High
CVE-2026-92807
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-92967
Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
Critical
CVE-2026-84434
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Critical
CVE-2026-92229
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Medium
CVE-2026-15760
Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Medium
CVE-2026-89093
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Medium
CVE-2026-89334
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Medium
CVE-2026-77820
WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
High
CVE-2026-81650
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-92422
Meow Gallery <= 5.5.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-14844
Master Slider <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-81652
NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-87840
Tripzzy <= 1.5.0 - Missing Authorization
Medium
CVE-2026-84223
Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-16542
Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2026-87839
Tripzzy <= 1.5.0 - Missing Authorization
Low
CVE-2026-81653
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Medium
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
High
CVE-2026-87909
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
High
CVE-2026-92541
Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation
Low
CVE-2026-81651
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Medium
CVE-2026-92423
Meow Gallery <= 5.5.4 - Authenticated (Author+) Information Exposure
Medium
CVE-2026-92965
TikTok 1.2.0 - 1.4.1 - Missing Authorization
Medium
CVE-2026-92410
Sign-up Sheets <= 2.3.0 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.