Medium
CVE-2026-18386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-15823
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Medium
CVE-2026-15820
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
Medium
CVE-2026-15796
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
High
CVE-2026-76562
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
High
CVE-2026-14873
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
High
CVE-2026-15019
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Critical
CVE-2026-18351
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
Medium
CVE-2026-83541
Sina Extension for Elementor 3.7.1 - 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-81789
Advanced Product Fields Extended for WooCommerce <= 3.1.6 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-81803
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-81782
WP Docs <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
CVE-2026-14563
Advanced Customized Prompts <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-81022
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure
Medium
CVE-2026-84222
Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-81794
Shirt Product Designer for WooCommerce 1.0.4 - Missing Authorization
High
CVE-2026-84816
WPCS – WordPress Currency Switcher Professional <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14562
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Information Exposure
Medium
CVE-2026-86809
المنتور فارسی 2.7.10 - 2.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
Critical
CVE-2026-14560
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-15695
Translate WordPress with GTranslate < 3.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-15690
Content Mask 1.7.1 - 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-14559
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-26212
Rara One Click Demo Import <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.