40803
Jotform – AI Chatbot <= 3.8.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39801
AI Copilot – Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-105436
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-105701
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
High
CVE-2026-39797
The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39791
Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
Medium
CVE-2026-39767
WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service
High
CVE-2026-75962
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
High
CVE-2026-41555
Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection
High
CVE-2026-39761
Meta Box AIO <= 3.7.1 - Unauthenticated Privilege Escalation
High
CVE-2026-104394
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-104672
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-104405
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-105317
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-105061
WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39721
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization
Medium
CVE-2026-102393
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-103079
JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-103084
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105055
WP Mailster <= 1.9.0.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.