Medium
CVE-2026-78125
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-78292
Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-77016
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-78286
Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
Medium
CVE-2026-13416
CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting
High
CVE-2026-78271
FluentCRM Pro <= 3.1.12 - Authenticated (Editor+) Privilege Escalation
Medium
CVE-2026-78285
Like Button Rating ♥ LikeBtn <= 2.6.61 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-75977
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
Medium
CVE-2026-19454
JetBackup – Backup, Restore & Migrate 3.1.18.8 - 3.1.23.3 - Authenticated (Admin+) Backup Download
High
CVE-2026-78283
Music Player for WooCommerce <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-78289
CozyStay - Hotel Booking WordPress Theme <= 1.10.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16612
FiboSearch – Ajax Search for WooCommerce < 1.34.1 - Unauthenticated Information Exposure
High
CVE-2026-78293
WP w3all phpBB <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-3235
WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
Medium
CVE-2026-6178
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
Medium
CVE-2026-32550
Kadence Shop Kit <= 3.0.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-78260
ePayco plugin for WooCommerce <= 8.4.6 - Unauthenticated SQL Injection
Critical
CVE-2026-32566
ACPT (Premium) <= 2.0.63 - Unauthenticated Privilege Escalation
High
CVE-2026-74932
Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-3002
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
Critical
CVE-2026-18052
ManageWP Worker < 4.9.37 - Authentication Bypass
High
CVE-2026-18884
WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
Medium
CVE-2026-32564
ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.