Medium
CVE-2026-4945
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-18056
HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
Critical
CVE-2026-75816
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
Medium
b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-15247
Search Atlas SEO – OTTO AI SEO Automation for WordPress < 2.6.24 - Missing Authorization
High
CVE-2026-83625
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
Medium
CVE-2026-14975
WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
Medium
CVE-2026-3853
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Medium
CVE-2026-4361
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
High
CVE-2026-18406
SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
High
CVE-2026-19887
Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
High
CVE-2026-15984
QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
High
CVE-2026-19769
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Critical
CVE-2026-13447
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
Medium
CVE-2026-83628
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Critical
CVE-2026-83627
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
Medium
CVE-2026-80437
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2025-9049
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
High
CVE-2026-81543
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-75018
Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
Medium
CVE-2026-85038
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.40 - Unauthenticated Unauthorized B2B Group Assignment
Medium
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Critical
CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.