Medium
CVE-2026-84066
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
Critical
CVE-2026-15354
ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Critical
CVE-2026-11613
Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Medium
CVE-2026-84755
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Missing Authorization
Medium
CVE-2026-84779
Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 - Missing Authorization
Medium
CVE-2026-77764
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 7.9.9.6 - Missing Authorization
Medium
CVE-2026-77784
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) SEO Object Updates
Medium
CVE-2026-85306
MountDev AI MCP Connector for WordPress <= 1.6.5 - Missing Authorization
High
72f4776f-5450-4022-92dd-47ddaa91a5cd
Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-85308
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-84753
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-85305
SEOPress – AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-19862
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection
Medium
CVE-2026-84936
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
High
CVE-2026-84834
JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Medium
CVE-2026-84044
Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion
High
CVE-2026-84775
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service
High
CVE-2026-84776
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall <= 6.69 - Unauthenticated Denial of Service
Medium
CVE-2026-77785
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure
Medium
CVE-2026-84043
ePayco plugin for WooCommerce < 8.4.7 - Unauthenticated Unauthorized Order Status Manipulation
High
CVE-2026-84778
Migrate Guru – Site Migration & Cloning <= 6.65 - Unauthenticated Denial of Service
Medium
CVE-2026-77783
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.