Medium
CVE-2026-86608
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-15664
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
Medium
CVE-2026-12402
OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
Medium
CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
High
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Medium
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Critical
CVE-2026-84434
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Medium
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
High
CVE-2026-85017
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-18405
Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-92622
Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Medium
CVE-2026-92714
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
High
CVE-2026-17086
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
Medium
8b8d4431-ac72-45a2-b4a1-19690946d0ee
WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
High
CVE-2026-84738
AF Companion <= 2.1.0 - Authenticated (Shop Manager+) Remote Code Execution
Medium
CVE-2026-15758
3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
Critical
b8a7a925-2b9e-43bc-b649-c7ec518e063c
Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
High
CVE-2026-84099
IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection
Critical
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
High
CVE-2026-62107
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Unauthenticated PHP Object Injection
High
CVE-2026-62103
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.0 - Unauthenticated PHP Object Injection
High
CVE-2026-82925
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection
High
CVE-2026-62105
ThemeREX Addons < 2.45.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-12215
OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.