High
CVE-2026-33479
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
High
CVE-2026-33418
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
High
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
High
CVE-2026-33331
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
High
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
Medium
CVE-2024-13785
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.4 - Unauthenticated Blind Arbitrary Shortcode Execution
High
CVE-2025-14037
Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion
Medium
CVE-2025-13910
WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting
Low
CVE-2026-2290
Post Affiliate Pro <= 1.29.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
Medium
CVE-2026-1247
Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-1275
Multi Post Carousel by Category <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute
Medium
CVE-2026-1278
Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields
Medium
CVE-2026-0609
Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode
Medium
CVE-2026-1093
WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Medium
CVE-2026-1393
Add Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1397
PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes
Medium
CVE-2026-1390
Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1378
WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1392
SR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1575
Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-1647
Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2026-1854
Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.