Medium
CVE-2026-77116
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-15049
Depicter — Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-19406
Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-74992
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-18466
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization
Medium
CVE-2026-5093
Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
Medium
CVE-2026-19697
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-4244
Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
Medium
CVE-2026-4561
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
Medium
CVE-2026-19416
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
High
CVE-2026-2996
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
Critical
CVE-2026-75860
JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution
Medium
CVE-2026-19615
Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-18031
TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-19782
WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-18231
WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure
High
CVE-2026-13405
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-16058
YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure
High
CVE-2026-16950
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection
High
CVE-2026-16617
Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
Medium
CVE-2026-3424
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
Medium
CVE-2026-16979
SmartCrawl SEO checker, analyzer & optimizer < 3.16.3 - Missing Authorization
Medium
CVE-2026-19709
Membership For WooCommerce < 3.1.2 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.