Medium
CVE-2026-66453
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-66450
Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion
Critical
CVE-2026-19089
Product Input Fields for WooCommerce <= 2.0.1 - Unauthenticated Arbitrary File Upload
High
CVE-2026-66449
Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-61985
Car Rental Manager – Online Vehicle Booking System <= 1.3.7 - Missing Authorization
Medium
CVE-2026-18200
FoodBoxBooker <= 1.0.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update
Medium
CVE-2026-19074
Advanced Classifieds & Directory Pro <= 3.4.2 - Unauthenticated Non-Public Listing Custom Field Disclosure
Medium
CVE-2026-66441
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.10 - Missing Authorization
Medium
CVE-2026-66430
Visitor Traffic Real Time Statistics pro <= 11.10 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-15047
s2Member <= 260804 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19794
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66429
Visitor Traffic Real Time Statistics pro <= 11.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14211
Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure
Medium
CVE-2026-66431
Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization
Medium
CVE-2026-66454
WP Social Avatar <= 1.5 - Missing Authorization
Medium
CVE-2026-11907
Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
Critical
CVE-2026-14364
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
Critical
CVE-2026-14365
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
Medium
CVE-2026-12801
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
Medium
CVE-2026-18501
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
Medium
CVE-2026-0673
Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
High
CVE-2026-65571
69 Clothing | Brand Store & Fashion Boutique WordPress Theme <= 1.2.11.1 - Unauthenticated PHP Object Injection
Critical
CVE-2026-12872
Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-17020
Salon Booking System – Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.