Medium
CVE-2026-97634
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-100182
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Medium
CVE-2026-97338
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
High
CVE-2026-95817
DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-12951
MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
High
CVE-2026-97663
Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
High
CVE-2026-102772
CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
High
CVE-2026-97336
CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
High
CVE-2026-102565
BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
High
CVE-2026-90438
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
High
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
High
CVE-2026-93875
JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
Medium
CVE-2026-78471
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Medium
CVE-2026-84925
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
High
CVE-2026-15897
Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
High
CVE-2026-92174
SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
Critical
CVE-2026-15896
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Critical
CVE-2026-19660
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
Critical
CVE-2026-19652
Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
High
CVE-2026-10026
CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
High
CVE-2026-93367
Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
Critical
CVE-2026-14378
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
Medium
CVE-2026-96451
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-103342
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.