High
CVE-2026-16145
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-16146
Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values
Medium
CVE-2026-15948
Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
Medium
CVE-2026-16586
Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'
Medium
CVE-2026-17090
Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter
Medium
CVE-2026-16080
Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
Medium
CVE-2026-12128
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Medium
CVE-2026-8840
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
High
CVE-2026-15312
Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
High
CVE-2026-15162
Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
High
CVE-2026-14433
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
High
CVE-2026-15965
MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
Critical
CVE-2026-15341
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
Critical
CVE-2026-15303
6Storage Rentals <= 2.28.0 - Unauthenticated Account Takeover via 'email' Parameter
High
CVE-2026-15001
bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
Critical
CVE-2026-14484
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
High
CVE-2026-28568
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-32481
Ezoic <= 2.22.11 - Authentication Bypass
Medium
CVE-2026-14925
Import WP – Export and Import CSV and XML files to WordPress < 2.14.23 - Unauthenticated Information Exposure
Medium
CVE-2026-14332
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Missing Authorization
High
CVE-2026-32464
Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-15045
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.10 - Unauthenticated Payment Bypass
Critical
CVE-2026-13610
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation
Medium
CVE-2026-73352
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.