Critical
CVE-2026-14557
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-15663
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
Medium
CVE-2026-12654
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
Medium
CVE-2026-15653
Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
Medium
CVE-2026-15100
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Medium
CVE-2026-11354
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Medium
CVE-2026-6454
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
Medium
CVE-2026-15420
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
Critical
CVE-2026-15981
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
Medium
CVE-2026-16274
Classified Listing <= 5.4.3 - Missing Authorization
Medium
CVE-2026-59537
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-16534
Import and export users and customers <= 2.4.1 - Authenticated (Admin+) Privilege Escalation
High
CVE-2026-59538
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection
Medium
CVE-2026-59539
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 - Insecure Direct Object Reference
High
CVE-2026-65493
Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-65526
Visualizer – Tables & Charts Manager with Built-in AI Generator <= 4.0.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-16276
Classified Listing <= 5.4.3 - Missing Authorization
Medium
CVE-2026-15348
Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
Critical
CVE-2026-15015
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
Medium
CVE-2026-13009
AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
Medium
CVE-2026-15786
WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
Medium
CVE-2026-16078
WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
Medium
CVE-2026-15827
GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
High
CVE-2026-7232
FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.