Medium
CVE-2026-16559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-28143
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16039
MStore API <= 4.20.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure
Medium
CVE-2026-28147
Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization
Medium
CVE-2025-15678
Nexter Blocks <= 5.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-16988
GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure
Medium
CVE-2026-13703
SEO Redirection Plugin – 301 Redirect Manager <= 9.18 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16578
Admin Safety Guard <= 1.3.0 - Unauthenticated User Data Disclosure
Medium
CVE-2026-16595
Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure
Medium
CVE-2026-15214
Subscriptions for WooCommerce <= 2.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
High
CVE-2026-18464
Maps Pro <= 6.1.2 - Unauthenticated Denial of Service
Medium
CVE-2026-18037
Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure
Medium
CVE-2026-16992
Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure
High
CVE-2026-12713
WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection
Medium
CVE-2026-16574
Dokan <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant
Medium
CVE-2026-16594
Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure
Medium
CVE-2026-16957
Slim SEO <= 4.9.10 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Meta Disclosure
Medium
CVE-2026-16285
Product Attachment for WooCommerce < 2.3.3 - Unauthenticated Information Exposure
Medium
CVE-2025-15675
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-15151
Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.23 - Missing Authorization
Medium
CVE-2026-14938
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.95.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-16064
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization
Medium
CVE-2026-16292
Frontend File Manager Plugin <= 23.6 - Cross-Site Request Forgery
Medium
CVE-2026-16042
LWS Optimize – All-in-One Speed Booster & Cache Tools < 3.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.