Medium
CVE-2026-14029
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
Medium
CVE-2026-11592
Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
Medium
CVE-2026-13333
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
Medium
CVE-2026-57322
weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-57645
Newsletters <= 4.13 - Missing Authorization
Medium
CVE-2026-13331
Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter
Medium
CVE-2026-57667
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection
Medium
CVE-2026-13226
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
High
CVE-2026-12583
Newsletters <= 4.14 - Unauthenticated PHP Object Injection
Medium
CVE-2026-54840
Newsletters <= 4.13 - Missing Authorization
High
CVE-2026-3018
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
Medium
CVE-2026-8599
MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
Medium
CVE-2026-8089
weMail <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-7618
EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-7798
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
Medium
CVE-2026-27349
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-5200
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Medium
CVE-2026-40793
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization
High
CVE-2026-40727
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion
High
CVE-2026-3614
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-2025
Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more < 1.19.5 - Unauthenticated Information Disclosure
Medium
CVE-2026-1651
Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
Medium
CVE-2025-14339
weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.