Medium
CVE-2026-8910
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-8909
WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
Medium
CVE-2026-8907
WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
Medium
CVE-2026-8904
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save
Medium
CVE-2026-8902
AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8841
Extra Settings for RocketChat <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-8977
WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action
Medium
CVE-2026-8499
Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update
Medium
CVE-2026-7662
ePaperFlip Publisher <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute
Medium
CVE-2026-5714
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
High
CVE-2026-7556
FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
Medium
CVE-2026-10862
Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
Low
CVE-2026-11477
hsweb-framework has an open redirect issue
Low
CVE-2026-11470
hsweb-framework has a Path Traversal issue
High
CVE-2026-49061
WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download
High
CVE-2026-49076
JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection
Critical
CVE-2026-49058
LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation
High
CVE-2026-49069
WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.21 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-49074
JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-49066
Conekta Payment Gateway <= 6.0.0 - Unauthenticated Information Exposure
Critical
CVE-2026-49063
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation
High
CVE-2026-49080
wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection
High
CVE-2026-49075
JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.