Medium
CVE-2026-66432
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-18988
Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute
Medium
CVE-2026-66460
AfterShip Tracking <= 1.18.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-19077
Copy & Delete Posts <= 1.5.4 - Missing Authorization
Medium
CVE-2026-66443
REST API Log <= 1.7.1 - Unauthenticated Information Exposure
Medium
CVE-2026-66453
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization
High
CVE-2026-66450
Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion
Critical
CVE-2026-19089
Product Input Fields for WooCommerce <= 2.0.1 - Unauthenticated Arbitrary File Upload
High
CVE-2026-66449
Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-61985
Car Rental Manager – Online Vehicle Booking System <= 1.3.7 - Missing Authorization
Medium
CVE-2026-18200
FoodBoxBooker <= 1.0.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update
Medium
CVE-2026-19074
Advanced Classifieds & Directory Pro <= 3.4.2 - Unauthenticated Non-Public Listing Custom Field Disclosure
Medium
CVE-2026-66441
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.10 - Missing Authorization
Medium
CVE-2026-66430
Visitor Traffic Real Time Statistics pro <= 11.10 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-15047
s2Member <= 260804 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19794
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66429
Visitor Traffic Real Time Statistics pro <= 11.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14211
Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure
Medium
CVE-2026-66431
Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization
Medium
CVE-2026-66454
WP Social Avatar <= 1.5 - Missing Authorization
Medium
CVE-2026-72779
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium
CVE-2026-72782
Craft CMS: Authenticated leak of secret environment variables
Medium
CVE-2026-72785
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium
CVE-2026-14794
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.