Medium
CVE-2026-8840
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-15312
Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
High
CVE-2026-15162
Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
High
CVE-2026-14433
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
High
CVE-2026-15965
MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
Critical
CVE-2026-15341
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
Critical
CVE-2026-15303
6Storage Rentals <= 2.28.0 - Unauthenticated Account Takeover via 'email' Parameter
High
CVE-2026-15001
bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
Critical
CVE-2026-14484
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
High
CVE-2026-28568
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-32481
Ezoic <= 2.22.11 - Authentication Bypass
Medium
CVE-2026-14925
Import WP – Export and Import CSV and XML files to WordPress < 2.14.23 - Unauthenticated Information Exposure
Medium
CVE-2026-14332
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Missing Authorization
High
CVE-2026-32464
Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-15045
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.10 - Unauthenticated Payment Bypass
Critical
CVE-2026-13610
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation
Medium
CVE-2026-73352
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization
High
CVE-2026-13360
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
Medium
CVE-2026-18391
WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-73356
Breeze Cache <= 2.5.12 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
High
CVE-2026-32553
OttoKit: All-in-One Automation Platform <= 1.1.35 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-73997
Kadence Starter Templates — Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service
High
CVE-2026-32465
Essential Real Estate <= 5.3.3 - Authenticated (Customer+) PHP Object Injection
Medium
CVE-2026-14857
WP Crowdfunding < 2.2.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.