Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 1,681

Reset filters

High 10.07.2026

CVE-2026-57767

WP Google Maps Pro <= 10.1.02 - Unauthenticated Stored Cross-Site Scripting

The WP Google Maps Pro plugin for WordPress is vulnerable to stored cross-site scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into pages.

High 09.07.2026

CVE-2026-13430

Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import

High 09.07.2026

CVE-2026-12595

LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback

High 09.07.2026

CVE-2026-12598

LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback

High 09.07.2026

CVE-2026-13492

UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field

High 09.07.2026

CVE-2026-57738

777 <= 1.13.0 - Unauthenticated PHP Object Injection

High 09.07.2026

CVE-2026-59518

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection

High 09.07.2026

CVE-2026-57710

WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload

High 09.07.2026

CVE-2026-57770

Grand Photography WordPress <= 5.7.8 - Unauthenticated PHP Object Injection

Medium 08.07.2026

CVE-2026-9027

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint

Medium 08.07.2026

CVE-2026-12428

Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter

High 08.07.2026

CVE-2026-8848

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation

Critical 08.07.2026

CVE-2026-14245

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter

High 08.07.2026

CVE-2026-5523

Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form

High 08.07.2026

CVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

High 07.07.2026

CVE-2026-14495

DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

High 07.07.2026

CVE-2026-57371

WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection

Medium 07.07.2026

CVE-2026-59521

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 3.1.15 - Authenticated (Administrator+) PHP Object Injection

High 06.07.2026

CVE-2026-57744

RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated PHP Object Injection

High 06.07.2026

CVE-2026-57724

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection

Critical 03.07.2026

CVE-2026-12497

ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation

Medium 02.07.2026

CVE-2026-8489

Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

Medium 02.07.2026

CVE-2026-9180

MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter

Medium 01.07.2026

CVE-2026-9145

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 1,681

Know which vulnerabilities affect your application

Application security in your inbox