Medium
CVE-2026-12395
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-24547
SiteGround Email Marketing <= 1.7.5 - Missing Authorization
High
CVE-2026-56053
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-56054
JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-10749
Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-10531
AI Share & Summarize < 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-56055
RH - Real Estate WordPress Theme <= 4.5.3 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-57429
Slim SEO – A Fast & Automated SEO Plugin For WordPress <= 4.6.2 - Missing Authorization
Medium
CVE-2026-12510
AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure
Medium
CVE-2026-56063
Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 - Missing Authorization
High
CVE-2026-11371
BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-12937
Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
Medium
CVE-2026-12094
Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter
Medium
CVE-2026-11997
Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-10552
Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter
Medium
CVE-2026-9619
Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
Medium
CVE-2026-9612
WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
High
CVE-2026-9178
WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint
Medium
CVE-2026-6292
MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update
Critical
CVE-2026-12416
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
Critical
CVE-2026-12417
SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
High
CVE-2026-8705
ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
High
CVE-2026-10091
Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12988
WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.