Medium
CVE-2026-19723
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-80439
Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-84848
Quick Event Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-85308
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-84754
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.12.13 - Missing Authorization
Medium
CVE-2025-15694
Joli Table Of Contents 2.0.0 - 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-84215
Timetics – Appointment Booking Calendar & Scheduling <= 1.0.61 - Missing Authorization
Medium
CVE-2026-84847
Quick Event Manager <= 9.17 - Missing Authorization
High
CVE-2026-81737
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-81423
Accept Stripe Payments < 2.1.4 - Unauthenticated Open Redirect
Medium
CVE-2026-84849
Pre-Orders for WooCommerce <= 2.3.1 - Missing Authorization
High
CVE-2026-84753
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-85305
SEOPress – AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-19859
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-19862
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection
Medium
CVE-2026-84936
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
High
CVE-2026-84815
Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-19084
Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read
High
CVE-2026-84834
JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
High
CVE-2026-65842
Plate: SSRF with response disclosure in DOCX image embedding
High
CVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
High
CVE-2026-62232
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Medium
CVE-2026-61450
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.