Medium
CVE-2026-40796
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-42655
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.19 - Missing Authorization
Medium
CVE-2026-40776
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
Medium
CVE-2026-42640
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization
High
CVE-2026-42647
JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.7.7 - Unauthenticated SQL Injection
High
CVE-2026-42650
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42660
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-42656
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42629
PowerPack Pro for Elementor < v2.13.0 - Missing Authorization
Medium
CVE-2026-42657
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization
High
CVE-2026-42639
GD Rating System <= 3.6.2 - Unauthenticated SQL Injection
Medium
CVE-2026-42651
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.9 - Missing Authorization
Medium
CVE-2026-42654
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization
High
CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
High
CVE-2026-42649
Favicon Rotator <= 1.2.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42659
AFI – The Easiest Integration Plugin <= 1.126.12 - Missing Authorization
Medium
CVE-2026-4019
Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint
Medium
CVE-2026-2902
WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment
High
CVE-2026-5306
Check & Log Email – Easy Email Testing & Mail logging < 2.0.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40795
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Missing Authorization
Medium
CVE-2026-4911
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
Medium
CVE-2026-4805
Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block
Medium
CVE-2026-6551
Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
Medium
CVE-2026-6809
Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.