Medium
CVE-2026-32386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-39667
Korea SNS <= 1.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-14294
Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
Medium
CVE-2026-32382
Digital Download <= 1.1.4 - Missing Authorization
Medium
CVE-2025-13732
s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-32372
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
Medium
CVE-2026-39664
Leadrebel <= 1.0.2 - Missing Authorization
Medium
CVE-2026-39668
Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization
High
CVE-2026-32384
WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-2426
WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
Medium
CVE-2025-14444
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
Medium
CVE-2026-1942
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
Medium
CVE-2025-11185
Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-2126
User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
Medium
CVE-2025-13727
Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values
High
CVE-2026-2495
WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter
Medium
CVE-2026-2127
SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
Medium
CVE-2026-1649
Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter
Medium
CVE-2026-1941
WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-1656
Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification
Medium
CVE-2026-1655
EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
Low
CVE-2026-2419
WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter
Medium
CVE-2026-2112
Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion
Medium
CVE-2026-1938
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.