Medium
CVE-2026-87907
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-84099
IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-76556
Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-85569
Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion
Medium
CVE-2026-87891
Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Missing Authorization
Critical
CVE-2026-81402
DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-87888
YayPricing – WooCommerce Dynamic Pricing & Discounts < 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-87854
Subscriptions for WooCommerce <= 2.0.2 - Unauthenticated Information Exposure
Medium
CVE-2026-80071
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation
Medium
CVE-2026-84088
Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-87896
Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-82124
Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Information Exposure
Medium
CVE-2026-89027
JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
Medium
CVE-2026-87959
WPBot 8.7.2 - 8.7.5 - Missing Authorization
High
CVE-2026-81742
BE REST Endpoints <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15609
Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
Medium
CVE-2026-82125
Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-86448
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
High
CVE-2026-76551
Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-85131
WPLP Cookie Consent <= 4.4.3 - Cross-Site Request Forgery
Medium
CVE-2026-76559
Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2026-84907
Eventin <= 4.1.23 - Missing Authorization
Medium
CVE-2026-90771
joi messages compilation allows prototype replacement through __proto__ error codes
Medium
CVE-2026-88912
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.