Medium
CVE-2026-13344
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-15257
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Missing Authorization
Medium
CVE-2026-14221
Easy Appointments < 4.0.1 - Missing Authorization
Medium
CVE-2026-16290
ProfileGrid <= 5.0.0.0 - Missing Authorization
Medium
CVE-2026-13330
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates < 2.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-11881
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-14188
Easy Appointments < 3.12.28 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-15153
WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection
Medium
CVE-2026-14240
Tourmaster <= 5.4.8 - Unauthenticated Information Exposure
Medium
CVE-2026-18050
Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure
Medium
CVE-2026-14226
Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13345
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 - Missing Authorization
Medium
CVE-2026-16734
Stripe Payment Forms by WP Full Pay <= 8.5.1 - Missing Authorization
High
CVE-2026-8143
HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
High
CVE-2026-15397
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
Medium
CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
Medium
CVE-2026-54705
mathlive's Lack of Escaping of HTML allows for XSS
Medium
CVE-2026-54704
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
Medium
CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
Unrated
CVE-2026-18260
drupal/disable_login - SA-CONTRIB-2026-110
Unrated
CVE-2026-18259
drupal/tca - SA-CONTRIB-2026-090
Low
CVE-2026-52838
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Low
CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
Medium
CVE-2026-52837
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.