Medium
CVE-2026-9832
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-2422
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
Medium
CVE-2026-12402
OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
Medium
CVE-2026-15946
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Medium
CVE-2026-15947
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Medium
CVE-2026-13200
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
Medium
CVE-2026-13191
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter
Medium
CVE-2026-75959
GoPay for WooCommerce <= 1.0.34 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
Medium
CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Medium
CVE-2026-1984
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Medium
CVE-2026-5400
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
Medium
CVE-2026-7527
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
High
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Medium
CVE-2026-9615
Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Medium
CVE-2026-87917
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Medium
CVE-2026-9232
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Medium
CVE-2026-9855
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Medium
CVE-2026-13770
AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
Medium
CVE-2026-4792
Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
High
CVE-2026-93749
source-map-js allows event-loop denial of service through indexed source-map section offsets
High
CVE-2026-93748
http-cache-semantics max-stale handling can disclose cross-user cached responses
High
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Medium
CVE-2026-71537
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
High
CVE-2026-85058
io.moquette:moquette-broker has a Missing Authorization issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.