High
CVE-2026-6495
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-10077
YOOtheme Pro <= 5.0.34 - Authenticated (Author+) Stored Cross-Site Scripting
Critical
CVE-2026-10795
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
Medium
CVE-2026-2827
Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
Medium
CVE-2026-52695
ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure
Medium
CVE-2026-10750
Royal MCP <= 1.4.25 - Missing Authorization to Unauthenticated MCP Tool Use
Medium
CVE-2026-52699
VikRentCar Car Rental Management System <= 1.4.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-52700
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-52696
JetBlog <= 2.4.8 - Unauthenticated Information Exposure
Medium
CVE-2026-52694
Digital Signature Add-on for WooCommerce <= 2.0 - Unauthenticated Information Exposure
Medium
CVE-2026-52698
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-52697
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-11568
Product Configurator for WooCommerce <= 1.7.2 - Unauthenticated Private/Draft Product Data Disclosure
Medium
CVE-2026-11883
WebAuthn Provider for Two Factor <= 2.5.5 - Two-Factor Authentication Bypass
High
CVE-2026-11570
User Submitted Posts <= 20260607 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-60218
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-49043
WP Migrate Lite – Migration Made Easy <= 2.7.8 - Cross-Site Request Forgery
High
CVE-2026-11794
Advanced Form Integration <= 2.1.0 - Unauthenticated Privilege Escalation
Critical
CVE-2025-6254
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation
High
CVE-2026-3018
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
Medium
CVE-2026-8613
aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
Medium
CVE-2026-8853
MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
Medium
CVE-2026-9019
Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters
Medium
CVE-2016-20063
Simple Personal Message <= 1.0.3 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.