Medium
CVE-2026-4109
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-2582
Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-3017
Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-4479
WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-4059
ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
Medium
CVE-2026-1607
Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2026-6227
BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
High
CVE-2026-4388
Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
Critical
CVE-2026-4365
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
High
CVE-2026-4352
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
Medium
CVE-2026-6203
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
High
CVE-2026-39531
WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection
High
CVE-2026-39530
SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection
Medium
CVE-2026-39513
Easy Appointments <= 3.12.21 - Missing Authorization
High
CVE-2026-39468
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-39463
ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39491
Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-39512
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
High
CVE-2026-39474
Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39511
WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection
Medium
CVE-2026-5335
Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure
High
CVE-2026-39494
Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-39525
Booking Activities <= 1.16.48.1 - Missing Authorization
Medium
CVE-2026-5337
Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.