Medium
CVE-2026-27330
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-78281
CP Media Player – Audio Player and Video Player <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-32479
Visitor Traffic Real Time Statistics pro <= 11.17 - Unauthenticated SQL Injection
Medium
CVE-2026-5092
Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
Medium
CVE-2026-16569
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.69 - Missing Authorization to Authenticated (Subscriber+) Stock Update
High
CVE-2026-78261
Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-78288
Beautiful taxonomy filters <= 2.4.6 - Unauthenticated SQL Injection
Medium
CVE-2026-18547
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Medium
CVE-2026-77824
Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Medium
CVE-2026-17587
My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions
Medium
CVE-2026-75908
Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
High
CVE-2026-75971
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
High
CVE-2026-19949
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
Medium
CVE-2026-76128
eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-18100
MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
Medium
CVE-2026-18512
TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
High
CVE-2026-18328
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
High
CVE-2026-18323
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
High
CVE-2026-16601
CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
Medium
CVE-2026-12561
tagDiv Composer <= 5.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19892
InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
Medium
CVE-2026-19943
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
Medium
CVE-2026-75930
FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
Medium
CVE-2026-76063
FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.