Mittel
CVE-2026-4792
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 8.950
Filter zurücksetzen
Kritisch
CVE-2026-89274
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
Mittel
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Mittel
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Mittel
CVE-2026-15660
SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
Hoch
CVE-2026-92807
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Kritisch
CVE-2026-84434
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Mittel
CVE-2026-15760
Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Mittel
CVE-2026-89093
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Mittel
CVE-2026-89334
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Mittel
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
Hoch
CVE-2026-87909
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
Hoch
CVE-2026-85017
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
Mittel
CVE-2026-85113
GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution
Mittel
CVE-2026-13471
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Mittel
CVE-2026-14472
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Mittel
CVE-2026-75961
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
Mittel
CVE-2026-16777
Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Mittel
CVE-2026-92622
Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Mittel
CVE-2026-92249
Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Hoch
CVE-2026-14323
Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Mittel
CVE-2026-90981
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
Mittel
CVE-2026-17576
InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
Hoch
CVE-2026-89413
Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.