High
CVE-2026-94678
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-97066
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-96823
Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization
Medium
CVE-2026-94173
Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-94677
Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-96524
MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery
High
CVE-2026-96837
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-96833
Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-97235
ThemeREX Addons < 2.45.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-96834
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-96824
Template Kit – Import <= 1.0.16 - Authenticated (Editor+) Arbitrary File Deletion
High
CVE-2026-97077
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-93770
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-96836
پارسی دیت – Parsi Date <= 6.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94673
Simply Schedule Appointments <= 1.6.12.31 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-96533
Testimonials Widget <= 4.0.4 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-97065
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-96350
Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-97253
LayerSlider <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-85081
Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-96825
All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass
Medium
CVE-2026-97078
Sprout Invoices – Client Invoicing & Estimates <= 20.8.17 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-97196
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation
Medium
CVE-2026-96526
MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.