Critical
CVE-2026-18080
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 391
Reset filters
Medium
CVE-2026-15790
Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
Medium
CVE-2026-9767
The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter
Medium
CVE-2026-18402
SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute
Medium
CVE-2026-15441
Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
Medium
CVE-2026-16294
PowerPress Podcasting plugin by Blubrry < 11.17.1 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2026-65640
WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
Medium
CVE-2026-14549
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
Medium
CVE-2026-14548
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
Medium
CVE-2026-13701
Advanced Excerpt <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2026-4431
Easy Post Submission <= 2.3.0 - Missing Authorization
High
CVE-2026-18881
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
Medium
CVE-2026-5651
Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
Medium
CVE-2026-5108
Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
Medium
CVE-2026-15941
Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-11421
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
High
CVE-2026-18322
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
Medium
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Medium
CVE-2026-17555
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Medium
CVE-2026-16087
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Medium
CVE-2026-16614
GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Medium
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
Medium
CVE-2026-18436
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
Medium
CVE-2026-15267
Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.