Medium
CVE-2026-14184
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-14183
Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
Medium
CVE-2026-14185
WPBot AI ChatBot <= 8.1.0 - Missing Authorization
Critical
CVE-2026-12073
ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
Medium
CVE-2026-12724
Kirki <= 6.0.11 - Unauthenticated HTML Injection
Medium
CVE-2026-13432
ThumbPress <= 6.2.1 - Missing Authorization
High
CVE-2026-57677
Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-10755
All in One SEO < 4.9.9 - Missing Authorization
High
CVE-2026-57320
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42382
Audrey <= 1.5 - Unauthenticated Local File Inclusion
High
CVE-2026-57679
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.5 - Unauthenticated SQL Injection
High
CVE-2026-27412
Pearl - Corporate Business <= 3.4.10 - Unauthenticated Local File Inclusion
Medium
CVE-2026-57327
MainWP Dashboard: Self-hosted WordPress Management for Agencies <= 6.1.1 - Missing Authorization
High
CVE-2026-57331
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 - Authenticated (Performer+) Arbitrary File Deletion
High
CVE-2025-69133
Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2025-69134
OpenAI Chatbot for WordPress – Helper <= 1.1.4 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2026-13156
MailerSend - Official SMTP Integration <= 1.0.7 - Cross-Site Request Forgery
High
CVE-2026-57337
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages <= 1.5.3.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57621
Booktics <= 1.0.21 - Unauthenticated PHP Object Injection
High
CVE-2026-57344
Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57334
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization
High
CVE-2025-58902
Lighthouse <= 1.2.12 - Unauthenticated Local File Inclusion
High
CVE-2026-8095
Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-9242
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.