Medium
CVE-2026-15256
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-16968
GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure
High
CVE-2026-65440
GetGenie <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65441
GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16746
MultiVendorX <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure
Medium
CVE-2026-14939
Visualizer: Tables and Charts Manager <= 4.0.5 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-16736
User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled
Medium
CVE-2026-16035
miniOrange 2FA <= 6.2.6 - Missing Authorization
Medium
CVE-2026-66433
Location Weather <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-16548
Bit Assist <= 1.8.1 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-65445
Ad Invalid Click Protector (AICP) <= 1.3.0 - Missing Authorization
High
CVE-2026-15962
Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
Medium
CVE-2026-15425
Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
High
CVE-2026-10818
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
Medium
CVE-2026-14955
Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
Medium
CVE-2026-15260
Geo My WP <= 4.5.5.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion
Medium
CVE-2025-15673
Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read
Medium
CVE-2026-15231
TaxoPress <= 3.50.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Private Post Disclosure
Medium
CVE-2026-16297
Clearfy <= 2.4.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-16564
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification
Medium
CVE-2026-16563
Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure
Medium
CVE-2026-65562
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-17032
Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software
Medium
CVE-2026-16565
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.