Medium
CVE-2026-13414
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-81291
Uncode <= 2.12.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-80311
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-81299
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-81757
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-5934
WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
High
CVE-2026-19225
Defender Security – Malware Scanner, Login Security & Firewall < 6.2.0 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-3423
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Medium
CVE-2026-78363
MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-81346
Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion
High
CVE-2026-13598
RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin) < 1.3.0 - Unauthenticated Privilege Escalation
High
CVE-2026-15990
Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
Medium
CVE-2026-81278
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Medium
CVE-2026-19226
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-13406
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Missing Authorization
Medium
CVE-2026-78276
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-74916
WP Fastest Cache – WordPress Cache Plugin 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning
Medium
CVE-2026-77701
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
Medium
CVE-2026-78273
Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-14550
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System < 3.0.18 - Missing Authorization
Medium
CVE-2026-81279
Push Notification for Post and BuddyPress <= 3.20 - Missing Authorization
Critical
CVE-2026-77002
SmilePass Selfie Login <= 1.0.2 - Authentication Bypass to Administrator
Medium
CVE-2026-78146
Simple Newsletter Plugin – Noptin < 4.3.3 - Missing Authorization
Medium
CVE-2026-80433
SureFeedback Client Site <= 1.2.12 - Authenticated (Subscriber+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.