Medium
CVE-2026-49112
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-8385
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
Medium
CVE-2026-8608
Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action
High
CVE-2026-49085
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49081
User Registration Stripe <= 1.3.12 - Missing Authorization
Medium
CVE-2019-25727
10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download
High
CVE-2026-9691
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
High
CVE-2026-49104
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-10835
SALESmanago & Leadoo <= 3.11.2 - Unauthenticated SQL Injection
Medium
CVE-2026-49078
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 - Missing Authorization
High
CVE-2026-49079
JetSearch <= 3.5.17 - Unauthenticated SQL Injection
Medium
CVE-2026-9016
Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
Medium
CVE-2026-10823
YMC Smart Filter <= 3.11.2 - Unauthenticated Private/Draft Post Disclosure
Medium
CVE-2026-49082
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2019-25738
Hybrid Composer <= 1.4.6 - Missing Authorization
High
CVE-2026-7654
Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Critical
CVE-2026-47708
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Critical
ghsa-jpvj-wpmj-h7rv
Supply chain compromise via malicious @cap-js/openapi
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Medium
CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.