Medium
CVE-2026-66572
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-66573
JetTabs <= 2.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66574
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66575
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-66576
JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66577
JetSearch <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66578
Property Hive <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66579
JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66580
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.12.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-66608
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-66617
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66618
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-66619
Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-66624
WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-2585
Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
Medium
CVE-2026-18441
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Medium
CVE-2026-66625
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-14311
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Medium
CVE-2026-16582
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Medium
CVE-2026-66626
SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-66628
WP-Lister Lite for eBay <= 3.8.11 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2026-66631
MoreConvert Wishlist for WooCommerce <= 1.9.21 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-66630
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-16750
Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.