Medium
c34ef5e3-afcd-4686-861f-5e382812233a
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-89278
GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
Medium
CVE-2026-87829
Checkout Field Manager <= 7.9.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
b54af5b0-d79a-4fb2-965f-d3ff4956dc5a
WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()
Medium
CVE-2026-84909
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Medium
CVE-2026-92400
Payment Gateway for PayPal on WooCommerce <= 9.2.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-12106
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Medium
adc90b32-f973-4c8e-b419-0614d4642b7f
WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite
Medium
CVE-2026-85574
Unbounce Landing Pages <= 1.1.4 - Missing Authorization
High
CVE-2026-93031
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Medium
CVE-2026-91847
Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-92420
Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
8b8d4431-ac72-45a2-b4a1-19690946d0ee
WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
Medium
CVE-2026-76554
Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation
Medium
83597e50-1992-4171-b24e-b14f55be6e4c
WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions
Medium
CVE-2026-92425
Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-92435
Mailchimp for WooCommerce <= 6.1.0 - Missing Authorization
Critical
CVE-2026-84750
Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-92099
WPGraphQL Smart Cache <= 2.3.1 - Missing Authorization
Medium
64453a11-e0dd-40f8-99c3-f05ef640b42b
WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller
High
CVE-2026-88926
VikRentItems Flexible Rental Management System <= 1.2.3 - Unauthenticated SQL Injection
Medium
CVE-2026-19860
JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2026-92403
Secure Custom Fields <= 6.9.3 - Missing Authorization
High
CVE-2026-85680
Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.