Medium
CVE-2026-28168
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-10308
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2026-13168
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-28161
Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-18807
ECS <= 4.3.7 - Missing Authorization
High
CVE-2026-28158
Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13612
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure
Medium
CVE-2026-28159
Service Finder Booking <= 6.2 - Missing Authorization
Medium
CVE-2026-28188
Hydra Booking <= 1.2.2 - Missing Authorization
Medium
CVE-2026-28174
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
Medium
CVE-2026-3639
PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
Medium
CVE-2026-3835
Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
Medium
CVE-2026-73340
Featured Image from URL (FIFU) <= 5.3.3 - Authenticated (Contributor+) Stored Cross-site Scripting
Medium
CVE-2026-61978
Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 - Missing Authorization
Medium
CVE-2026-73344
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-28002
Booktics 1.0.22 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-73353
Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization
High
CVE-2026-28142
Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
High
CVE-2026-28004
Business Directory <= 6.4.25 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27380
Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-15205
Paymob for WooCommerce <= 4.1.8 - Unauthenticated SQL Injection
High
CVE-2026-18039
Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-73357
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.