Critical
CVE-2026-3535
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-3480
WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter
Medium
CVE-2026-3477
PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter
Medium
CVE-2025-1794
AM LottiePlayer <= 3.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2026-3781
Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
Medium
CVE-2026-4871
Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute
High
CVE-2026-4808
Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2026-3618
Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute
Medium
CVE-2026-4141
Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form
Medium
CVE-2026-3594
Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
Medium
CVE-2026-3142
Pinterest Site Verification plugin using Meta Tag <= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var'
Medium
CVE-2026-5506
Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5508
WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5169
Inquiry form to posts or pages <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Medium
CVE-2026-35586
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
High
CVE-2026-35523
strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
Medium
CVE-2026-3311
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar
High
CVE-2026-35526
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
Critical
CVE-2026-35490
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
Medium
CVE-2026-3600
Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute
Low
CVE-2026-34781
Electron: Crash in clipboard.readImage() on malformed clipboard image data
Medium
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Medium
CVE-2026-3239
Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.