High
CVE-2026-12144
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-17166
Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Medium
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Medium
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Medium
CVE-2026-17161
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
Medium
CVE-2026-17162
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
Medium
CVE-2026-15393
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
Medium
CVE-2026-65523
Formidable Forms Signature Online Contract Automation <= 2.0.1 - Unauthenticated Insecure Direct Object Reference
Critical
CVE-2026-65507
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
High
CVE-2026-65515
AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65546
Qode Tours <= 3.1.3.1 - Unauthenticated SQL Injection
High
CVE-2026-65552
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-14553
Zportals <= 6.3.3 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-15677
GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-65551
Breakdance <= 2.6.1 - Missing Authorization
High
CVE-2026-65509
wpDataTables (Premium) <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65513
Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-65547
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-65504
BOX NOW Delivery Croatia <= 3.3.0 - Missing Authorization
Medium
CVE-2026-65541
Staff Training <= 1.0.7 - Missing Authorization
High
CVE-2026-65545
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65520
WP OAuth Server ( Login with WordPress ) <= 6.2.0 - Unauthenticated SQL Injection
Medium
CVE-2026-65502
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 - Missing Authorization
Medium
CVE-2026-65543
Vimeo <= 1.2.2 - Authenticated (Subscriber+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.