Medium
CVE-2026-54804
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Critical
CVE-2026-12375
Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor
High
CVE-2026-54188
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-4375
DoLeads Integrator <= 1.2.2 - Unauthenticated Remote Code Execution
High
CVE-2026-54186
JobSearch WP Job Board <= 3.2.9 - Unauthenticated SQL Injection
High
CVE-2026-54196
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-12115
Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
High
CVE-2026-54189
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12685
EscortWP <= 3.6.2 - Backdoored Software
Medium
CVE-2026-54802
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization
High
CVE-2026-54195
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.0.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-54185
Cornerstone < 7.8.8 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-2381
WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
High
CVE-2026-8176
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
High
CVE-2026-8442
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
Medium
CVE-2026-10093
File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
High
CVE-2026-8444
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter
Medium
CVE-2026-5149
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
Medium
CVE-2026-15284
King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
High
CVE-2026-8443
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
Medium
CVE-2026-10780
Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute
Medium
CVE-2026-9187
Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
High
CVE-2026-6933
Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation
Medium
CVE-2026-6964
Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.