High
CVE-2026-41231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-41232
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
Medium
CVE-2026-41233
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Medium
CVE-2026-65903
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Medium
CVE-2026-39540
Shipment Tracker for Woocommerce <= 1.5.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-40725
WooCommerce Product Filters 2.0.0 - 2.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40724
Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download
Medium
CVE-2026-39597
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Reflected Cross-Site Scripting
High
CVE-2026-40738
Eldon - Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40735
Reina <= 2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40731
ChapterOne <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2026-40727
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion
Medium
CVE-2026-40786
MyRewards <= 5.7.3 - Missing Authorization
Medium
CVE-2026-39548
MagOne <= 9.0 - Reflected Cross-Site Scripting
High
CVE-2026-40733
ShiftUp <= 1.3 - Unauthenticated PHP Object Injection
High
CVE-2026-39579
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-39532
Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39507
Social Slider Feed <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24972
Elated Listing <= 1.4 - Missing Authorization
Medium
CVE-2026-40726
User Registration Stripe <= 1.3.14 - Missing Authorization
Medium
CVE-2026-39593
HAPPY – Helpdesk Support Ticket System <= 1.0.10 - Missing Authorization
High
CVE-2026-39598
Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload
High
CVE-2026-40720
Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39594
Ultra Addons for WPForms <= 1.0.11 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.