High
CVE-2026-1233
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-3445
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
Medium
CVE-2026-3571
Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification
High
CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
Medium
CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Medium
CVE-2026-40764
Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery
Medium
CVE-2026-34887
Kubio AI Page Builder <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Medium
CVE-2026-4020
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Critical
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
High
CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Medium
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
High
CVE-2026-3124
Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Medium
CVE-2026-39543
Tourfic <= 2.21.4 - Missing Authorization
Medium
CVE-2026-39506
AI Engine (Pro) < 3.4.2 - Missing Authorization
Medium
CVE-2026-2442
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
Medium
CVE-2026-1307
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
High
CVE-2026-4987
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
High
CVE-2026-32505
Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-3098
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
Medium
CVE-2026-39516
Nexter Blocks <= 4.7.0 - Unauthenticated Information Exposure
Medium
CVE-2026-4281
FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
Medium
CVE-2026-4331
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.