High
CVE-2026-1667
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-39243
decompress allows arbitrary hardlink creation during archive extraction
High
CVE-2026-57712
WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.29 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57767
WP Google Maps Pro <= 10.1.02 - Unauthenticated Stored Cross-Site Scripting
The WP Google Maps Pro plugin for WordPress is vulnerable to stored cross-site scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into pages.
High
CVE-2026-59516
ICS Calendar <= 12.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57816
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57706
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11562
WS Form LITE <= 1.11.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Update
High
CVE-2026-15335
Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter
High
CVE-2026-15240
Customer Switching < 2.1.3 - Authenticated (Customer+) Privilege Escalation
High
CVE-2026-57668
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12687
ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Unauthenticated Group Registration Bypass
High
CVE-2026-57695
Document Gallery <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57708
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15382
Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion
High
CVE-2026-57735
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57711
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-15250
LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment
Medium
CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
Medium
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Medium
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Critical
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Critical
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
High
CVE-2026-52775
YesWiki has Authenticated SQL Injection via ReactionManager
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.