Medium
CVE-2026-84847
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-81737
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-81423
Accept Stripe Payments < 2.1.4 - Unauthenticated Open Redirect
Medium
CVE-2026-84849
Pre-Orders for WooCommerce <= 2.3.1 - Missing Authorization
High
CVE-2026-84753
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-85305
SEOPress – AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-19859
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-19862
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection
Medium
CVE-2026-84936
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
High
CVE-2026-84815
Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-19084
Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read
High
CVE-2026-84834
JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Medium
CVE-2026-2573
GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
Medium
CVE-2026-84044
Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion
Medium
CVE-2026-15232
MotoPress Appointment Booking < 2.4.8 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-81198
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2025-15663
Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-19704
Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection
Medium
CVE-2026-81426
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Cross-Site Request Forgery
High
CVE-2026-84775
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service
Medium
CVE-2025-15664
Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-81195
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization
High
CVE-2026-84763
RTMKit <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.