Medium
CVE-2026-65473
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-65468
JetBooking <= 4.1.2 - Missing Authorization
Medium
CVE-2026-65550
Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2026-59547
Payment Gateway for PayPal on WooCommerce <= 9.1.4 - Missing Authorization
High
CVE-2026-65481
Vino <= 1.9 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-59525
Participants Database <= 2.7.8.3 - Unauthenticated SQL Injection
Medium
CVE-2026-65482
LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-65462
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.2 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2026-59540
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
High
CVE-2026-65477
Tonda Core <= 2.1.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-65496
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2026-65501
Shiptastic for WooCommerce <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-27392
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Medium
CVE-2026-25405
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-65506
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization
Medium
CVE-2026-59543
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-65475
Modula Image Gallery – Photo Grid & Video Gallery 2.14.25-2.14.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13146
Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
High
CVE-2026-114113
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
High
CVE-2026-73569
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Medium
CVE-2026-73565
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Medium
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.