Medium
CVE-2026-11777
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-10029
Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints
Medium
CVE-2026-9199
Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter
High
CVE-2026-12407
E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
Medium
CVE-2026-10023
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Medium
CVE-2026-54828
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
High
CVE-2026-54819
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 - Unauthenticated SQL Injection
High
CVE-2026-54809
GIFT4U – Gift Cards All in One for Woo <= 1.0.10 - Unauthenticated SQL Injection
High
CVE-2026-54825
wpDataTables (Premium) <= 7.4 - Unauthenticated SQL Injection
Medium
CVE-2026-54826
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-54831
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 - Unauthenticated SQL Injection
High
CVE-2026-54829
WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection
Medium
CVE-2026-54810
Nexi XPay <= 8.3.1 - Missing Authorization
High
CVE-2026-54823
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-54818
SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-11784
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Medium
CVE-2026-54832
Gutenverse Companion <= 2.5.0 - Missing Authorization
Medium
CVE-2026-54813
SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-12120
FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
High
CVE-2026-54815
Cargo Shipping Location for WooCommerce <= 5.6 - Unauthenticated SQL Injection
High
CVE-2026-54816
Advanced Ads – Ad Manager & AdSense <= 2.0.21 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-54817
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization
Medium
CVE-2026-54821
Visual Link Preview <= 2.3.1 - Authenticated (Subscriber+) Sensitive Information Exposure
High
CVE-2026-54812
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.