Medium
CVE-2026-40726
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-39593
HAPPY – Helpdesk Support Ticket System <= 1.0.10 - Missing Authorization
High
CVE-2026-39598
Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload
High
CVE-2026-40720
Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39594
Ultra Addons for WPForms <= 1.0.11 - Missing Authorization
Medium
CVE-2026-40741
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Missing Authorization
High
CVE-2026-40736
Laurits <= 1.5.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40739
LuxeDrive - Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40308
My Calendar < 3.7.7 - Unauthenticated Denial of Service
Medium
CVE-2026-3369
Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title
Low
CVE-2026-3155
OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'
High
CVE-2026-3489
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'
Medium
CVE-2026-0718
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
High
CVE-2025-14868
Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion
High
CVE-2026-3876
Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode
Medium
CVE-2026-3875
BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-2840
Email Encoder – Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode
Medium
CVE-2026-1572
Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings
High
CVE-2026-1620
Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter
Medium
CVE-2025-13364
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
Medium
CVE-2026-3995
OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
Medium
CVE-2026-3355
Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'
Medium
CVE-2026-3581
Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update
Medium
CVE-2026-3551
Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.