Medium
CVE-2026-27357
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-42730
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-42684
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated SQL Injection
High
CVE-2026-8679
AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter
Medium
CVE-2026-7636
Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
High
CVE-2026-9011
Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
High
CVE-2026-4834
WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
Medium
CVE-2026-27349
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-9065
SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-42383
YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-9059
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-24637
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-6728
Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
High
CVE-2026-9010
Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
High
CVE-2026-3985
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter
Medium
CVE-2026-7472
Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-8685
Infility Global <= 2.15.19 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-6394
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
High
CVE-2026-3430
Creative Mail <= 1.6.9 - Unauthenticated SQL Injection
High
CVE-2026-42727
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.8 - Unauthenticated SQL Injection
High
CVE-2026-8912
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
High
CVE-2020-37244
Membership by Supsystic <= 1.4.7 - Unauthenticated SQL Injection
Medium
CVE-2026-8425
Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.