High
CVE-2026-42672
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-42673
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Exposure
Medium
CVE-2026-6206
MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
Medium
CVE-2026-6225
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
Medium
CVE-2026-5486
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
High
CVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
High
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Medium
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Medium
CVE-2025-9987
Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
High
CVE-2026-1250
Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
Medium
CVE-2026-4608
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
High
CVE-2026-2993
AI Chatbot & Workflow Automation by AIWU <= 1.5.6 - Unauthenticated SQL Injection in getListForTbl()
Medium
CVE-2026-7626
Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
High
CVE-2026-4935
OttoKit: All-in-One Automation Platform < 1.1.23 - Unauthenticated SQL Injection
High
CVE-2021-47941
WordPress Survey & Pol <= 1.5.7.3 - Unauthenticated SQL Injection
Medium
CVE-2026-42667
Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure
Medium
CVE-2026-45218
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42665
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection
Medium
CVE-2026-8198
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API
Medium
CVE-2026-25468
Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure
High
CVE-2026-40798
wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection
High
CVE-2026-42773
eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
Medium
CVE-2025-68060
Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection
High
CVE-2026-4348
BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.