Medium
CVE-2026-28183
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-16298
FoodBoxBooker <= 1.0.6 - Privilege Escalation to Unauthenticated Arbitrary Password Reset
Medium
CVE-2026-66452
Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 - Missing Authorization
Critical
CVE-2026-18468
Login & Register Forms <= 4.0.1 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-66712
Simple Membership <= 4.7.8 - Missing Authorization
High
CVE-2026-66663
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-17010
Saitama Addon Pack < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66425
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization
Medium
CVE-2026-17008
Quick Paypal Payments < 5.7.51 - Unauthenticated Payment Bypass
High
CVE-2026-14592
WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28172
Tracking Code Manager <= 2.6.0 - Cross-Site Request Forgery
Medium
CVE-2026-16604
Passster – Password Protect Pages and Content < 4.3.6 - Missing Authorization
Medium
CVE-2026-66451
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization
High
CVE-2026-13596
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection
Medium
CVE-2026-11782
Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-12966
Direct Payments for WooCommerce – Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments < 2.5.3 - Missing Authorization
Medium
CVE-2026-28169
YITH WooCommerce Zoom Magnifier <= 2.52.0 - Unauthenticated Information Exposure
High
CVE-2026-17019
JetEngine <= 3.8.13.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-18470
Login & Register Forms <= 4.0.1 - Unauthenticated Registered User Email Address Disclosure
Medium
CVE-2026-17012
Restore PayPal Standard for WooCommerce <= 3.1.2 - Unauthenticated Payment Verification Bypass
Critical
CVE-2026-66665
Type Hub <= 2.0.6 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-17018
CubeWP Framework <= 1.1.30 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure
Medium
CVE-2026-28179
FiboSearch – Ajax Search for WooCommerce <= 1.33.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
High
CVE-2026-28177
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.23.0 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.