Medium
CVE-2026-18441
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-66625
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-14311
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Medium
CVE-2026-16582
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Medium
CVE-2026-66626
SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-66628
WP-Lister Lite for eBay <= 3.8.11 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2026-66631
MoreConvert Wishlist for WooCommerce <= 1.9.21 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-66630
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-16750
Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
High
CVE-2026-86814
UsersWP - Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
Medium
CVE-2026-86591
Botiga Pro <= 1.6.4 - Missing Authorization
Medium
CVE-2026-92430
Rede Itaú for WooCommerce <= 5.4.6 - Missing Authorization
Medium
CVE-2026-92421
Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-78296
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 - Unauthenticated Email Verification Bypass
Low
dc1ae2c7-1eff-4976-8f88-f0b97a5cf323
WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)
Medium
CVE-2025-15698
Business Name Generator <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Low
c41aadb1-e1a6-4bda-ac94-c461c320e78f
WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break
Medium
c34ef5e3-afcd-4686-861f-5e382812233a
WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route
Medium
CVE-2026-89278
GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
Medium
CVE-2026-87829
Checkout Field Manager <= 7.9.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
b54af5b0-d79a-4fb2-965f-d3ff4956dc5a
WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()
Medium
CVE-2026-84909
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Medium
CVE-2026-92400
Payment Gateway for PayPal on WooCommerce <= 9.2.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-12106
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.