High
CVE-2026-39530
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-39474
Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-5809
wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
Medium
CVE-2026-4979
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
High
CVE-2026-5144
BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
Medium
CVE-2026-3358
Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
Medium
CVE-2026-4977
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
High
CVE-2026-3360
Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
Medium
CVE-2026-4664
Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
Medium
CVE-2026-42652
User Registration <= 5.1.5 - Reflected Cross-Site Scripting
Critical
CVE-2026-6443
Essentialplugin Plugins (Various Versions) - Injected Backdoor
Medium
CVE-2026-5742
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Medium
CVE-2026-4336
Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
High
CVE-2026-39555
Askka - Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-2519
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
High
CVE-2026-39522
Solene <= 3.4 - Unauthenticated Local File Inclusion
Critical
d7261e93-2341-4e14-a9b3-8fec295f6cde
Smart Slider 3 Pro 3.5.1.35 - Backdoor Embedded via Supply Chain Compromise
High
CVE-2026-39550
Aperitif <= 1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-39523
Solene Core <= 2.3.2 - Unauthenticated Local File Inclusion
High
CVE-2026-39559
Uppercase < 1.2.2 - Unauthenticated Local File Inclusion
High
CVE-2026-39549
Aperitif <= 1.5 - Unauthenticated Local File Inclusion
High
CVE-2026-39560
Hiroshi <= 1.5.1 - Unauthenticated PHP Object Injection
High
CVE-2026-39568
Mr. SEO <= 2.0 - Unauthenticated Local File Inclusion
High
CVE-2026-39552
Blueprint < 1.1.5 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.