High
CVE-2026-66650
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-66672
Flatastic <= 2.0 - Unauthenticated PHP Object Injection
Critical
CVE-2026-32475
Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass
Medium
CVE-2026-74012
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-73364
Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection
High
CVE-2026-73389
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
High
CVE-2026-73993
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
High
CVE-2026-66583
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
High
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
High
CVE-2026-73380
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-66620
OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-73397
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-73341
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection
High
CVE-2026-73376
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection
High
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-13174
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
Medium
CVE-2026-13169
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
Critical
CVE-2024-13784
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-18347
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
Medium
CVE-2026-10035
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-18385
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
Medium
CVE-2026-15009
Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
Medium
CVE-2026-13167
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.