Medium
CVE-2026-18057
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-61966
WPJAM Basic <= 7.0.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-66465
Cartify <= 1.3.0.1 - Missing Authorization
High
CVE-2026-66472
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection
Medium
CVE-2026-18789
Ezoic <= 2.23.0 - Missing Authorization
Medium
CVE-2026-19052
ProSolution WP Client <= 2.0.8 - Missing Authorization
Medium
CVE-2026-66467
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.7.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-16737
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
Medium
CVE-2026-13171
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation
Medium
CVE-2026-18962
Photo Album Plus <= 9.2.09.1 - Missing Authorization
High
CVE-2026-66478
Church Admin <= 5.1.1 - Unauthenticated SQL Injection
Medium
CVE-2026-17013
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-11880
Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
Medium
CVE-2026-66466
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.1.1 - Missing Authorization
Medium
CVE-2026-66642
WP Umbrella: Security Backup Restore & Monitoring 2.24.2-2.26.2 - Cross-Site Request Forgery
High
CVE-2026-66704
Gutenverse Companion <= 2.5.1 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-66444
Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure
Medium
cddbb0f8-fc73-46d7-80af-edb69227084f
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
Medium
cac1c1fa-7d6c-43c3-885e-9be320cb8f83
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass
Medium
c83a2c4d-a264-49ec-85f1-e3f48715d725
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
Medium
c3f9898b-0aa0-4dd1-9298-96c853dbef5c
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
High
CVE-2026-61982
SiteGuard WP Plugin <= 1.8.6 - Unauthenticated Stored Cross-Site Scripting
Medium
92babbbf-74bd-474f-9057-c5022a7d64c7
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
Medium
CVE-2026-14548
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.