Medium
CVE-2026-57400
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-57402
Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-11359
Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
High
CVE-2026-57416
SiteGround Email Marketing <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57395
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
Medium
CVE-2026-57422
Bopo – WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-57393
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-57406
FundEngine – Donation and Crowdfunding Platform <= 1.7.6 - Missing Authorization
High
CVE-2026-57815
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-57390
Extra Product Options Builder for WooCommerce <= 1.2.167 - Missing Authorization
Critical
CVE-2026-14300
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-9253
WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
High
CVE-2026-13441
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
Medium
CVE-2026-57419
Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization
High
CVE-2026-11974
Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Read
Critical
CVE-2026-57768
Houzez Login Register <= 3.3.3 - Unauthenticated Privilege Escalation
High
CVE-2026-57396
Free Gifts for WooCommerce <= 13.1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57392
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
High
CVE-2026-57389
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
High
CVE-2026-57415
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57398
Real Estate Manager Pro <= 12.8.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57401
SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion
Medium
CVE-2026-4653
Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
Medium
CVE-2026-6740
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.