Medium
CVE-2026-12843
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-57777
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
High
CVE-2026-19224
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2025-15691
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
Medium
CVE-2026-27086
Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-82186
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2026-15354
ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Critical
CVE-2026-11613
Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Medium
f72c0a27-9602-4465-a14a-15c2a34e578b
Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
High
CVE-2026-84768
VikAppointments Services Booking Calendar <= 1.2.20 - Unauthenticated SQL Injection
Medium
CVE-2026-85303
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation
Medium
CVE-2026-85302
WPKoi Templates for Elementor <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
eda9ae01-cdc4-43e0-8a4c-1ec365939fa8
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Medium
CVE-2026-84767
Bookit — Booking & Appointment Calendar <= 2.6.0.3 - Missing Authorization
Medium
CVE-2026-82024
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting
Medium
CVE-2026-84755
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Missing Authorization
Medium
CVE-2026-78149
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content Disclosure
High
CVE-2026-77792
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12865
Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.44 - Reflected Cross-Site Scripting
High
CVE-2026-81807
Simple Ajax Chat – Add a Fast, Secure Chat Box < 20260827 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-84779
Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 - Missing Authorization
Medium
CVE-2026-77764
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 7.9.9.6 - Missing Authorization
Medium
CVE-2026-85309
Ultimate Maps by Supsystic <= 1.5.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.