Medium
CVE-2026-28181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
High
CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
High
CVE-2026-28142
Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
Medium
CVE-2026-27380
Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-18039
Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-73357
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting
Medium
CVE-2026-73349
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
Medium
CVE-2026-73346
Mailchimp for WooCommerce < 6.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-28149
Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-18961
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
High
CVE-2026-15606
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
High
CVE-2026-13457
InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
High
CVE-2026-15426
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
High
CVE-2026-66653
Barista <= 2.5.1 - Unauthenticated Local File Inclusion
High
CVE-2026-66656
Foton Core <= 1.1.1 - Unauthenticated Local File Inclusion
High
CVE-2026-27536
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-61969
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.6.0 - Unauthenticated SQL Injection
High
CVE-2026-66657
Biagiotti Core <= 2.1.1 - Unauthenticated Local File Inclusion
Critical
CVE-2026-14182
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation
Medium
CVE-2026-27999
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
Medium
CVE-2026-66469
Arvow AI SEO Writer <= 1.5.3 - Missing Authorization
Medium
CVE-2026-16538
TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation
Medium
CVE-2026-16737
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.