Medium
CVE-2026-96531
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-96525
MCP Server for WordPress <= 1.8.1 - Missing Authorization
High
CVE-2026-96830
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94123
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-96348
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization
Medium
CVE-2026-97247
Blocksy Companion <= 2.1.55 - Missing Authorization
High
CVE-2026-94681
WP Store Locator < 3.0.0 - Unauthenticated Denial of Service
Medium
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-96838
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 - Cross-Site Request Forgery
Medium
CVE-2026-3253
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
Medium
CVE-2026-4806
Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset
Medium
CVE-2026-16302
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2026-18335
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Medium
CVE-2026-15731
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Critical
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
High
CVE-2026-85682
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
High
CVE-2026-77193
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
Medium
CVE-2026-96826
W4 Post List <= 3.0.6 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-93513
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-95592
Team – Team Members Showcase Plugin <= 6.0.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-94461
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-93618
JetTricks <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-93623
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-94487
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.