Critical
CVE-2026-16142
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-12128
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Medium
CVE-2026-8840
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
High
CVE-2026-15312
Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
Critical
CVE-2026-15341
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
Critical
CVE-2026-15303
6Storage Rentals <= 2.28.0 - Unauthenticated Account Takeover via 'email' Parameter
Critical
CVE-2026-14484
RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
High
CVE-2026-32464
Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-73352
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization
Medium
CVE-2026-18391
WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-73997
Kadence Starter Templates — Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service
High
CVE-2026-32465
Essential Real Estate <= 5.3.3 - Authenticated (Customer+) PHP Object Injection
Medium
CVE-2026-73383
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.47 - Authenticated (Shop Manager+) Arbitrary File Downloaf
High
CVE-2026-32470
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
High
CVE-2026-73181
Extra Product Options & Add-Ons for WooCommerce < 7.6 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-73348
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
Medium
CVE-2026-73995
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
Medium
CVE-2026-16650
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass
High
CVE-2026-28570
Vavo Core <= 2.3.0 - Unauthenticated Local File Inclusion
Critical
CVE-2026-12949
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
Medium
CVE-2026-28182
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-28187
Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-73403
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
High
CVE-2026-61980
OMGF Pro <= 5.2.7 - Unauthenticated Arbitrary File Download
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.