Medium
CVE-2026-2559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-1463
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
High
CVE-2026-25458
Moments <= 2.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-2373
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
High
CVE-2026-25464
Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
High
CVE-2026-24981
Visionary Core <= 1.4.9 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-27045
WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-24359
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
High
CVE-2026-24974
Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-27048
The Aisle Core <= 2.0.5 - Unauthenticated Local File Inclusion
High
CVE-2026-24978
Jobica Core <= 1.4.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-27047
Curly Core <= 2.1.6 - Unauthenticated Local File Inclusion
High
CVE-2026-24976
Organici Library <= 2.1.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-39496
YayMail <= 4.3.3 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-2233
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
Medium
CVE-2026-39464
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.19.8 - Authenticated (Editor+) Server-Side Request Forgery
Medium
CVE-2026-4063
Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation
Medium
CVE-2026-3986
Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
Medium
CVE-2026-2257
GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
Medium
CVE-2026-2879
GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
High
CVE-2026-2890
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
High
CVE-2026-3045
Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
High
CVE-2026-27065
BuilderPress <= 2.0.1 - Unauthenticated Local File Inclusion
High
CVE-2026-2626
Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.