High
CVE-2026-19116
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Critical
CVE-2026-15980
MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
Medium
CVE-2026-76547
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-14558
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-82226
Tickera – Sell Tickets & Manage Events <= 3.6.0.2 - Unauthenticated PHP Object Injection
High
CVE-2026-19848
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-14307
GeotargetingWP < 3.5.6.2 - Reflected Cross-Site Scripting
High
CVE-2026-18983
One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
High
CVE-2026-18324
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Medium
CVE-2026-15798
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
Medium
CVE-2026-78276
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-15985
Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
Critical
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
High
CVE-2026-78292
Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-78286
Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
High
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-18547
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
High
CVE-2026-75971
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
High
CVE-2026-78262
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection
High
CVE-2026-78265
The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection
High
CVE-2026-32563
ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-0551
PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
Critical
CVE-2026-4703
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
Medium
CVE-2026-3424
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.