Medium
CVE-2026-18335
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Critical
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
High
CVE-2026-77193
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
High
CVE-2026-78397
Link Library <= 7.9.5 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-95525
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-95523
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
High
Exploited in attacks
CVE-2026-87902
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
Medium
CVE-2026-15095
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
High
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
High
CVE-2025-1281
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-92969
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
Medium
CVE-2026-84046
Directorist <= 8.9.4 - Authenticated (Subscriber+) Server-Side Request Forgery
Critical
CVE-2026-75799
YAHMAN Add-ons <= 0.9.30 - Unauthenticated Remote Code Execution
Medium
CVE-2026-87071
Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Medium
CVE-2026-87978
Paymob for WooCommerce <= 4.1.13 - Unauthenticated Payment Bypass
High
CVE-2026-82843
OAuth Server <= 6.3.0 - Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
Critical
CVE-2026-82187
WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-1641
Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
Medium
CVE-2026-9855
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Critical
CVE-2026-89274
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
High
CVE-2026-92807
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
High
CVE-2026-81650
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-16542
Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.