Wysoka
CVE-2026-97341
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 406
Średnia
CVE-2025-12828
Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
Wysoka
CVE-2026-87091
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
Średnia
CVE-2026-11399
Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
Wysoka
CVE-2026-96650
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
Średnia
CVE-2026-100149
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
Wysoka
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
Wysoka
CVE-2026-96575
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
Wysoka
CVE-2026-101928
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
Wysoka
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
Średnia
CVE-2026-103909
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
Średnia
CVE-2026-91108
Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
Średnia
CVE-2026-100152
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
Średnia
1f0a1439-d10c-4dfc-9a40-7319debe3c51
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Wysoka
CVE-2026-92977
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
Średnia
CVE-2026-39717
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization
Średnia
CVE-2026-104402
Mindio Magic MCP <= 0.5.6 - Authenticated (Subscriber+) Information Exposure
Wysoka
CVE-2026-97644
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
Średnia
CVE-2026-39599
WDS MCP Content Manager <= 3.10.4 - Missing Authorization
Średnia
CVE-2026-39444
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference
Średnia
CVE-2026-39439
WebSamurai <= 1.0.7 - Missing Authorization
Średnia
CVE-2026-32585
Airano MCP Bridge <= 2.11.0 - Missing Authorization
Średnia
CVE-2026-32584
Smart One Click Setup – Complete Demo Import & Export <= 1.4.3 - Unauthenticated Information Exposure
Średnia
CVE-2026-92538
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.