High
CVE-2026-59544
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-27064
Mailster - Email Newsletter Plugin for WordPress <= 4.1.17 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-65497
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-65464
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery
Medium
CVE-2026-65472
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.3.5 - Missing Authorization
High
CVE-2026-65481
Vino <= 1.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-65462
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-65477
Tonda Core <= 2.1.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-57626
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
Critical
CVE-2026-13439
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
Medium
CVE-2026-15782
WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
Medium
CVE-2026-15208
RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-9734
W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-15244
HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
Medium
CVE-2026-15246
RealHomes Memberships <= 3.0.0 - Authenticated (Subscriber+) Payment Bypass
Critical
Exploited in attacks
CVE-2026-63030
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
Medium
CVE-2026-9656
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
High
CVE-2026-13765
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
High
CVE-2026-13352
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
Medium
CVE-2026-15457
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
High
CVE-2026-15395
Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
Medium
CVE-2026-15159
Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
Critical
CVE-2026-15932
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System < 1.4.48 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-61945
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.