Medium
866f5121-81be-409e-b6d5-81b72bfb5539
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-62117
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-66666
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
Medium
CVE-2026-105872
Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection
Medium
71f883d7-edf5-409e-92c1-f87f880602d3
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
Medium
CVE-2026-62100
KuteShop <= 4.2.9 - Reflected Cross-Site Scripting
Medium
CVE-2026-45440
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-62093
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-42717
Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-62099
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-42712
Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-62095
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
High
CVE-2026-62096
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
High
CVE-2026-42711
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42715
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-104392
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-42777
Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-62091
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
High
CVE-2026-89417
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
High
CVE-2026-105855
Payload didn't enforce field-level password update restrictions
High
CVE-2026-105854
Payload: ReDoS in Multipart Content-Type Validation
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.