High
CVE-2026-32554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-78277
FluentCRM PRO <= 3.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-32476
Brave Conversion Engine (PRO) <= 0.8.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28167
Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read
High
CVE-2026-32558
WordPress & WooCommerce Affiliate Program <= 8.9.1 - Unauthenticated Privilege Escalation
Critical
CVE-2026-78284
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-16986
Booking Package < 1.7.25 - Unauthenticated Price Manipulation
Medium
CVE-2026-78290
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-77789
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-77758
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Information Exposure
High
CVE-2026-28166
Tour Master - Tour Booking, Travel, Hotel <= 5.4.9 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-16747
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution
Medium
CVE-2026-19435
Duplicate Post < 1.5.6 - Missing Authorization
Medium
CVE-2026-16959
Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-13176
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-77694
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion
Medium
CVE-2026-75796
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-16962
Tamara Checkout <= 1.9.9.20 - Unauthenticated Payment Bypass
Medium
CVE-2026-14601
Link Whisper Free < 0.9.7 - Authenticated (Editor+) SQL Injection
High
CVE-2026-32559
UltimateAI <= 3.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-78278
Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-78279
Fluent Support Pro <= 2.3.1 - Cross-Site Request Forgery
Medium
CVE-2026-32471
ProLancer Element <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-15150
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.