Medium
CVE-2026-39796
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,415
Medium
CVE-2026-39787
10WebSocial <= 1.4.35 - Missing Authorization
Medium
CVE-2026-39788
Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-39791
Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
High
CVE-2026-39778
Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39780
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39781
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39785
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection
High
CVE-2026-39784
Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39773
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-39775
JobZilla - Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-39776
Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Editor+) Remote Code Execution
High
CVE-2026-39790
VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-39770
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-39767
WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service
High
CVE-2026-75962
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
Medium
CVE-2026-66588
The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization
Medium
CVE-2026-39762
Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Missing Authorization
High
CVE-2026-39764
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.19 - Unauthenticated SQL Injection
Medium
CVE-2026-39765
PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2026-39766
ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42634
Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42636
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42638
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.