High
CVE-2026-101888
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-103293
MPG <= 4.2.2 - Authenticated (Editor+) Arbitrary File Read
Medium
CVE-2026-103514
2FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass
Medium
CVE-2026-94238
Loco Translate <= 2.8.8 - Authenticated (Translator+) Limited File Read
Critical
CVE-2026-95588
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-15983
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Medium
CVE-2026-19902
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
High
CVE-2026-96561
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
Medium
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Critical
CVE-2026-94389
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution
Medium
CVE-2026-62083
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment
Medium
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass
Medium
CVE-2026-97288
WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-75098
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
High
CVE-2026-89294
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
Critical
CVE-2026-96349
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 - Unauthenticated Remote Code Execution
High
CVE-2026-97242
WEBO MCP <= 3.0.18 - Authenticated (Author+) Arbitrary File Deletion
Medium
CVE-2026-81740
Paytm Payment Gateway <= 2.8.8 - Unauthenticated Payment Bypass
High
CVE-2026-91828
OMGF <= 6.3.10 - Denial of Service to Unauthenticated Site Availability Exhaustion
Critical
CVE-2026-101148
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2026-19253
Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion
Critical
CVE-2026-75873
Zella <= 2.6.2 - Unauthenticated Arbitrary File Upload
High
CVE-2026-97316
Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.