High
CVE-2026-18056
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-75816
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
Critical
CVE-2026-16310
MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
High
pysec-2026-4010
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Critical
pysec-2026-4009
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
Medium
CVE-2026-84926
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization
Medium
CVE-2026-84931
Joli Table Of Contents < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-81424
Accept Stripe Payments < 2.1.4 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-84937
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch < 2.1.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-84022
Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-84896
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder < 51.1.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-78150
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-84901
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization
Medium
9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-84930
CatFolders Document Gallery & PDF Library < 2.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-82846
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Medium
CVE-2025-15693
JCH Optimize 4.2.1 - 5.0.0 - Authenticated (Administrator+) Path Traversal
Medium
CVE-2026-83543
Greenshift – animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-84898
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal
Medium
CVE-2026-81348
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam < 4.2.3 - Unauthenticated Information Exposure
Medium
CVE-2026-15247
Search Atlas SEO – OTTO AI SEO Automation for WordPress < 2.6.24 - Missing Authorization
Medium
CVE-2026-84225
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-84221
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.