High
CVE-2026-55839
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
High
ghsa-2mf3-mr2r-r4vf
@rhinostone/swig: arbitrary local file read via include/extends path traversal
High
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Medium
CVE-2026-15421
Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Medium
CVE-2025-11729
PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
Medium
CVE-2026-73377
Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization
High
CVE-2026-73342
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66635
Slider by 10Web – Responsive Image Slider <= 1.2.62 - Cross-Site Request Forgery
High
CVE-2026-73375
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66622
Depicter — Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection
Medium
CVE-2026-73399
Flutterwave WooCommerce <= 3.3.0 - Missing Authorization
High
CVE-2026-73400
Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion
High
CVE-2026-73380
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-66643
Wufoo Shortcode <= 1.55 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66641
Video Conferencing with Zoom <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66638
Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66591
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66639
WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-66633
Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-32552
YITH WooCommerce Membership Premium <= 2.33.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-74015
Readabler < 2.0.18 - Unauthenticated SQL Injection
High
CVE-2026-32547
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66637
Featured Video Plus <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.