High
CVE-2026-84812
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-75134
SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting
Medium
CVE-2026-84756
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-84781
Gallery PhotoBlocks <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-84771
PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.3 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-84761
LiteSpeed Cache <= 7.9 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-82194
WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2026-81427
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2025-7963
Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
High
CVE-2026-75528
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Medium
CVE-2026-3850
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Critical
CVE-2026-78657
SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
High
CVE-2026-14357
DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
Medium
CVE-2026-3851
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
High
CVE-2026-14982
WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
High
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
High
CVE-2026-81286
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
High
CVE-2026-81772
Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Medium
CVE-2026-83547
Xpro Elementor Addons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-83533
Express Checkout <= 2.4.8 - Unauthenticated Payment Bypass
Medium
CVE-2026-82223
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.22 - Missing Authorization
Medium
CVE-2025-15692
Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-81769
Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-81288
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.