Medium
CVE-2026-13450
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-12406
User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
Critical
CVE-2026-14245
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
Medium
CVE-2026-13253
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
Medium
CVE-2026-14343
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
High
CVE-2026-15000
Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values
Medium
CVE-2026-12170
AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
Medium
CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
Medium
CVE-2026-7558
Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
Medium
CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
High
CVE-2026-57410
MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-5523
Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form
Medium
CVE-2026-57413
Instant AI Image Generator – Create & Import Images <= 2.1.4 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-57414
AI ChatBot for eCommerce – WoowBot <= 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-57713
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection
Critical
CVE-2026-57697
ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset
High
CVE-2026-57416
SiteGround Email Marketing <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57395
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
Medium
CVE-2026-57406
FundEngine – Donation and Crowdfunding Platform <= 1.7.6 - Missing Authorization
High
CVE-2026-57815
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download
High
CVE-2026-13441
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
High
CVE-2026-11974
Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-57392
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
Medium
CVE-2026-6740
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.