High
CVE-2026-54545
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-45293
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
High
CVE-2026-43910
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Medium
CVE-2026-5626
Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
Medium
CVE-2026-15344
WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
High
CVE-2026-12476
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Medium
CVE-2026-15735
Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta
High
CVE-2026-12144
Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Medium
CVE-2026-17166
Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Medium
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Medium
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Medium
CVE-2026-17161
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
Medium
CVE-2026-17162
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
Medium
CVE-2026-15393
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
Medium
CVE-2026-65523
Formidable Forms Signature Online Contract Automation <= 2.0.1 - Unauthenticated Insecure Direct Object Reference
Critical
CVE-2026-65507
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
High
CVE-2026-65515
AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65546
Qode Tours <= 3.1.3.1 - Unauthenticated SQL Injection
High
CVE-2026-65552
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-14553
Zportals <= 6.3.3 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-15677
GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-65551
Breakdance <= 2.6.1 - Missing Authorization
High
CVE-2026-65509
wpDataTables (Premium) <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65513
Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.