High
CVE-2026-91827
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-82849
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-93341
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests
High
CVE-2026-92438
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-89005
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-80338
CMB2 <= 2.12.0 - Missing Authorization
Medium
CVE-2026-88788
Text Styler <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-88846
MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration
Medium
CVE-2026-88845
MasterStudy LMS <= 3.7.49 - Missing Authorization
Medium
CVE-2026-93662
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-89004
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-95600
TrustedLogin Connector <= 2.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-15095
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
High
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
Medium
CVE-2025-14486
PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
Medium
CVE-2025-14484
Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
High
CVE-2025-1281
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-14487
Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Medium
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-9004
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
Medium
CVE-2026-7622
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Medium
CVE-2026-16778
Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Medium
CVE-2026-1645
Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Medium
CVE-2026-91092
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.