High
CVE-2026-66657
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2026-61962
WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution
Critical
CVE-2026-14182
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation
Critical
CVE-2026-61967
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation
Critical
CVE-2026-27543
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation
High
CVE-2026-27539
Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27535
Solace Extra <= 1.6.0 - Missing Authorization
Medium
CVE-2026-66660
Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 - Missing Authorization
Medium
CVE-2026-27538
WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
Medium
CVE-2026-66655
MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting
High
CVE-2026-66659
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection
Medium
CVE-2026-66654
Vehica Core <= 1.0.104 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-27999
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
Medium
CVE-2026-14290
Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-11578
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
Medium
CVE-2026-16974
Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
Medium
CVE-2026-18230
Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-19217
Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-14858
Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure
Critical
CVE-2026-15039
Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-66464
Website Internal Link Optimiser <= 5.2.7 - Missing Authorization
High
CVE-2026-66698
SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66471
Accordions – Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-66687
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.