High
CVE-2026-48871
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-8382
Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
High
CVE-2026-42754
Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42760
Backup and Staging by WP Time Capsule <= 1.22.25 - Missing Authorization
High
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-42755
TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
Critical
CVE-2026-42758
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
High
CVE-2026-42759
Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-9757
GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
High
CVE-2026-7459
Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
High
CVE-2026-7465
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
High
CVE-2026-42748
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2026-42753
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 - Missing Authorization
Low
CVE-2026-42749
Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization
Medium
CVE-2026-42750
WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42752
Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass
Medium
CVE-2026-42751
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-12714
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
Medium
CVE-2026-9189
Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Medium
CVE-2026-10039
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
High
CVE-2026-6075
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Medium
CVE-2026-9243
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
High
CVE-2025-11262
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-3655
OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.