Medium
CVE-2026-18558
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 391
Reset filters
High
CVE-2026-104021
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
Critical
CVE-2026-107645
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
Blocksy Companion allows unauthenticated attackers to gain Dokan vendor privileges and automatic login during registration, even if vendor signup is turned off.
Medium
CVE-2026-104387
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Missing Authorization
Medium
CVE-2026-104388
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Unauthenticated Information Exposure
Medium
CVE-2026-104407
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Cross-Site Request Forgery
Medium
CVE-2026-97354
PowerPress 11.13.12 - 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-104401
Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure
High
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
Medium
CVE-2026-92727
EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
High
CVE-2026-97641
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
High
CVE-2026-96343
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection
Medium
CVE-2026-97319
PowerPress <= 11.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-19775
OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
Medium
CVE-2026-96346
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-92967
Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
High
CVE-2026-15451
MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
Medium
CVE-2026-15439
GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-19946
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Medium
CVE-2026-75586
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
Medium
eda9ae01-cdc4-43e0-8a4c-1ec365939fa8
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Medium
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
High
CVE-2026-75807
SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
High
CVE-2026-6286
Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.