Medium
CVE-2026-80339
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-85133
WPLP Cookie Consent <= 4.4.1 - Missing Authorization
Medium
CVE-2026-84935
HT Menu – WordPress Mega Menu Builder for Elementor < 1.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-84934
JCH Optimize < 6.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-85117
LukasApps CAPTCHA tools for Contact Form 7 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-16502
Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
High
CVE-2026-9331
EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter
Medium
CVE-2026-80341
Payment Plugins for PayPal WooCommerce <= 2.0.25 - Missing Authorization
Medium
CVE-2026-81741
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect
Medium
CVE-2026-18042
Travel <= 12.0.1 - Missing Authorization
High
CVE-2026-82304
Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQL Injection
Medium
CVE-2026-8279
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
High
CVE-2026-6431
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
Medium
CVE-2026-4945
Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
Medium
CVE-2026-84028
Bold Page Builder < 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-2390
Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
Medium
CVE-2026-12853
Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
High
CVE-2026-18056
HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
Critical
CVE-2026-75816
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
Critical
CVE-2026-16310
MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
High
pysec-2026-4010
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Critical
pysec-2026-4009
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
Medium
CVE-2026-84926
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization
Medium
CVE-2026-84931
Joli Table Of Contents < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.