Medium
CVE-2026-42671
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-45436
WPBakery Page Builder <= 8.7.2 - Missing Authorization
High
CVE-2026-23970
Redirection for Contact Form 7 <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-7525
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
High
CVE-2026-4030
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
High
CVE-2026-4031
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception
Medium
CVE-2026-5243
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
High
CVE-2026-42668
Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
High
CVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Medium
CVE-2026-4782
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Medium
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
High
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Medium
CVE-2025-14033
ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-6962
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Medium
CVE-2025-9988
Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Medium
CVE-2025-9987
Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
Medium
CVE-2025-9989
Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-7051
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Medium
CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
High
CVE-2026-1250
Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
Medium
CVE-2025-15463
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-5371
MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset
High
CVE-2026-6177
Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.