High
CVE-2026-66633
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-32552
YITH WooCommerce Membership Premium <= 2.33.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-74015
Readabler < 2.0.18 - Unauthenticated SQL Injection
High
CVE-2026-32547
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66637
Featured Video Plus <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-14919
ShopMonitor.io – Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-73187
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons <= 1.4.2 - Unauthenticated SQL Injection
Medium
CVE-2026-73379
Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass
High
CVE-2026-73361
Recipe Card Blocks Lite <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-73359
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-73362
URL Shortify – Simple and Easy URL Shortener <= 2.5.0 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-14596
DynamicKit for Elementor < 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-73338
Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-73365
JetAppointment <= 2.5.2 - Unauthenticated SQL Injection
Medium
CVE-2026-66679
Appointment Hour Booking – Booking Calendar <= 1.5.94 - Missing Authorization
Medium
CVE-2026-66602
HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.0 - Cross-Site Request Forgery
Critical
CVE-2026-73996
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-66620
OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-66621
Ultimate Dashboard Pro <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66627
GP Premium <= 2.5.5 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2026-73404
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization
Medium
CVE-2026-27365
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 2.17.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-73397
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-73358
Affiliates Manager <= 2.9.53 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.