Medium
CVE-2026-63000
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-94500
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-63002
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Medium
CVE-2026-63001
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Medium
CVE-2026-94682
Podcast Importer SecondLine <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-94391
Ultimate FAQ Accordion Plugin <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-95528
Core Web Vitals & PageSpeed Booster <= 1.0.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-93620
PayPlus Payment Gateway <= 8.2.5 - Missing Authorization
Critical
CVE-2026-18467
Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Medium
CVE-2026-95590
Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-94179
Razorpay Payment Button Plugin <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-95513
Online Booking & Scheduling Calendar by vcita <= 4.6.0 - Missing Authorization
Medium
CVE-2026-95603
Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-95604
Tangible: Loops & Logic <= 4.2.4 - Missing Authorization
Medium
CVE-2026-95527
Conekta Payment Gateway <= 6.2.4 - Missing Authorization
High
CVE-2026-94176
Mang Board <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-93774
WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-93772
wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-95529
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-93526
Event Tickets and Registration <= 5.29.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-93622
WPS Limit Login <= 1.5.9.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-95530
PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 11.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-95515
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94498
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) <= 3.15.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.