Critical
CVE-2026-9690
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-49110
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization
Medium
CVE-2026-9702
InPost PL <= 1.9.0 - Missing Authorization to Unauthenticated WooCommerce Order Parcel-Locker Hijacking
High
CVE-2026-49765
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49775
Welcart e-Commerce <= 2.11.28 - Missing Authorization
High
CVE-2026-49781
OttoKit: All-in-One Automation Platform <= 1.1.27 - Unauthenticated PHP Object Injection
High
CVE-2026-49109
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49771
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-49767
wpForo Forum <= 3.1.0 - Missing Authorization
High
CVE-2026-49763
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-49768
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49764
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization
High
CVE-2026-49106
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-49108
Moderno < 1.43 - Unauthenticated PHP Object Injection
Medium
CVE-2025-10268
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
High
CVE-2026-49778
WPFunnels Pro <= 2.9.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-10737
SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
Medium
CVE-2026-8653
MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
Medium
CVE-2026-49057
JobSearch WP Job Board <= 3.2.7 - Missing Authorization
Medium
CVE-2026-48969
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization
High
CVE-2026-49055
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42775
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48970
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 - Missing Authorization
High
CVE-2026-49780
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.