High
CVE-2026-43976
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-42708
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42710
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Authenticated (Author+) SQL Injection
High
CVE-2026-82627
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Medium
CVE-2026-17538
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Medium
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Medium
CVE-2026-42713
Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42714
Pix por Piggly (para Woocommerce) <= 2.1.2 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2026-42720
Dynamic User Directory <= 2.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42721
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-27434
WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
Medium
CVE-2026-104390
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization
Medium
CVE-2026-105876
Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 - Unauthenticated Information Exposure
Medium
CVE-2026-104393
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105875
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-104391
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-103075
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization
Medium
CVE-2026-105873
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105884
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-97294
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105871
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-42705
Grand News <= 3.4 - Missing Authorization
High
CVE-2026-105318
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94062
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.