High
CVE-2026-84218
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-3851
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
High
CVE-2026-14982
WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
High
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
High
CVE-2026-81286
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
High
CVE-2026-81772
Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Medium
CVE-2026-83547
Xpro Elementor Addons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-83533
Express Checkout <= 2.4.8 - Unauthenticated Payment Bypass
Medium
CVE-2026-82223
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.22 - Missing Authorization
Medium
CVE-2025-15692
Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-81769
Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-81288
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-82884
All in One SEO <= 5.0.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-81294
Authorizer <= 3.15.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-19698
GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection
Medium
CVE-2026-82883
Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-81770
MapGeo – Interactive Geo Maps <= 1.6.30 - Reflected Cross-Site Scripting
Medium
CVE-2026-81774
Product Attachment for WooCommerce <= 2.3.3 - Unauthenticated Information Exposure
High
CVE-2026-77009
WatchMan-Site7 <= 4.2.0 - Authenticated (Subscriber+) Remote Code Execution
High
CVE-2026-81289
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.13.1 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-9055
Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
High
CVE-2026-81283
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
Medium
ghsa-rgwj-5xj2-c3m3
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
High
CVE-2026-71415
Kirby: File upload permissions are not checked during processing of chunk data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.