Medium
CVE-2026-79618
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-97249
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation
Medium
CVE-2026-91020
WebToffee Gift Cards for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary Gift Card Price Manipulation
Critical
CVE-2026-82901
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
Medium
CVE-2026-89003
WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-89000
WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-86838
Bookly <= 28.2 - Unauthenticated Payment Bypass
High
CVE-2026-88843
MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-13456
WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
Medium
CVE-2026-12037
Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
Medium
CVE-2026-17602
SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
High
CVE-2026-19804
s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
High
CVE-2026-92713
Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
Medium
CVE-2026-94376
Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Medium
CVE-2026-92799
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Medium
CVE-2026-89411
Paymattic <= 4.6.25 - Unauthenticated Payment Bypass
High
CVE-2026-84069
WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion
Medium
CVE-2026-96524
MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery
High
CVE-2026-96837
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-96824
Template Kit – Import <= 1.0.16 - Authenticated (Editor+) Arbitrary File Deletion
High
CVE-2026-96533
Testimonials Widget <= 4.0.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-96526
MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-96525
MCP Server for WordPress <= 1.8.1 - Missing Authorization
High
CVE-2026-94123
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.