High
CVE-2026-97253
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-85081
Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-96825
All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass
Medium
CVE-2026-97078
Sprout Invoices – Client Invoicing & Estimates <= 20.8.17 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-97196
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation
Medium
CVE-2026-96526
MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-96531
Optimole 4.0.0 - 4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-96525
MCP Server for WordPress <= 1.8.1 - Missing Authorization
High
CVE-2026-96830
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94123
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-96348
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization
Medium
CVE-2026-97247
Blocksy Companion <= 2.1.55 - Missing Authorization
High
CVE-2026-94681
WP Store Locator < 3.0.0 - Unauthenticated Denial of Service
Medium
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-96838
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 - Cross-Site Request Forgery
High
CVE-2026-56669
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
High
CVE-2026-61685
ReactPress has SQL injection via dynamic column names in TypeORM query builders
Medium
ghsa-8pcw-h6w9-h46g
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
Medium
CVE-2026-3253
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
Medium
CVE-2026-4806
Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset
Medium
CVE-2026-16302
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2026-18335
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
High
CVE-2026-77394
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
High
CVE-2026-76089
Formie: Missing authorization on sent notification resend modal exposes submission PII
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.