Medium
CVE-2026-24573
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2026-45444
Gift Cards For WooCommerce Pro <= 4.2.6 - Unauthenticated Arbitrary File Upload
High
CVE-2026-42683
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24637
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42728
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48093
Code Embed <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-49466
Draft List < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-6728
Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
High
CVE-2026-5200
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
Medium
CVE-2026-6405
Anomify AI <= 0.3.6 - Cross-Site Request Forgery
Medium
CVE-2026-2955
AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header
Medium
CVE-2026-6566
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
High
CVE-2026-7522
Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
High
CVE-2026-7613
Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import
Medium
CVE-2026-5075
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
High
CVE-2026-9010
Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
Critical
CVE-2026-7637
Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
Medium
CVE-2025-15369
Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
Critical
CVE-2026-7284
Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
High
CVE-2026-3985
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter
Medium
CVE-2026-8610
TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
Medium
CVE-2026-7472
Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-7467
Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
Medium
CVE-2026-6549
Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.