Medium
CVE-2026-15252
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-16620
WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-18436
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
Critical
CVE-2026-16054
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.7 - Unauthenticated Arbitrary File Deletion
Low
CVE-2026-16954
AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure
Medium
CVE-2026-14547
Estatik Real Estate <= 4.3.2 - Unauthenticated Mail Relay
Medium
CVE-2026-14318
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting
High
CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
High
CVE-2026-14356
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
Medium
CVE-2026-1982
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
Medium
CVE-2026-66699
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
Medium
CVE-2026-16036
miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass
Medium
CVE-2026-66703
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-5582
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
Critical
CVE-2026-14488
Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter
Critical
CVE-2026-14900
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
Critical
CVE-2026-18072
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
High
CVE-2026-12476
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
High
CVE-2026-12144
Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Medium
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Medium
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Critical
CVE-2026-65507
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
High
CVE-2026-65552
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-65547
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.