Medium
CVE-2026-24597
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-39436
cformsII <= 15.1.3 - Cross-Site Request Forgery
High
CVE-2026-42687
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection
Low
CVE-2026-27346
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.10 - Missing Authorization
Medium
CVE-2026-24592
Auto Affiliate Links <= 6.8.8.3 - Missing Authorization
High
CVE-2026-42733
WPCS – WordPress Currency Switcher Professional <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27398
RSVP and Event Management <= 2.7.16 - Missing Authorization
Medium
CVE-2025-62745
Team Showcase <= 1.22.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24582
FlexTable – Data Table Sync with Google Sheets <= 3.24.0 - Missing Authorization
Medium
CVE-2026-32389
NanoCare < 1.2.2 - Missing Authorization
High
CVE-2026-24937
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-8386
Go Maps <= 10.0.9 - Unauthenticated Information Exposure
Medium
CVE-2026-9278
Form Builder CP <= 1.2.46 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-24586
Newses <= 2.0.0.77 - Missing Authorization
Medium
CVE-2026-24527
Autoship Cloud for WooCommerce Subscription Products <= 2.14.3 - Missing Authorization
Medium
CVE-2026-27357
Search Analytics for WP < 1.5.0 - Missing Authorization
Medium
CVE-2026-24574
Export WordPress Pages to Static HTML & PDF — Static Site Export <= 6.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-24554
Subscription & Recurring Payment for WooCommerce <= 1.9.1 - Cross-Site Request Forgery
High
CVE-2026-4372
HuggingFace transformers vulnerable to remote code execution
Medium
CVE-2026-42732
Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization
Critical
CVE-2026-42731
miniOrange OTP Login, Verification and SMS Notifications <= 5.4.9 - Unauthenticated Privilege Escalation
Medium
CVE-2026-42730
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-15546
Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite
Medium
CVE-2026-42686
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.