Medium
CVE-2026-14862
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
Medium
CVE-2026-15106
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
Medium
CVE-2026-15610
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
High
CVE-2026-15008
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
Medium
CVE-2026-15022
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
High
CVE-2026-7543
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
Medium
CVE-2026-13005
MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
Medium
CVE-2026-12941
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
Medium
CVE-2026-15652
Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
Medium
CVE-2026-12409
Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
Medium
CVE-2026-14987
GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
High
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Medium
CVE-2026-12695
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) < 6.2.6 - Two-Factor Authentication Bypass
Critical
CVE-2026-15013
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
Medium
CVE-2026-15407
Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
Medium
CVE-2026-12385
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Medium
CVE-2026-14847
Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
Medium
CVE-2026-14931
JS Help Desk <= 3.1.3 - Authenticated (Contributor+) User Email Disclosure
Medium
CVE-2026-14929
JS Help Desk <= 3.1.3 - Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification
Medium
CVE-2026-14554
Check & Log Email <= 2.0.14 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-14319
GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure
Medium
CVE-2026-15048
GeekyBot <= 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-14936
Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.