Medium
CVE-2026-62091
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-89417
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
High
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
Medium
CVE-2026-105879
JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-42699
FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-42696
SiteVault – Backup, Restore, Migration & Cloning <= 1.5.18 - Unauthenticated Remote Code Execution
High
CVE-2026-93947
Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection
High
CVE-2026-40803
Jotform – AI Chatbot <= 3.8.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-40804
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42697
Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39801
AI Copilot – Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation
Critical
CVE-2026-39802
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 - Unauthenticated Remote Code Execution
Medium
CVE-2026-40801
Wordable – Export Google Docs to WordPress <= 8.2.10 - Missing Authorization
High
CVE-2026-39800
Additional Order Filters for WooCommerce <= 1.24 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-105436
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-42633
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-40800
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-42702
Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
High
4a3e3e6e-9c17-4ac5-9f83-1e01365436e9
WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
High
CVE-2026-39799
WP File Download <= 6.3.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42630
Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure
Medium
CVE-2026-42419
Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure
Medium
CVE-2026-40777
wpsection <= 1.5.1 - Missing Authorization
Medium
CVE-2026-42695
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.