Medium
CVE-2026-81424
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-84937
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch < 2.1.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-84022
Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-84896
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder < 51.1.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-78150
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-84901
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization
Medium
9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-84930
CatFolders Document Gallery & PDF Library < 2.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-82846
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Medium
CVE-2025-15693
JCH Optimize 4.2.1 - 5.0.0 - Authenticated (Administrator+) Path Traversal
Medium
CVE-2026-83543
Greenshift – animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-84898
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal
Medium
CVE-2026-81348
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam < 4.2.3 - Unauthenticated Information Exposure
Medium
CVE-2026-15247
Search Atlas SEO – OTTO AI SEO Automation for WordPress < 2.6.24 - Missing Authorization
Medium
CVE-2026-84225
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-84221
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-84745
The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-84899
VikWidgetsLoader – Collection of Widgets < 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-83544
Greenshift – animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-84021
Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
ghsa-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
Critical
CVE-2024-11080
Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.22 - Unauthenticated Hook Injection
Medium
CVE-2026-76573
Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.