Medium
CVE-2026-76227
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2025-23368
Wildfly Elytron integration susceptible to brute force attacks via CLI
Medium
CVE-2026-1249
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery
Critical
CVE-2025-8572
Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
Medium
CVE-2026-1258
Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
Medium
CVE-2026-1254
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
High
CVE-2026-1843
Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log
Medium
CVE-2026-0550
myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Medium
CVE-2025-15483
Link Hopper <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter
Medium
CVE-2026-1903
Ravelry Designs Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute
Medium
CVE-2026-1910
UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute
Critical
CVE-2026-1306
midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
Medium
CVE-2026-0736
Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field
Medium
CVE-2026-1792
Geo Widet <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-1985
Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
Medium
CVE-2026-2022
Smart Forms <= 2.6.100 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure
Medium
CVE-2026-26226
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)
Medium
CVE-2026-0735
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter
Medium
CVE-2026-0745
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
Medium
CVE-2026-0751
Payment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter
Medium
CVE-2025-14852
MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-1303
MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection
Medium
CVE-2026-1394
WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1939
Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.