Critical
CVE-2026-32579
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-39719
PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-95526
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization
High
CVE-2026-94664
PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 - Unauthenticated Arbitrary File Read
High
CVE-2026-94666
Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Arbitrary File Read
Critical
CVE-2026-94503
Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-94271
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
Medium
CVE-2026-94270
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
Medium
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
High
CVE-2026-97660
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
High
CVE-2026-75028
WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
Critical
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
Medium
CVE-2026-97344
Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
High
CVE-2026-96650
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
Medium
1f0a1439-d10c-4dfc-9a40-7319debe3c51
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Medium
CVE-2026-102797
ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-97637
JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
High
CVE-2026-93756
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
High
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
High
CVE-2026-92174
SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
Critical
CVE-2026-15896
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
High
CVE-2026-10026
CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
Critical
CVE-2026-103065
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution
Medium
CVE-2026-103082
LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.