Medium
CVE-2026-77765
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-84027
Directorist 8.9.1 - 8.9.4 - Missing Authorization
Medium
CVE-2026-91073
Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-90950
Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass
Medium
CVE-2026-84026
Directorist 8.1 - 8.9.4 - Unauthenticated Information Exposure
Medium
CVE-2026-84098
Directorist 3.1.0 - 8.9.4 - Missing Authorization
Medium
CVE-2026-87070
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
Medium
CVE-2026-84150
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-9858
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Medium
CVE-2026-9289
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
Medium
CVE-2026-9613
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
High
CVE-2026-1255
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
Medium
CVE-2026-6295
WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Medium
CVE-2026-11899
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
Medium
CVE-2026-9832
Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
Medium
CVE-2026-2422
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
Medium
CVE-2026-15946
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Medium
CVE-2026-15947
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Medium
CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Medium
CVE-2026-7527
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
High
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Medium
CVE-2026-87917
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Medium
CVE-2026-9232
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Medium
CVE-2026-9855
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.