Medium
CVE-2026-4244
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-4561
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
Medium
CVE-2026-19416
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
High
CVE-2026-2996
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
Critical
CVE-2026-75860
JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution
Medium
CVE-2026-19615
Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-18031
TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-19782
WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-18231
WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure
High
CVE-2026-13405
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-16058
YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure
High
CVE-2026-16950
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection
High
CVE-2026-16617
Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
Medium
CVE-2026-3424
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
Medium
CVE-2026-16979
SmartCrawl SEO checker, analyzer & optimizer < 3.16.3 - Missing Authorization
Medium
CVE-2026-19709
Membership For WooCommerce < 3.1.2 - Unauthenticated Information Exposure
Medium
CVE-2026-18777
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
Medium
CVE-2026-77115
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content < 0.8.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-55451
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
Critical
CVE-2026-77264
Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
Medium
ghsa-jm5p-837g-rv8g
Wagtail: Improper restriction handling on Page translation API endpoint
Medium
ghsa-x5cx-w6p2-mxf2
Wagtail: Improper permission handling when copying snippets
Medium
ghsa-c2xx-cjmh-9q8f
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.