High
CVE-2026-19807
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
CVE-2026-15989
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
Critical
CVE-2026-75957
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
High
CVE-2026-93882
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
High
CVE-2026-96561
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
Medium
CVE-2026-91109
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
High
CVE-2026-92245
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
Medium
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Medium
CVE-2026-102392
Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-100512
Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-97291
Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-102377
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-97256
Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-102385
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-94389
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution
Medium
CVE-2026-97318
Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Open Redirect
Medium
CVE-2026-97282
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-97274
OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 - Unauthenticated Authentication Bypass
Medium
CVE-2026-97317
Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Information Exposure
Medium
CVE-2026-62078
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-100508
Two Factor <= 0.16.0 - Unauthenticated Denial of Service
Medium
CVE-2026-62083
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment
Medium
CVE-2026-97074
Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-75098
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.