Medium
CVE-2026-14224
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-66696
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-65554
AnsPress – Question and answer 4.4.4 - Missing Authorization
Medium
CVE-2026-66692
Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference
Medium
CVE-2026-18197
Link Library < 7.9.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-61968
myCred <= 3.1.2 - Missing Authorization
Medium
CVE-2026-17515
MLS Import <= 7.0.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16055
Contest Gallery <= 30.0.6 - Unauthenticated Two-Factor Authentication Bypass
Medium
CVE-2026-16036
miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass
Medium
CVE-2026-66688
Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66703
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-12584
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-66701
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization
High
CVE-2026-14270
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
High
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Medium
CVE-2026-8791
Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
76fb0ffd-32c1-483d-ae95-9bc70ba1c064
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
Medium
CVE-2026-7436
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
Medium
CVE-2026-5060
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
Medium
CVE-2026-5582
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
Medium
CVE-2026-6089
WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2026-4604
Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
High
CVE-2026-32203
Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.