Medium
CVE-2026-13729
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-61975
JetReviews <= 3.0.1 - Unauthenticated Information Exposure
Medium
CVE-2026-13604
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
Medium
CVE-2026-14822
Event Tickets and Registration < 5.29.0.1 - Missing Authorization
High
CVE-2026-16635
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Critical
CVE-2026-15964
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
Medium
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Medium
CVE-2026-18344
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
Medium
CVE-2025-14073
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
Medium
CVE-2026-15644
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-17571
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
Medium
CVE-2026-17555
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Medium
CVE-2026-10782
RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action
Medium
CVE-2026-15601
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Medium
CVE-2026-15649
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-18059
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
Medium
CVE-2026-17605
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
High
CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
High
CVE-2026-15052
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
High
CVE-2026-16144
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Medium
CVE-2026-18062
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
Medium
CVE-2026-18435
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
Medium
CVE-2026-15662
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
Medium
CVE-2026-15951
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.