Medium
CVE-2026-8884
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-9200
Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
Medium
CVE-2026-8868
Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-8899
Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-8994
Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter
Medium
CVE-2026-9014
WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
High
CVE-2026-8787
Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Critical
CVE-2026-8760
Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
Medium
CVE-2026-8048
My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Medium
CVE-2026-9236
CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
Medium
CVE-2025-14481
Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
Medium
CVE-2026-15299
Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
High
CVE-2025-69108
Hot Coffee <= 1.7 - Unauthenticated PHP Object Injection
High
CVE-2025-69109
Raider Spirit <= 1.1.4 - Unauthenticated Local File Inclusion
High
CVE-2025-58707
Spin - Cricket Team Sports WordPress Theme + AI <= 1.8 - Unauthenticated Local File Inclusion
High
CVE-2025-58897
Fermentio — Brewery and Winemaking Restaurant WordPress Theme <= 1.5.0 - Unauthenticated Local File Inclusion
High
CVE-2025-69150
Medeus <= 1.14 - Unauthenticated Local File Inclusion
High
CVE-2025-58924
Geya - Renewable Energy & Ecology WordPress Theme <= 1.15 - Unauthenticated Local File Inclusion
High
CVE-2026-39661
SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-69112
Planty <= 1.14.0 - Unauthenticated Local File Inclusion
High
CVE-2025-69114
MaxiNet - Internet & IPTV Provider Elementor Template Kit <= 1.2.10 - Unauthenticated Local File Inclusion
High
CVE-2025-69130
Entrepreneur - Booking for Small Businesses WordPress <= 3.1.3 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-69105
Modernee <= 1.6.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24590
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.