High
CVE-2026-39596
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
High
CVE-2026-39493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection
High
CVE-2026-4079
SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
High
CVE-2026-39519
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 - Unauthenticated SQL Injection
High
CVE-2026-39492
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection
Medium
CVE-2026-39480
BackupBliss – Backup & Migration with Free Cloud Storage <= 2.1.1 - Unauthenticated Information Exposure
High
CVE-2026-39502
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection
Medium
CVE-2026-1865
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
Critical
CVE-2026-3535
DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter
Medium
CVE-2026-3781
Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
Medium
CVE-2026-3594
Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
Medium
CVE-2026-3513
TableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Medium
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
High
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2026-34888
Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
Medium
CVE-2026-34891
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-34885
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-1233
Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
High
CVE-2026-2696
Export All URLs < 5.1 - Unauthenticated Information Exposure
Medium
CVE-2026-5451
Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode
Medium
CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Medium
CVE-2026-4668
Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
Medium
CVE-2026-45214
Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.