Medium
CVE-2026-3481
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-9018
Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter
Medium
CVE-2026-2518
FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
Medium
CVE-2026-9104
Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
Medium
CVE-2026-6864
CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter
Medium
CVE-2026-7509
KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Medium
CVE-2026-7249
Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging
High
CVE-2026-4834
WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
Medium
CVE-2026-4843
GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
Critical
CVE-2026-6960
BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field
Medium
CVE-2026-27349
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure
Medium
347feeaa-2d5c-4818-ab9e-2125a00b8ae8
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-27393
WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms <= 1.7.6 - Missing Authorization
Medium
0114a028-42ef-4668-815f-d62494565116
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-1543
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Critical
CVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Medium
CVE-2026-4811
WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field
Medium
CVE-2026-1881
Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
Medium
CVE-2026-9065
SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-42383
YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-27405
Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization
Medium
CVE-2026-48094
ShareOpenly < 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-27424
Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization
High
CVE-2026-42756
QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly <= 3.2.7 - Authenticated (Contributor+) Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.