High
CVE-2026-15142
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Critical
CVE-2026-16142
TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
Medium
CVE-2026-18391
WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-73997
Kadence Starter Templates — Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service
High
CVE-2026-32465
Essential Real Estate <= 5.3.3 - Authenticated (Customer+) PHP Object Injection
High
CVE-2026-32470
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
Critical
CVE-2026-12949
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
Medium
CVE-2026-12743
affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-27380
Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-28149
Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-18961
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
High
CVE-2026-13457
InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
High
CVE-2026-15426
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Medium
CVE-2026-18200
FoodBoxBooker <= 1.0.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update
Medium
CVE-2026-66454
WP Social Avatar <= 1.5 - Missing Authorization
High
CVE-2026-65571
69 Clothing | Brand Store & Fashion Boutique WordPress Theme <= 1.2.11.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-65582
AI Hub - Startup & Technology WordPress Theme <= 1.3.10 - Authenticated (Subscriber+) Arbitrary File Dowload
High
CVE-2026-65575
Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor <= 1.5.3 - Unauthenticated PHP Object Injection
High
CVE-2026-65579
Agricola - Agriculture & Organic Farm Theme <= 1.21.0 - Unauthenticated PHP Object Injection
High
CVE-2026-65573
Abelle <= 1.22 - Unauthenticated PHP Object Injection
High
CVE-2026-65577
Advice - Psychology, Therapy & Counseling Theme <= 1.18.0 - Unauthenticated PHP Object Injection
High
CVE-2026-65576
Adrena | Airsoft Club & Paintball WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
High
CVE-2026-65581
AI ANN - AI Generator & AI Agency WordPress Theme <= 1.29.0 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.