Medium
CVE-2026-77150
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-84960
WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-78172
Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
High
CVE-2026-81754
Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-81825
Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-18579
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-18561
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
High
CVE-2026-15462
Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
Medium
CVE-2026-18964
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
Medium
CVE-2026-19985
Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting
High
CVE-2026-19991
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-12215
OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
Medium
CVE-2026-11496
Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
Critical
CVE-2026-8778
MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-15439
GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-7438
Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
Medium
CVE-2026-62139
Site Kit by Google – Analytics, Search Console, AdSense, Speed <= 1.186.0 - Cross-Site Request Forgery
High
CVE-2026-81090
Gpx2Graphics <= 0.3 - Cross-Site Request Forgery to Arbitrary File Upload
High
CVE-2026-82845
Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-62133
RTMKit <= 2.1.5 - Cross-Site Request Forgery
Medium
CVE-2026-62132
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Missing Authorization
Medium
CVE-2026-87916
WPBot <= 8.5.9 - Unauthenticated Information Exposure
Critical
CVE-2026-75800
Frontegg SAML SSO <= 1.0.1 - Authentication Bypass to Admin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.