Medium
CVE-2026-9188
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Medium
CVE-2026-12657
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
Medium
CVE-2026-12472
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
Medium
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Critical
CVE-2026-15158
Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
A critical vulnerability in Blocksy Companion allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution when the premium edition is active with specific extensions.
Medium
CVE-2026-12754
VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
Medium
CVE-2026-11988
LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
Medium
CVE-2026-12127
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
High
CVE-2026-10513
Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
High
CVE-2026-27414
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-27060
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-27436
Five Star Business Profile and Schema <= 2.3.19 - Authenticated (Editor+) Arbitrary Code Execution
Medium
CVE-2026-57680
Kirki <= 6.0.11 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-57677
Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection
High
CVE-2026-57621
Booktics <= 1.0.21 - Unauthenticated PHP Object Injection
Medium
CVE-2026-57676
Simple User Avatar <= 4.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-9242
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
Medium
CVE-2026-12432
Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
Critical
CVE-2026-12415
Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
Medium
CVE-2026-57643
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-57658
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-56057
Uncanny Automator Pro <= 7.3.0.6 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-56053
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-10749
Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.