High
CVE-2026-6176
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-6128
All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
High
CVE-2026-81290
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-5096
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
High
CVE-2026-77008
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2026-81342
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect
High
CVE-2026-5097
wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
Medium
CVE-2026-81284
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization
Medium
CVE-2026-16568
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-81759
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.5.0 - Missing Authorization
Medium
CVE-2026-78139
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist < 3.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-81285
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service
Medium
CVE-2026-4246
ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
High
CVE-2026-6286
Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
Medium
CVE-2026-77017
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-81777
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.0 - Unauthenticated Captcha Bypass
Medium
CVE-2026-75797
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-76549
UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery
High
CVE-2026-77012
爱采集数据采集和发布插件 <= 1.0.0 - Unauthenticated Arbitrary File Read
High
CVE-2026-81760
JetEngine <= 3.8.14.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-77018
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-13159
Real Estate Papi <= 1.0.5 - Cross-Site Request Forgery
Medium
CVE-2026-78138
Finale Lite – Sales Countdown Timer & Discount for WooCommerce < 2.21.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-18233
MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.