Medium
CVE-2026-8626
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-8624
LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Medium
CVE-2026-8685
Infility Global <= 2.15.19 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-8424
Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2026-8423
JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
Medium
CVE-2026-8420
BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Medium
CVE-2026-8419
Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Medium
CVE-2026-8418
Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
Medium
CVE-2026-7462
VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter
High
CVE-2026-6456
Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
Medium
CVE-2026-6452
Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update
Medium
CVE-2026-6404
Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
Medium
CVE-2026-6401
Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-6400
Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
Medium
CVE-2026-6399
General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
Medium
CVE-2026-6397
Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
Medium
CVE-2026-6395
Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
Medium
CVE-2026-6394
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
Medium
CVE-2026-6391
Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters
Critical
CVE-2026-6555
ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'
Medium
CVE-2026-8038
Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
Medium
CVE-2026-6072
Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Medium
CVE-2026-5293
診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
Medium
CVE-2026-8922
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.