High
CVE-2026-49085
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2019-25727
10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download
High
CVE-2026-9691
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
High
CVE-2026-49104
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-10835
SALESmanago & Leadoo <= 3.11.2 - Unauthenticated SQL Injection
Medium
CVE-2026-49082
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-7654
Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
High
CVE-2026-10586
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
Critical
CVE-2026-10735
Multiple ShapedPlugin Plugins < (Various Versions) - Backdoored Software
High
CVE-2026-5305
Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-49107
Thrive Apprentice < 10.8.10.2 - Unauthenticated PHP Object Injection
High
CVE-2026-49769
wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection
High
CVE-2026-49770
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection
High
CVE-2026-49776
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 - Unauthenticated SQL Injection
Critical
CVE-2026-9690
Media folder Addon <= 4.0.1 - Unauthenticated Arbitrary File Download
High
CVE-2026-49765
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 - Unauthenticated PHP Object Injection
High
CVE-2026-49781
OttoKit: All-in-One Automation Platform <= 1.1.27 - Unauthenticated PHP Object Injection
High
CVE-2026-49109
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection
High
CVE-2026-49763
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-49768
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection
High
CVE-2026-49106
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-49108
Moderno < 1.43 - Unauthenticated PHP Object Injection
High
CVE-2026-10737
SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.