Medium
CVE-2026-11987
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-11783
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Medium
CVE-2026-12399
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
Medium
CVE-2026-11597
Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-12471
Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
Medium
CVE-2026-13295
Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
Medium
CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
Critical
CVE-2026-12415
Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
Medium
CVE-2026-13333
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
Medium
CVE-2026-13335
CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
Medium
CVE-2026-11356
Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings
Medium
CVE-2026-13422
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
Medium
CVE-2026-57640
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization
High
CVE-2026-11961
User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-63041
Forget About Shortcode Buttons <= 2.1.3 - Missing Authorization
Medium
CVE-2026-57631
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-57644
Restaurant Menu and Food Ordering <= 2.4.10 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-57637
Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery
Medium
CVE-2026-57642
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-57646
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2025-68052
Eagle Booking <= 1.3.4.3 - Cross-Site Request Forgery
Medium
CVE-2026-57659
Paid Memberships Pro - Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery
Medium
CVE-2026-57634
PPWP – Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-57648
Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.