High
CVE-2026-96761
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-95609
Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-96329
tagDiv Opt-In Builder <= 1.7.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-96328
JNews - Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
High
CVE-2026-94632
BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-95599
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 6.0.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-94270
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
Medium
CVE-2026-94568
Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-94661
JetBlog <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95598
Search in Place <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39718
Wallstreet <= 2.8.6 - Cross-Site Request Forgery
Medium
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Critical
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Medium
CVE-2026-97343
Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
High
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
Medium
CVE-2026-92974
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
Medium
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
High
CVE-2026-97660
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
Medium
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
Medium
CVE-2026-103421
WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
Medium
CVE-2026-100157
WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
Medium
CVE-2026-103519
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
High
CVE-2026-96267
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
High
CVE-2026-93889
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.