High
CVE-2026-12721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-13393
ElementsKit Lite <= 3.10.0 - Authenticated (Subsite administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-7640
WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Medium
CVE-2026-11802
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
Medium
CVE-2026-11390
News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
Medium
CVE-2026-12536
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Medium
CVE-2026-12385
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Medium
CVE-2026-14847
Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
Medium
CVE-2026-14831
Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass
High
CVE-2026-4110
Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14931
JS Help Desk <= 3.1.3 - Authenticated (Contributor+) User Email Disclosure
Medium
CVE-2026-14929
JS Help Desk <= 3.1.3 - Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification
Medium
CVE-2026-14921
Ultimate Addons for WPBakery Page Builder <= 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-14554
Check & Log Email <= 2.0.14 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-14319
GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure
Medium
CVE-2026-15048
GeekyBot <= 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-14936
Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass
Medium
CVE-2026-15209
JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Cross-User Support Ticket Disclosure
Medium
CVE-2026-8155
BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
High
CVE-2026-14333
Demi - One Click Demo Import, Backup & Site Migration <= 0.0.6 - Unauthenticated Sensitive Data Exposure
Medium
CVE-2026-12901
GetPaid <= 2.8.54 - Unauthenticated Payment Bypass
Medium
CVE-2026-12501
Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-14843
Events Made Easy <= 3.1.3 - Insecure Direct Object Reference to Unauthenticated Person Data Modification
Medium
CVE-2026-14849
Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.