Medium
CVE-2026-100179
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-95687
WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
High
CVE-2026-19807
ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
Critical
CVE-2026-75957
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Medium
CVE-2026-91109
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
Medium
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Medium
CVE-2026-102392
Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-100512
Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-97291
Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-102377
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-97256
Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-6171
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Medium
CVE-2026-93624
Music Player for WooCommerce <= 1.9.1 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-95531
WPBot – ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-94122
Responsive Slider Gallery – Responsive Image Photo Slider <= 1.5.5 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-92412
Five Star Restaurant Reviews <= 2.3.13 - Reflected Cross-Site Scripting
High
CVE-2026-87741
ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
High
CVE-2026-96344
eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection
High
CVE-2026-93651
Minimum and Maximum Quantity for WooCommerce <= 2.1.2 - Authenticated (Author+) PHP Object Injection
High
CVE-2026-94683
DesignSetGo <= 2.8.0 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-96832
Content Egg – Affiliate Product Importer & Price Comparison <= 6.3.1 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-96831
Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-91051
EWWW Image Optimizer 8.6.0 - 8.7.7 - Authenticated (Author+) PHP Object Injection
Medium
CVE-2026-93771
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 3.5.2 - Authenticated (Shop Manager+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.