Medium
CVE-2026-24968
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-3226
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
High
CVE-2026-3231
Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
Medium
CVE-2026-3492
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
High
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Medium
CVE-2026-2917
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Medium
CVE-2026-2918
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
High
CVE-2025-13067
Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
High
CVE-2026-3453
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
Medium
CVE-2026-1781
MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
High
CVE-2026-1454
Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-27076
LuxeDrive <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-27080
Deston <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-27077
MultiOffice <= 1.2 - Unauthenticated Local File Inclusion
Medium
aa7b7474-c170-42a2-be88-0fe410a2e71b
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
High
CVE-2026-27081
Rosebud - Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
High
CVE-2026-27084
Buisson <= 1.1.11 - Unauthenticated PHP Object Injection
High
CVE-2026-27075
Belfort <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-27083
Work & Travel Company <= 1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-0677
Photo Contest | Competition | Video Contest <= 2.9.1 - Authenticated (Author+) PHP Object Injection
High
CVE-2026-27082
Love Story <= 1.3.12 - Unauthenticated PHP Object Injection
High
CVE-2026-27078
Emaurri <= 1.0.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24364
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.5 - Missing Authorization
High
CVE-2026-27079
Amfissa <= 1.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.