High
CVE-2026-13369
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-9188
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
Medium
CVE-2026-12472
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
High
CVE-2026-5821
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
High
CVE-2026-14249
Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
Medium
CVE-2026-57348
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery
Critical
CVE-2026-5524
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
High
CVE-2026-9834
WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
Medium
CVE-2026-10096
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Critical
CVE-2026-6070
WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
Medium
CVE-2026-12127
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
Medium
CVE-2026-11380
JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
High
CVE-2026-13693
Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read
High
CVE-2026-27436
Five Star Business Profile and Schema <= 2.3.19 - Authenticated (Editor+) Arbitrary Code Execution
Medium
CVE-2026-57681
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-12240
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
Medium
CVE-2026-11367
PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
High
CVE-2026-13147
Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-57346
Embed Privacy <= 1.12.3 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-57320
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42382
Audrey <= 1.5 - Unauthenticated Local File Inclusion
High
CVE-2026-27412
Pearl - Corporate Business <= 3.4.10 - Unauthenticated Local File Inclusion
High
CVE-2026-57623
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution
High
CVE-2026-57331
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 - Authenticated (Performer+) Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.