High
CVE-2026-19887
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-15984
QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
High
CVE-2026-78438
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
High
CVE-2026-19769
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Medium
CVE-2026-18843
Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
High
CVE-2026-75914
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Low
ghsa-6hxq-p678-4hr2
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
High
CVE-2026-77263
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
High
CVE-2026-77233
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
Critical
CVE-2026-13447
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
Medium
CVE-2026-8623
Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
Medium
CVE-2026-83628
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Medium
CVE-2026-18404
Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
Critical
CVE-2026-83627
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
Medium
CVE-2026-8625
Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
Medium
CVE-2026-80437
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-27347
JetPopup <= 2.0.20.2 - Missing Authorization
Medium
CVE-2026-27432
WP Rentals - Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2025-9049
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
Medium
CVE-2026-85311
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.60 - Missing Authorization
Medium
CVE-2026-79632
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
High
CVE-2026-81543
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Medium
CVE-2025-14945
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.