Medium
CVE-2026-49066
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2026-49063
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation
High
CVE-2026-49080
wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection
High
CVE-2026-49075
JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-49071
WooCommerce Dropshipping Premium <= 5.2.4 - Missing Authorization
High
CVE-2026-49772
The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection
Medium
CVE-2026-49064
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 - Unauthenticated Information Exposure
High
CVE-2026-10083
APCu Manager <= 4.4.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-49067
Advanced 301 and 302 Redirect <= 1.6.9 - Unauthenticated SQL Injection
Medium
CVE-2026-49062
Faust.js <= 1.8.7 - Missing Authorization
Medium
CVE-2026-52692
Affiliates Manager <= 2.9.50 - Unauthenticated Information Exposure
High
CVE-2026-49084
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
Medium
CVE-2026-49070
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 - Missing Authorization
Medium
CVE-2026-49065
Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization
Medium
CVE-2026-49072
WooCommerce Anti-Fraud <= 7.2.6 - Missing Authorization
High
CVE-2026-49111
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-49073
Booking (Reservation & Appointment) <= 3.0.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-3011
Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
Medium
CVE-2021-47983
Accept Stripe Payments <= 2.0.39 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2024-58348
Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution
Medium
CVE-2026-10820
ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
High
CVE-2026-9851
Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
Medium
CVE-2026-9829
Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
Medium
CVE-2026-9594
WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.