Medium
CVE-2026-86809
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-14560
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-15695
Translate WordPress with GTranslate < 3.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-15690
Content Mask 1.7.1 - 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-14559
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-26212
Rara One Click Demo Import <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-81805
SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps <= 2.1.5 - Unauthenticated Privilege Escalation
Medium
CVE-2026-85310
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal
Medium
CVE-2026-14565
Advanced Customized Prompts <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-86813
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection
Medium
CVE-2026-82848
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.3.1 - 2.3.3 - Unauthenticated Information Exposure
Medium
CVE-2026-81804
ZHBackup – Backup, Restore & Migration <= 2.4.2 - Unauthenticated Information Exposure
Medium
CVE-2026-85116
Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-82530
IP2Location Country Blocker <= 2.44.0 - IP Soofing
High
CVE-2026-81800
Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated SQL Injection
High
CVE-2026-86779
Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.6 - Authenticated (Contributor+) Arbitrary File Deletion
Medium
CVE-2026-78536
Robokassa payment gateway for Woocommerce <= 1.8.9 - Missing Authorization
Medium
CVE-2026-84821
WP Fast Total Search – The Power of Indexed Search <= 1.82.284 - Missing Authorization
Medium
CVE-2026-14566
Advanced Customized Prompts <= 1.0.1 - Missing Authorization
Medium
CVE-2026-81785
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.9.0 - Missing Authorization
Medium
CVE-2026-86996
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
High
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Medium
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.