Medium
CVE-2026-13331
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-57652
JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-57632
Email Marketing for WooCommerce by Omnisend <= 1.19.0 - Missing Authorization
Medium
CVE-2026-57663
Recipe Cards For Your Food Blog from Zip Recipes <= 8.2.7 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-57662
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-57317
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57324
GIFT4U – Gift Cards All in One for Woo <= 1.0.10 - Missing Authorization
High
CVE-2026-57315
Blocksy Companion Pro <= 2.1.45 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-10525
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-64637
Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-57667
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection
Medium
CVE-2026-1869
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
Medium
CVE-2026-13226
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
Medium
CVE-2026-56060
Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 - Unauthenticated Information Exposure
Medium
CVE-2026-57312
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-57619
Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2026-56064
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-56062
Quotes llama <= 3.1.5 - Unauthenticated SQL Injection
Medium
CVE-2026-10599
Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass
High
CVE-2026-57658
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-57622
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 - Missing Authorization
Medium
CVE-2026-56066
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.4 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-12978
FunnelKit <= 3.15.0.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-9710
Cornerstone < 7.8.8 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.