Medium
CVE-2026-42717
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-62099
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-42712
Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-62095
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
High
CVE-2026-62096
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
High
CVE-2026-42711
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42715
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-104392
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-42777
Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-62091
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
High
CVE-2026-89417
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
High
CVE-2026-105855
Payload didn't enforce field-level password update restrictions
High
CVE-2026-105854
Payload: ReDoS in Multipart Content-Type Validation
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
High
CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
Medium
CVE-2026-105852
Payload relationship-query authorization bypass
High
CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
Medium
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
High
CVE-2026-105806
Payload: Improper access control for MCP API keys
Critical
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
Critical
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
Medium
CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.