Critical
CVE-2026-15932
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-61947
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-61945
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-14862
Support Genix Lite <= 1.4.47 - Missing Authorization
Medium
CVE-2026-61946
Easy Appointments <= 3.12.27 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-57428
Sprout Clients – CRM and Lead Management <= 3.2.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57427
Download Monitor - WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-61950
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection
Medium
CVE-2026-61943
Premium Packages – Sell Digital Products Securely <= 6.2.0 - Missing Authorization
Medium
CVE-2026-12697
wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
High
CVE-2026-13609
Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57425
Autopay dla WooCommerce <= 2.2.27 - Missing Authorization
High
CVE-2026-61944
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-13741
Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter
High
CVE-2026-15005
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
High
CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
Medium
CVE-2026-15727
WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
Medium
CVE-2026-15324
SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
Medium
CVE-2026-15021
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
Medium
CVE-2026-15106
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
Medium
CVE-2026-15610
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
Medium
CVE-2026-13754
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
High
CVE-2026-15008
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
Medium
CVE-2026-15651
WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.