Medium
CVE-2026-90981
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 378
Reset filters
Medium
CVE-2026-15650
RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
Medium
CVE-2026-15758
3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
Critical
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
High
CVE-2026-81754
Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-6642
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
High
CVE-2026-14989
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
Medium
CVE-2026-19945
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
Medium
CVE-2026-19944
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
Medium
CVE-2026-77186
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
High
CVE-2026-13359
Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
Medium
CVE-2026-80440
Hustle – Email Marketing, Lead Generation, Optins, Popups < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-83625
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
High
CVE-2026-18406
SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
High
CVE-2026-77830
Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
Medium
CVE-2026-8623
Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
Medium
eda9ae01-cdc4-43e0-8a4c-1ec365939fa8
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Critical
CVE-2026-19859
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-75528
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Medium
CVE-2026-15101
WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
High
CVE-2026-19914
Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
Medium
CVE-2026-16786
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Medium
CVE-2026-75964
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
Medium
CVE-2026-75980
BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.