High
CVE-2026-82845
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Medium
CVE-2026-62134
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-6642
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
Medium
CVE-2026-18386
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
Medium
CVE-2026-15823
Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Medium
CVE-2026-19946
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Medium
CVE-2026-7804
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Medium
CVE-2026-11363
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
High
CVE-2026-81784
Wise Chat <= 3.4 - Unauthenticated PHP Object Injection
High
CVE-2026-16502
Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
Critical
CVE-2026-75816
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
Medium
b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-4361
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Medium
CVE-2026-18843
Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
Critical
CVE-2026-15354
ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Medium
f72c0a27-9602-4465-a14a-15c2a34e578b
Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
High
CVE-2026-84753
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
High
CVE-2026-84834
JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
High
CVE-2026-84752
RTMKit <= 2.1.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-81772
Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
High
CVE-2026-81283
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-19806
Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
High
CVE-2026-66047
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.