High
CVE-2026-6518
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-2262
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
High
CVE-2026-5718
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
High
CVE-2026-5710
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field
High
CVE-2026-3464
WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
Critical
a882c3d9-b4c1-4743-b930-382ca1081bab
WowShipping Pro 1.0.6 - Injected Backdoor
Medium
CVE-2026-6439
VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field
High
CVE-2026-4659
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
Medium
CVE-2026-5234
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Medium
CVE-2026-5427
Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes
Medium
CVE-2026-3330
Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
Medium
CVE-2026-4666
wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
Medium
CVE-2026-3488
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
High
CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
Medium
CVE-2026-4160
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
High
CVE-2026-40725
WooCommerce Product Filters 2.0.0 - 2.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40724
Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download
High
CVE-2026-40738
Eldon - Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40735
Reina <= 2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40731
ChapterOne <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2026-40733
ShiftUp <= 1.3 - Unauthenticated PHP Object Injection
High
CVE-2026-39532
Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-40736
Laurits <= 1.5.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40739
LuxeDrive - Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.