Medium
CVE-2026-74916
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-77701
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
Medium
CVE-2026-78273
Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-14550
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System < 3.0.18 - Missing Authorization
Medium
CVE-2026-81279
Push Notification for Post and BuddyPress <= 3.20 - Missing Authorization
Critical
CVE-2026-77002
SmilePass Selfie Login <= 1.0.2 - Authentication Bypass to Administrator
Medium
CVE-2026-78146
Simple Newsletter Plugin – Noptin < 4.3.3 - Missing Authorization
Medium
CVE-2026-80433
SureFeedback Client Site <= 1.2.12 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-81271
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery
Medium
CVE-2026-81273
FluentBooking Pro <= 2.2.4 - Cross-Site Request Forgery
Medium
CVE-2026-81274
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.67 - Missing Authorization
Medium
CVE-2026-81276
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.23 - Missing Authorization
Low
CVE-2026-81272
FluentPlayer Pro <= 1.3.2 - Missing Authorization
Medium
CVE-2026-77790
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-78275
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Deletion
High
CVE-2026-78274
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-14216
Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization
Medium
CVE-2026-81277
Suggestion Engine for WooCommerce <= 2.0.11 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-74930
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-77754
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization
Medium
CVE-2026-14326
Timetics < 1.0.62 - Authenticated (Staff+) Insecure Direct Object Reference
Critical
CVE-2026-19092
Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation
Medium
CVE-2026-13172
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure
Medium
CVE-2026-12514
Shared Files Pro < 1.7.70 & Shared Files Free < 1.7.67 - Unauthenticated Limited File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.