High
CVE-2026-1542
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-2471
WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
High
CVE-2026-28074
Pizza House <= 1.4.0 - Unauthenticated PHP Object Injection
Medium
e5b98a2c-faed-4e2b-8b94-31e2be95ad40
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter
High
CVE-2026-28124
Notarius - Legal Advisor WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
High
CVE-2026-28105
Good Energy <= 1.7.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-2489
TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
High
CVE-2026-23798
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-27352
Starto < 2.2.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-2301
Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
High
CVE-2026-27379
NextScripts: Social Networks Auto-Poster <= 4.4.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-27369
Celeste <= 1.3.6 - Unauthenticated PHP Object Injection
High
CVE-2026-27439
Dentario <= 1.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39690
Author Avatars List/Block <= 2.1.25 - Missing Authorization
High
CVE-2026-27438
Kingler <= 1.7 - Unauthenticated PHP Object Injection
High
CVE-2026-27437
Tennis SportClub - Tennis Sports Events WordPress Theme <= 1.2.3 - Unauthenticated PHP Object Injection
High
CVE-2026-27417
Sweet Date < 4.0.1 - Unauthenticated PHP Object Injection
High
CVE-2026-23544
Valenti <= 5.6.3.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-23542
Grand Restaurant <= 7.0.10 - Unauthenticated PHP Object Injection
Medium
CVE-2026-1942
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
Medium
CVE-2026-2230
Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
High
CVE-2026-1426
Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility
High
CVE-2026-22384
Applay - Shortcodes <= 3.7 - Authenticated (Contributor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.