High
CVE-2026-27400
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-52702
SEO Redirection Plugin – 301 Redirect Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-27429
Nifty <= 1.4.1 - Unauthenticated PHP Object Injection
Critical
CVE-2025-69129
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload
High
CVE-2026-52706
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
Medium
CVE-2026-52703
FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 - Unauthenticated Path Traversal
Medium
CVE-2026-8293
Really Simple Security <= 9.5.10.0 - Two Factor Authentication Bypass
High
CVE-2026-52707
Kastell <= 2.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-9125
The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
High
CVE-2026-6379
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection
Medium
CVE-2026-9067
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Critical
CVE-2026-11976
MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
High
CVE-2026-3326
XStore < 9.7.3 - Unauthenticated SQL Injection
High
CVE-2026-5776
Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-1631
Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization
Medium
CVE-2026-11781
Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-7385
Decent Comments < 3.0.2 - Unauthenticated Information Exopsure
Medium
CVE-2026-6268
EventPress < 22.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-8981
Custom Block Builder – Lazy Blocks < 4.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-8071
CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15609
Fortis for WooCommerce < 1.3.1 - Unauthenticated Information Exposure
Medium
CVE-2026-11965
User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-9060
Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-6381
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.