Medium
CVE-2026-103078
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-104404
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-104049
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-105322
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay
High
CVE-2026-97188
String Locator <= 2.6.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-104050
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-95526
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization
High
CVE-2026-104747
Haaken <= 1.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-96334
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
High
CVE-2026-94167
Kubio AI Page Builder <= 2.9.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94665
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-100511
VK Google Job Posting Manager <= 1.3.1 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-100506
WP Spell Check <= 12.1 - Authenticated (Author+) PHP Object Injection
High
CVE-2026-97257
Simple Event Planner <= 1.5.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-93617
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 - Authenticated (Custom Role+) PHP Object Injection
High
CVE-2026-103348
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 - Authenticated (Custom Role+) PHP Object Injection
Medium
CVE-2026-103349
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-97283
Advanced Post Manager <= 4.5.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-97309
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-97305
Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-100509
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-94568
Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection
Critical
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Medium
CVE-2026-97343
Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.