High
CVE-2026-56055
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Critical
CVE-2026-12416
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
Critical
CVE-2026-12417
SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
High
CVE-2026-8705
ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
High
CVE-2026-56031
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-12583
Newsletters <= 4.14 - Unauthenticated PHP Object Injection
High
CVE-2026-7761
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
High
CVE-2026-56037
Themify Popup <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-56032
BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-12081
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-54835
Five Star Restaurant Menu and Food Ordering <= 2.5.2 - Missing Authorization
Low
CVE-2026-12102
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
Medium
CVE-2026-12136
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-12137
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
Medium
CVE-2026-12093
Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
Medium
CVE-2026-11784
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
High
CVE-2026-12378
BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-54830
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 - Missing Authorization
High
CVE-2026-54806
WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-12115
Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
Medium
CVE-2026-2381
WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
High
CVE-2026-8442
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
High
CVE-2026-54194
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-12256
Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.