Medium
CVE-2026-15213
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-16094
Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter
Medium
CVE-2026-18049
WP Photo Album Plus < 9.2.07.002 - Missing Authorization
Medium
CVE-2026-16294
PowerPress Podcasting plugin by Blubrry < 11.17.1 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2026-16621
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-28567
WP Sort Order <= 1.3.5 - Missing Authorization
Medium
CVE-2026-16650
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass
Medium
CVE-2026-15993
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
Medium
CVE-2026-13712
Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-66667
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28570
Vavo Core <= 2.3.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-73189
WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
Critical
CVE-2026-12949
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
Medium
CVE-2026-16810
Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
Medium
CVE-2026-12743
affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-18109
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Medium
CVE-2026-28182
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-13177
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
Critical
CVE-2026-28192
Piotnet Addons For Elementor Pro <= 7.1.67 - Unauthenticated Arbitrary File Upload
High
CVE-2025-53345
Thim Core <= 2.3.3 - Authenticated (Subscriber+) Remote Code Execution
High
CVE-2026-28187
Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28154
Samex - Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting
Critical
CVE-2026-28185
Log in with Google <= 1.4.2 - Authentication Bypass
Medium
CVE-2026-14230
ECS <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.