Medium
CVE-2026-66677
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-74012
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-66604
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66607
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66593
Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection
High
CVE-2026-66605
Swatchly – Product Variation Swatches for WooCommerce <= 1.4.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-73385
Outranking Plugin Options <= 1.1.3 - Missing Authorization
Medium
CVE-2026-73384
Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure
Medium
CVE-2026-73386
Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 - Unauthenticated Information Exposure
High
CVE-2026-66597
wpDataTables (Premium) <= 6.5.1.4 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-74001
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 5.4.5 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-73364
Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection
Medium
CVE-2026-66594
Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-73389
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
High
CVE-2026-73182
BBQ Pro <= 3.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-73993
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
Medium
CVE-2026-74021
Chaplin <= 2.6.8 - Missing Authorization
High
CVE-2026-66615
Podlove Podcast Publisher <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66596
Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66583
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
High
CVE-2026-66606
SmartSMTP <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66600
Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-66614
GEO Plugin by Squirrly SEO <= 14.2.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-73391
Total Donations <= 2.0.5 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.