High
CVE-2026-19806
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-19796
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
High
CVE-2026-19952
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
Medium
CVE-2026-81287
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-77194
Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding
Medium
CVE-2026-79621
CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce < 6.1.3 - Unauthenticated Email Content Injection
Medium
CVE-2026-75133
Keep Backup Daily <= 2.1.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-16983
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor < 4.0.6 - Authenticated (Subscriber+) Password-Protected Post Password Disclosure
Medium
CVE-2026-14215
Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization
Medium
CVE-2026-77010
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-83492
Kubio AI Website Builder < 2.9.1 - Authenticated (Admin+) Denial of Service
Critical
CVE-2026-12526
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Privilege Escalation via Administrator Account Takeover
Medium
CVE-2026-74927
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.13 - 5.0.14 - Unauthenticated Information Exposure
High
CVE-2026-66047
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force
Medium
CVE-2026-77782
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure
Medium
CVE-2026-77788
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
High
CVE-2026-19116
User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-15980
MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
Critical
CVE-2026-15369
Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
High
CVE-2026-75807
SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
Low
CVE-2026-77786
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
Medium
CVE-2026-77007
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-76547
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-16600
SmartAIPress <= 1.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.