Medium
CVE-2026-92435
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Critical
CVE-2026-84750
Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-92099
WPGraphQL Smart Cache <= 2.3.1 - Missing Authorization
Medium
64453a11-e0dd-40f8-99c3-f05ef640b42b
WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller
High
CVE-2026-88926
VikRentItems Flexible Rental Management System <= 1.2.3 - Unauthenticated SQL Injection
Medium
CVE-2026-19860
JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2026-92403
Secure Custom Fields <= 6.9.3 - Missing Authorization
High
CVE-2026-85680
Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
Medium
3d59700b-3540-464c-bd27-23bb71f9b082
WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
Medium
CVE-2026-76790
Estatik <= 4.3.4 - Reflected Cross-Site Scripting
Medium
28747e2e-9012-470c-a891-0fe97fd1ddba
WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
High
CVE-2026-93485
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
Medium
CVE-2026-87831
Checkout Field Manager <= 7.9.6 - Missing Authorization
Medium
CVE-2026-92404
MgoSync 2.1.5 - 2.1.6 - Unauthenticated Information Exposure
Medium
CVE-2026-84091
SUMIT Payment Gateway for WooCommerce <= 3.0.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-66676
Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization
Medium
CVE-2026-73999
Cooked – Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-74000
Simple Membership <= 4.8.2 - Missing Authorization
Medium
CVE-2026-74002
Booking Calendar <= 11.7 - Missing Authorization
Medium
CVE-2026-74017
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
Medium
CVE-2026-74005
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery
Medium
CVE-2026-78294
Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-78295
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery
Medium
CVE-2026-78528
BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.