Medium
CVE-2026-75930
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-76063
FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
Medium
CVE-2026-17089
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
Medium
CVE-2026-14280
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
Medium
CVE-2026-10627
Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
Medium
CVE-2025-9878
Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-75982
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
Medium
CVE-2026-75019
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
Medium
CVE-2026-10630
WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
High
f20ead74-6db0-4bd2-82f6-0eb792288d70
FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter
Medium
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
High
CVE-2026-78262
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection
Medium
CVE-2026-19801
BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
Medium
CVE-2026-78266
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI <= 5.8.3 - Missing Authorization
Medium
CVE-2026-78268
Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 - Unauthenticated Information Exposure
Medium
CVE-2026-27364
Style Kits for Elementor <= 2.6.5 - Missing Authorization
High
CVE-2026-78282
Accept Stripe Payments <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-78267
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Privilege Escalation
High
CVE-2026-78263
Event Tickets and Registration <= 5.29.2.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-78265
The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection
High
CVE-2026-32563
ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-32561
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-32556
Boost <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-32555
Boost <= 2.0.4 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.