High
CVE-2026-65481
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-65477
Tonda Core <= 2.1.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-65496
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2026-59543
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
High
CVE-2026-15802
WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
Critical
CVE-2026-57716
Broadcast Live Video <= 7.2.4 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-15149
Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation
High
CVE-2026-1771
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
Medium
CVE-2026-15208
RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-10524
CoCart <= 4.8.0 - Unauthenticated Price Manipulation
High
CVE-2026-57696
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion
Medium
CVE-2026-15244
HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
Medium
CVE-2026-15246
RealHomes Memberships <= 3.0.0 - Authenticated (Subscriber+) Payment Bypass
High
CVE-2026-15368
Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
High
CVE-2026-13158
Everest Toolkit <= 1.2.3 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-13157
Theme Demo Import <= 1.1.3 - Authenticated (Admin+) Arbitrary File Upload
Critical
Exploited in attacks
CVE-2026-63030
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
Medium
CVE-2026-9656
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
Medium
CVE-2026-15457
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
Medium
CVE-2026-15160
Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
Critical
CVE-2026-15932
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System < 1.4.48 - Unauthenticated Arbitrary File Download
High
CVE-2026-15005
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
High
CVE-2026-15008
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
High
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.