Medium
CVE-2026-94161
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-96607
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-32557
WooCommerce Appointments <= 5.3.2 - Unauthenticated SQL Injection
Medium
CVE-2026-96334
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
High
CVE-2026-94167
Kubio AI Page Builder <= 2.9.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-95589
Advanced Partial Payment or Deposit for WooCommerce <= 4.0.1 - Missing Authorization
High
CVE-2026-94170
Social Sharing Plugin – Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94665
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
CVE-2026-94503
Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-32570
Progressify - Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting
High
CVE-2026-32569
WP Media folder <= 6.2.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-103066
WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-100511
VK Google Job Posting Manager <= 1.3.1 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-100506
WP Spell Check <= 12.1 - Authenticated (Author+) PHP Object Injection
High
CVE-2026-97257
Simple Event Planner <= 1.5.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-93617
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 - Authenticated (Custom Role+) PHP Object Injection
High
CVE-2026-103348
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 - Authenticated (Custom Role+) PHP Object Injection
Medium
CVE-2026-103349
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-97303
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more <= 3.0.2 - Missing Authorization
High
CVE-2026-103352
WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Unauthenticated SQL Injection
High
CVE-2026-97283
Advanced Post Manager <= 4.5.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-97309
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-97070
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-97305
Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.