Critical
CVE-2026-19652
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-103068
ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-97281
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.7 - Missing Authorization
Medium
CVE-2026-97280
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO 3.1.0 - Missing Authorization
Medium
CVE-2026-94390
Hide Shipping Method For WooCommerce <= 1.5.4 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-97284
Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-103347
hCaptcha for WP <= 5.3.0 - Unauthenticated Captcha Verification Bypass
Medium
CVE-2026-88782
Kubio AI Page Builder <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-92437
Mailchimp for WooCommerce <= 6.2 - Missing Authorization
Medium
CVE-2026-101160
Ultimate Review <= 2.4.3 - Unauthenticated Persistent Denial of Service
High
CVE-2026-88783
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-103514
2FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass
Medium
CVE-2026-86833
MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails
Critical
CVE-2026-95588
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-92144
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
High
CVE-2026-92244
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
High
CVE-2026-15983
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Medium
CVE-2026-100184
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Medium
CVE-2026-100179
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Medium
CVE-2026-101925
bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
Medium
CVE-2026-96268
Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
Medium
CVE-2026-90992
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
High
CVE-2026-95687
WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
Medium
CVE-2026-19902
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.