Critical
CVE-2026-89055
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-94376
Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Medium
CVE-2026-93899
Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Medium
CVE-2026-92799
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Medium
CVE-2026-92829
Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
High
CVE-2026-96039
BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
Critical
CVE-2026-14281
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
High
CVE-2026-97246
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-84069
WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion
High
CVE-2026-94121
10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-94076
GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-96829
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-94678
Go Live Update Urls <= 7.0.8 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-97066
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-94677
Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-96524
MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery
Medium
CVE-2026-96833
Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-96834
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-96825
All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass
Medium
CVE-2026-97196
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation
Medium
CVE-2026-96526
MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-96525
MCP Server for WordPress <= 1.8.1 - Missing Authorization
High
CVE-2026-96830
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94681
WP Store Locator < 3.0.0 - Unauthenticated Denial of Service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.