Medium
CVE-2026-2948
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-5957
EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
Medium
CVE-2026-1921
Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
Medium
CVE-2026-25863
Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service
High
CVE-2026-7049
PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
Medium
CVE-2026-6812
Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
Critical
CVE-2026-4882
User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
High
CVE-2026-6229
Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
High
CVE-2026-2052
Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic
High
CVE-2026-5113
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
High
CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
Medium
CVE-2026-4911
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
Medium
CVE-2026-6393
BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
High
CVE-2025-60085
Learnify - Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion
Critical
CVE-2026-3844
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Medium
CVE-2026-40783
Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-40779
Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-4132
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Medium
CVE-2026-4280
Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read
Critical
CVE-2026-40769
Contact Form Extender for Divi – Submissions DB & Extra Fields <= 1.0.6 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2026-4357
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
High
CVE-2026-40772
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.2 - Unauthenticated Arbitrary File Upload
High
CVE-2026-39440
FunnelFormsPro <= 3.8.1 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-6675
Responsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.