High
CVE-2026-97248
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-96343
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection
High
CVE-2026-86841
Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection
High
CVE-2026-19804
s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
High
CVE-2026-95866
User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
Medium
CVE-2026-93656
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
High
CVE-2026-93901
Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
High
CVE-2026-89426
Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
Medium
CVE-2026-92212
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
High
CVE-2026-97246
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-94121
10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-94076
GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-94678
Go Live Update Urls <= 7.0.8 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-94677
Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-96833
Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-85682
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
Medium
CVE-2026-95603
Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection
High
Exploited in attacks
CVE-2026-87902
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
High
CVE-2026-80513
wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-91827
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-91092
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
Medium
CVE-2026-18345
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
Critical
CVE-2026-13355
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Critical
CVE-2026-19658
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.